"Personal information" means anything linkable to you, your household or your device
In this notice, personal information is information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you, your household or your device. Epic says you may provide such information by using an Epic Website or Application, and tells you to read the privacy policy associated with the site or app you use to see which personal information you may provide while using it.
Supporting quotations
By using an Epic Website or Application, you may provide Epic with information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you, your household, or your device (“personal information“).
Please review the privacy policy associated with the Epic Website or Application you use to review the personal information you may provide to Epic during your use.
Qualifications & exceptions
The definition reaches information about your household and your device, not only information about you.
Information can count even if it is only indirectly linkable to you.
Not stated here
The privacy policy associated with each Epic Website or Application is not part of this source, so the specific information each one collects is not supplied here.
Data Access & Collection · Company practice
Identifiers and customer-record data: received from Epic websites, not mobile or Mac apps
Epic's collection table, which covers what Epic received from users in the last 12 months, says two categories came from its websites but not from its mobile and MacOS applications. Category A, identifiers, includes examples such as a real name, alias, postal address, unique personal or online identifier, IP address, email address, account name, Social Security number, driver's license number and passport number. Category B, the categories listed in the California Customer Records statute, includes examples such as name, signature, physical description, address, telephone number, insurance policy number, education, employment history, bank account or card numbers and other financial information, medical information and health insurance information; the table notes that some of this information may overlap with other categories. For both rows the table reads "Mobile and MacOS applications: No" and "Other Epic websites: Yes". The examples describe what each category can include; a "Yes" marks that Epic received the category, not that it received every example listed.
Supporting quotations
In particular, Epic has received the following categories of personal information from users of Epic Websites or Applications within the last 12 months (indicated with a “Yes”):
A. Identifiers.
A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.
Mobile and MacOS applications: No
Other Epic websites: Yes
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).
A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.
Some personal information included in this category may overlap with other categories.
Mobile and MacOS applications: No
Other Epic websites: Yes
Qualifications & exceptions
Covers what Epic received in the last 12 months; it is a look-back statement, not a promise about future collection.
Mobile and MacOS applications are marked No for both categories; other Epic websites are marked Yes.
Some category B information may overlap with other categories.
Not stated here
The table does not name MyChart or MyChart Central, so it does not say which line applies to MyChart Central used in a web browser.
The table does not say which listed examples Epic actually received.
The table does not explain how it treats information that healthcare organizations hold through MyChart; the notice separately excludes information stored or used by healthcare systems or other HIPAA Covered Entities from its access and deletion rights.
The California Customer Records statute (Cal. Civ. Code § 1798.80(e)) is cited but not supplied.
Data Access & Collection · Company practice
Browsing and interaction activity: received from Epic websites, not mobile or Mac apps
Category F, internet or other similar network activity, covers examples such as browsing history, search history and information on how you interact with a website, application or advertisement. Epic's table of what it received from users in the last 12 months marks this category "Mobile and MacOS applications: No" and "Other Epic websites: Yes", so Epic says it received this kind of activity information through its websites but not through its mobile and MacOS apps.
Supporting quotations
In particular, Epic has received the following categories of personal information from users of Epic Websites or Applications within the last 12 months (indicated with a “Yes”):
F. Internet or other similar network activity.
Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.
Mobile and MacOS applications: No
Other Epic websites: Yes
Qualifications & exceptions
Covers what Epic received in the last 12 months; it is a look-back statement.
Mobile and MacOS applications are marked No; other Epic websites are marked Yes.
Not stated here
The notice does not say how this activity is collected (for example which tracking technologies), or what it is used for beyond the general purposes listed later.
The table does not name MyChart or MyChart Central, so it does not say which line applies to MyChart Central used in a web browser.
Data Access & Collection · Company practice
Protected characteristics received only via Careers and MyChart Vaccination Registration
Category C covers protected classification characteristics under California or federal law. Its examples are age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, and genetic information (including familial genetic information). Epic's table of what it received in the last 12 months marks this category Yes for Careers.epic.com and MyChart Vaccination Registration, and No for other Epic Websites or Applications.
Supporting quotations
In particular, Epic has received the following categories of personal information from users of Epic Websites or Applications within the last 12 months (indicated with a “Yes”):
C. Protected classification characteristics under California or federal law.
Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).
Careers.epic.com and MyChart Vaccination Registration: Yes
Other Epic Websites or Applications: No
Qualifications & exceptions
Covers what Epic received in the last 12 months.
Only Careers.epic.com and MyChart Vaccination Registration are marked Yes; every other Epic Website or Application is marked No.
Not stated here
The table does not say which of the listed characteristics each of the two sites received.
Data Access & Collection · Company practice
Job history and performance information received via Careers, UserWeb, Epic Earth, Vendor Services, Open.epic
Category I, professional or employment-related information, covers current or past job history or performance evaluations. Epic's table of what it received in the last 12 months marks it Yes for Careers.epic.com, UserWeb and UserWeb-connected sites, Epic Earth, Vendor Services and Open.epic, and No for other Epic Websites or Applications.
Supporting quotations
In particular, Epic has received the following categories of personal information from users of Epic Websites or Applications within the last 12 months (indicated with a “Yes”):
I. Professional or employment-related information.
Current or past job history or performance evaluations.
Only the five listed sites are marked Yes; every other Epic Website or Application is marked No.
Data Access & Collection · Company practice
Non-public education records received only via the Careers site
Category J, non-public education information, is defined in the table by reference to the Family Educational Rights and Privacy Act (FERPA). Its examples are education records directly related to a student and maintained by an educational institution or a party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information or student disciplinary records. Epic's table of what it received in the last 12 months marks this category Yes for Careers.epic.com and No for other Epic Websites or Applications.
Supporting quotations
In particular, Epic has received the following categories of personal information from users of Epic Websites or Applications within the last 12 months (indicated with a “Yes”):
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).
Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.
Careers.epic.com: Yes
Other Epic Websites or Applications: No
Qualifications & exceptions
Covers what Epic received in the last 12 months.
Only Careers.epic.com is marked Yes.
Not stated here
The table cites FERPA (20 U.S.C. Section 1232g, 34 C.F.R. Part 99) for this category, but that law is not supplied by this source.
The table does not say which education records the Careers site received.
Data Access & Collection · Company practice
Commercial, biometric, geolocation and sensory data marked not received
Epic's table of what it received from users in the last 12 months marks four categories simply "No", with no site listed as an exception: D, commercial information (records of personal property, products or services purchased, obtained or considered, or other purchasing or consuming histories or tendencies); E, biometric information (such as fingerprints, faceprints, voiceprints, iris or retina scans, keystroke or gait patterns, and sleep, health or exercise data); G, geolocation data (physical location or movements); and H, sensory data (audio, electronic, visual, thermal, olfactory or similar information). The table looks back over 12 months; separately, Epic says it will not collect additional categories of personal information without providing you notice.
Supporting quotations
In particular, Epic has received the following categories of personal information from users of Epic Websites or Applications within the last 12 months (indicated with a “Yes”):
D. Commercial information.
Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
E. Biometric information.
Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.
G. Geolocation data. Physical location or movements.
H. Sensory data. Audio, electronic, visual, thermal, olfactory, or similar information.
No
No
No
No
We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.
Qualifications & exceptions
The No entries describe the last 12 months, not a permanent rule.
Epic commits to give notice before collecting additional categories of personal information.
Not stated here
The notice does not say how or when it would give notice of a new category.
The table does not explain how it treats health information that healthcare organizations hold through MyChart.
Data Access & Collection · Company practice
Epic gets personal information from you, from observing your actions on its sites and apps, and from your representative
Epic says its websites and applications obtain personal information from three categories of sources: directly from you, for example through forms you complete, communications you send and job applications you fill out; indirectly from you, for example by observing your actions on Epic Websites and Applications; and from your representative, for example when someone at your organization gives Epic information to create a UserWeb account on your behalf, register you for an Epic-hosted event, or list you as a developer for an application on Vendor Services. The examples end with "etc.", so they are not a complete list.
Supporting quotations
Epic Websites and Applications obtain personal information from the following categories of sources:
Directly from you. For example, from forms you complete, communications you send, job applications you fill out, etc.
Indirectly from you. For example, from observing your actions on the Epic Websites and Applications.
From your representative. For example, someone at your organization may provide Epic with information to create a UserWeb account on your behalf, register you for an Epic-hosted event, list you as a developer for an application on Vendor Services, etc.
Qualifications & exceptions
The examples for direct and representative sources are open-ended ("etc.").
Representative-provided information is described with organizational examples (UserWeb accounts, Epic-hosted events, Vendor Services developer listings).
Not stated here
The notice does not say how Epic observes your actions on its websites and applications, for example which technologies it uses.
The notice does not say which sources apply to which Epic Website or Application.