Retention & Deletion · User right or choice
You can ask Epic to delete information it collected from you, subject to listed exceptions
You have the right to ask Epic to delete personal information it collected from you and retained, subject to certain exceptions. Once Epic receives and confirms your verifiable consumer request, it says it will delete your personal information from its records, and direct its service providers to do the same, unless an exception applies. Epic may deny the request if keeping the information is necessary for Epic or its service providers to: complete a transaction for which the information was collected, provide something you requested, take actions reasonably anticipated within your ongoing relationship, or fulfill legal obligations; detect security incidents, protect against malicious, deceptive, fraudulent or illegal activity, or prosecute those responsible; debug products to repair errors that impair existing intended functionality; exercise free speech, ensure another consumer's free speech rights, or exercise another right provided by law; comply with the California Electronic Communications Privacy Act; engage in public or peer-reviewed scientific, historical or statistical research in the public interest that follows other applicable ethics and privacy laws, when deletion may likely make the research impossible or seriously impair it and you previously gave informed consent; enable solely internal uses reasonably aligned with consumer expectations based on your relationship with Epic; or make other internal and lawful uses compatible with the context in which you provided the information. If Epic cannot comply, its response will explain why. The deletion right does not cover personal information, including health information, that is stored or otherwise used by healthcare systems or other HIPAA Covered Entities.
Supporting quotations
You have the right to request that we delete any of your personal information that we have collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (see Exercising Access, Data Portability, and Deletion Rights), we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.
We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:
Complete a transaction for which we collected the personal information, provide something that you requested, take actions reasonably anticipated within the context of our ongoing relationship with you, or fulfill any legal obligations we may have.
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
Debug products to identify and repair errors that impair existing intended functionality.
Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.).
Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
We do not provide these deletion rights for personal information (including health information) that is stored or otherwise used by healthcare systems or other Covered Entities (as that term is defined in HIPAA).
The response we provide will also explain the reasons we cannot comply with a request, if applicable.
Qualifications & exceptions
- Covers personal information Epic collected from you and retained.
- Requires a verifiable consumer request that Epic receives and confirms.
- Epic "may" deny deletion when retention is necessary for one of the listed reasons, for Epic or its service providers.
- Excludes personal information (including health information) stored or otherwise used by healthcare systems or other HIPAA Covered Entities.
Not stated here
- The notice does not say whether information Epic received about you from others, such as your representative, counts as collected from you.
- The last two exceptions (internal uses aligned with consumer expectations, and other internal lawful uses compatible with the original context) are broad, and the notice does not say how Epic applies them.
- The California Electronic Communications Privacy Act is cited as "Cal. Penal Code § 1546 seq." in this source; the Act itself is not supplied.