Privacy Notice for California Residents

Epic MyChart · agreement dated February 16, 2026 · Official agreement

Read the agreement

3 of 28 cards in Sharing & Disclosure

Sharing & Disclosure · Permission or license

Epic may disclose personal information for a business purpose under a confidentiality and use-limit contract

Epic may disclose your personal information to a third party for a business purpose. When it does, Epic says it enters a contract that describes the purpose and requires the recipient both to keep that information confidential and not to use it for any purpose except performing the contract. Epic says it discloses personal information for a business purpose to its third party service providers. To see which individuals or third parties may have access to your personal information, the notice sends you to the privacy policy associated with the Epic Website or Application you use.

Supporting quotations

We may disclose your personal information to a third party for a business purpose.
When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.
We disclose your personal information for a business purpose to our third party service providers.
Please review the privacy policy associated with the Epic Website or Application you use in order to review the individuals or third parties that may have access to your personal information.

Qualifications & exceptions

  • The contract terms described cover disclosures made for a business purpose.
  • Recipients must keep the information confidential and use it only to perform the contract.

Not stated here

  • The notice does not name the service providers or other third parties.
  • "Business purpose" is not defined in this notice; as a CCPA-defined term it may carry the CCPA meaning, which is not supplied.
  • The associated privacy policies that list who may have access are not supplied by this source.

Sharing & Disclosure · Company practice

In the prior 12 months Epic disclosed seven categories of personal information for a business purpose

Epic says that in the preceding twelve months it disclosed these categories of personal information for a business purpose: A, identifiers; B, California Customer Records personal information categories; C, protected classification characteristics under California or federal law; F, internet or other similar network activity; I, professional or employment-related information; J, non-public education information; and K, inferences drawn from other personal information. These are the same seven categories the collection table marks Yes for at least some Epic Websites or Applications.

Supporting quotations

In the preceding twelve (12) months, Epic has disclosed the following categories of personal information for a business purpose:
Category A: Identifiers.
Category B: California Customer Records personal information categories.
Category C: Protected classification characteristics under California or federal law.
Category F: Internet or other similar network activity.
Category I: Professional or employment-related information.
Category J: Non-public education information.
Category K: Inferences drawn from other personal information.

Qualifications & exceptions

  • A look-back statement covering the preceding twelve months.

Not stated here

  • The list does not say which Epic Website or Application, or which recipients, each disclosed category relates to.

Sharing & Disclosure · Company commitment

Epic says it does not sell your information

The notice states that Epic does not sell your information. It makes this statement in the same paragraph that says Epic discloses personal information for a business purpose to its third party service providers.

Supporting quotations

We do not sell your information.

Qualifications & exceptions

  • Stated without exceptions in this notice.

Not stated here

  • The notice does not define "sell"; as a CCPA-defined term it may carry the CCPA meaning, which is not supplied.