California notice supplements Epic's privacy policies for California residents
This notice adds to the information in Epic Systems Corporation's privacy policies rather than replacing them. It applies to visitors and users who reside in California, whom it calls "consumers" or "you". Epic says it provides the notice in compliance with the California Consumer Privacy Act of 2018 (CCPA), and warns that some terms in the notice are defined by the CCPA, so their meanings may differ from the meanings used elsewhere on Epic's websites. This version is marked Last Updated: February 16, 2026.
Supporting quotations
This Privacy Notice for California Residents (“Notice”) supplements the information contained in Epic Systems Corporation’s (“Epic” or “we”) privacy policies and applies to visitors and users who reside in the State of California (“consumers” or “you”).
We provide this notice in compliance with the California Consumer Privacy Act of 2018 (CCPA).
Certain terms in this Notice are defined by the CCPA and their meanings may differ from the meanings that apply elsewhere on our websites.
Last Updated: February 16, 2026
Qualifications & exceptions
Applies only to visitors and users who reside in California.
Terms defined by the CCPA may carry a different meaning here than elsewhere on Epic's websites.
Not stated here
The notice does not list which of its terms carry CCPA meanings, and the CCPA itself is not supplied by this source.
The Epic privacy policies this notice supplements are not part of this source.
Legal Rights & Agreement Rules · Context
Notice covers Epic's public websites and apps, including MyChart and MyChart Central
The notice applies to your use of Epic resources that are publicly available on the internet. The list is open-ended ("include but are not limited to") and names, among others, Epic.com, Epic's Careers website, UserWeb and UserWeb-connected websites, Epic Earth, Open.epic, Vendor Services, EpicLink, Epic on FHIR, EpicShare, websites for UGM and other Epic-hosted events, MyChart Vaccination Registration, Lucy, and Epic's applications such as MyChart (including MyChart Central), Rover and Hyperspace for MacOS. Each of these is an "Epic Website or Application", the term the rest of the notice uses.
Supporting quotations
This Notice applies to your use of publicly-available Epic resources available via the internet, which include but are not limited to:
Epic.com, Epic’s Careers website, UserWeb and UserWeb-connected websites, Epic Earth, Open.epic, Vendor Services, EpicLink, Epic on FHIR, EpicShare, websites for UGM and other Epic-hosted events, MyChart Vaccination Registration, Lucy, and Epic’s applications, such as MyChart (including MyChart Central), Rover, Hyperspace for MacOS, and others (each item is an “Epic Website or Application”).
Qualifications & exceptions
The list is not exhaustive: it says "include but are not limited to" and ends applications with "and others".
Not stated here
The notice does not give a complete list of covered Epic websites and applications.
Data Access & Collection · Context
"Personal information" means anything linkable to you, your household or your device
In this notice, personal information is information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you, your household or your device. Epic says you may provide such information by using an Epic Website or Application, and tells you to read the privacy policy associated with the site or app you use to see which personal information you may provide while using it.
Supporting quotations
By using an Epic Website or Application, you may provide Epic with information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you, your household, or your device (“personal information“).
Please review the privacy policy associated with the Epic Website or Application you use to review the personal information you may provide to Epic during your use.
Qualifications & exceptions
The definition reaches information about your household and your device, not only information about you.
Information can count even if it is only indirectly linkable to you.
Not stated here
The privacy policy associated with each Epic Website or Application is not part of this source, so the specific information each one collects is not supplied here.
Data Access & Collection · Company practice
Identifiers and customer-record data: received from Epic websites, not mobile or Mac apps
Epic's collection table, which covers what Epic received from users in the last 12 months, says two categories came from its websites but not from its mobile and MacOS applications. Category A, identifiers, includes examples such as a real name, alias, postal address, unique personal or online identifier, IP address, email address, account name, Social Security number, driver's license number and passport number. Category B, the categories listed in the California Customer Records statute, includes examples such as name, signature, physical description, address, telephone number, insurance policy number, education, employment history, bank account or card numbers and other financial information, medical information and health insurance information; the table notes that some of this information may overlap with other categories. For both rows the table reads "Mobile and MacOS applications: No" and "Other Epic websites: Yes". The examples describe what each category can include; a "Yes" marks that Epic received the category, not that it received every example listed.
Supporting quotations
In particular, Epic has received the following categories of personal information from users of Epic Websites or Applications within the last 12 months (indicated with a “Yes”):
A. Identifiers.
A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.
Mobile and MacOS applications: No
Other Epic websites: Yes
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).
A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.
Some personal information included in this category may overlap with other categories.
Mobile and MacOS applications: No
Other Epic websites: Yes
Qualifications & exceptions
Covers what Epic received in the last 12 months; it is a look-back statement, not a promise about future collection.
Mobile and MacOS applications are marked No for both categories; other Epic websites are marked Yes.
Some category B information may overlap with other categories.
Not stated here
The table does not name MyChart or MyChart Central, so it does not say which line applies to MyChart Central used in a web browser.
The table does not say which listed examples Epic actually received.
The table does not explain how it treats information that healthcare organizations hold through MyChart; the notice separately excludes information stored or used by healthcare systems or other HIPAA Covered Entities from its access and deletion rights.
The California Customer Records statute (Cal. Civ. Code § 1798.80(e)) is cited but not supplied.
Data Access & Collection · Company practice
Browsing and interaction activity: received from Epic websites, not mobile or Mac apps
Category F, internet or other similar network activity, covers examples such as browsing history, search history and information on how you interact with a website, application or advertisement. Epic's table of what it received from users in the last 12 months marks this category "Mobile and MacOS applications: No" and "Other Epic websites: Yes", so Epic says it received this kind of activity information through its websites but not through its mobile and MacOS apps.
Supporting quotations
In particular, Epic has received the following categories of personal information from users of Epic Websites or Applications within the last 12 months (indicated with a “Yes”):
F. Internet or other similar network activity.
Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.
Mobile and MacOS applications: No
Other Epic websites: Yes
Qualifications & exceptions
Covers what Epic received in the last 12 months; it is a look-back statement.
Mobile and MacOS applications are marked No; other Epic websites are marked Yes.
Not stated here
The notice does not say how this activity is collected (for example which tracking technologies), or what it is used for beyond the general purposes listed later.
The table does not name MyChart or MyChart Central, so it does not say which line applies to MyChart Central used in a web browser.
Data Access & Collection · Company practice
Protected characteristics received only via Careers and MyChart Vaccination Registration
Category C covers protected classification characteristics under California or federal law. Its examples are age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, and genetic information (including familial genetic information). Epic's table of what it received in the last 12 months marks this category Yes for Careers.epic.com and MyChart Vaccination Registration, and No for other Epic Websites or Applications.
Supporting quotations
In particular, Epic has received the following categories of personal information from users of Epic Websites or Applications within the last 12 months (indicated with a “Yes”):
C. Protected classification characteristics under California or federal law.
Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).
Careers.epic.com and MyChart Vaccination Registration: Yes
Other Epic Websites or Applications: No
Qualifications & exceptions
Covers what Epic received in the last 12 months.
Only Careers.epic.com and MyChart Vaccination Registration are marked Yes; every other Epic Website or Application is marked No.
Not stated here
The table does not say which of the listed characteristics each of the two sites received.
Data Access & Collection · Company practice
Job history and performance information received via Careers, UserWeb, Epic Earth, Vendor Services, Open.epic
Category I, professional or employment-related information, covers current or past job history or performance evaluations. Epic's table of what it received in the last 12 months marks it Yes for Careers.epic.com, UserWeb and UserWeb-connected sites, Epic Earth, Vendor Services and Open.epic, and No for other Epic Websites or Applications.
Supporting quotations
In particular, Epic has received the following categories of personal information from users of Epic Websites or Applications within the last 12 months (indicated with a “Yes”):
I. Professional or employment-related information.
Current or past job history or performance evaluations.
Only the five listed sites are marked Yes; every other Epic Website or Application is marked No.
Data Access & Collection · Company practice
Non-public education records received only via the Careers site
Category J, non-public education information, is defined in the table by reference to the Family Educational Rights and Privacy Act (FERPA). Its examples are education records directly related to a student and maintained by an educational institution or a party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information or student disciplinary records. Epic's table of what it received in the last 12 months marks this category Yes for Careers.epic.com and No for other Epic Websites or Applications.
Supporting quotations
In particular, Epic has received the following categories of personal information from users of Epic Websites or Applications within the last 12 months (indicated with a “Yes”):
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).
Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.
Careers.epic.com: Yes
Other Epic Websites or Applications: No
Qualifications & exceptions
Covers what Epic received in the last 12 months.
Only Careers.epic.com is marked Yes.
Not stated here
The table cites FERPA (20 U.S.C. Section 1232g, 34 C.F.R. Part 99) for this category, but that law is not supplied by this source.
The table does not say which education records the Careers site received.
Inference & Profiling · Company practice
Profiles inferred from other personal information received only via the Careers site
Category K, inferences drawn from other personal information, covers a profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities and aptitudes. Epic's table of what it received in the last 12 months marks this category Yes for Careers.epic.com and No for other Epic Websites or Applications.
Supporting quotations
In particular, Epic has received the following categories of personal information from users of Epic Websites or Applications within the last 12 months (indicated with a “Yes”):
K. Inferences drawn from other personal information.
Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
Careers.epic.com: Yes
Other Epic Websites or Applications: No
Qualifications & exceptions
Covers what Epic received in the last 12 months.
Only Careers.epic.com is marked Yes.
Not stated here
The notice does not say what inferences the Careers site involves, how they are drawn, or how they are used.
Data Access & Collection · Company practice
Commercial, biometric, geolocation and sensory data marked not received
Epic's table of what it received from users in the last 12 months marks four categories simply "No", with no site listed as an exception: D, commercial information (records of personal property, products or services purchased, obtained or considered, or other purchasing or consuming histories or tendencies); E, biometric information (such as fingerprints, faceprints, voiceprints, iris or retina scans, keystroke or gait patterns, and sleep, health or exercise data); G, geolocation data (physical location or movements); and H, sensory data (audio, electronic, visual, thermal, olfactory or similar information). The table looks back over 12 months; separately, Epic says it will not collect additional categories of personal information without providing you notice.
Supporting quotations
In particular, Epic has received the following categories of personal information from users of Epic Websites or Applications within the last 12 months (indicated with a “Yes”):
D. Commercial information.
Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
E. Biometric information.
Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.
G. Geolocation data. Physical location or movements.
H. Sensory data. Audio, electronic, visual, thermal, olfactory, or similar information.
No
No
No
No
We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.
Qualifications & exceptions
The No entries describe the last 12 months, not a permanent rule.
Epic commits to give notice before collecting additional categories of personal information.
Not stated here
The notice does not say how or when it would give notice of a new category.
The table does not explain how it treats health information that healthcare organizations hold through MyChart.
Data Access & Collection · Company practice
Epic gets personal information from you, from observing your actions on its sites and apps, and from your representative
Epic says its websites and applications obtain personal information from three categories of sources: directly from you, for example through forms you complete, communications you send and job applications you fill out; indirectly from you, for example by observing your actions on Epic Websites and Applications; and from your representative, for example when someone at your organization gives Epic information to create a UserWeb account on your behalf, register you for an Epic-hosted event, or list you as a developer for an application on Vendor Services. The examples end with "etc.", so they are not a complete list.
Supporting quotations
Epic Websites and Applications obtain personal information from the following categories of sources:
Directly from you. For example, from forms you complete, communications you send, job applications you fill out, etc.
Indirectly from you. For example, from observing your actions on the Epic Websites and Applications.
From your representative. For example, someone at your organization may provide Epic with information to create a UserWeb account on your behalf, register you for an Epic-hosted event, list you as a developer for an application on Vendor Services, etc.
Qualifications & exceptions
The examples for direct and representative sources are open-ended ("etc.").
Representative-provided information is described with organizational examples (UserWeb accounts, Epic-hosted events, Vendor Services developer listings).
Not stated here
The notice does not say how Epic observes your actions on its websites and applications, for example which technologies it uses.
The notice does not say which sources apply to which Epic Website or Application.
Use & Processing · Permission or license
Epic may use personal information to run, support, personalize and improve its sites and apps
Epic says it may use personal information for a list of purposes. These include: fulfilling the reason you provided the information (for example, if you share your name and contact information to apply for a job or ask about Epic's products or services, Epic will use it to respond to you); providing, supporting, personalizing and developing Epic Websites or Applications; creating, maintaining, customizing and securing your account on Epic websites that require a personal login; processing your requests, purchases, transactions and payments and preventing transactional fraud; providing support and responding to your inquiries, including investigating your concerns and monitoring and improving its responses; personalizing your experience and delivering content relevant to your interests; and testing, analysis and product development, including developing and improving Epic Websites or Applications. Epic adds that it will not use the information for materially different, unrelated or incompatible purposes without giving you notice.
Supporting quotations
We may use personal information for the following purposes:
To fulfill or meet the reason you provided the information. For example, if you share your name and contact information to apply for a job or ask a question about our products or services, we will use that personal information to respond to you.
To provide, support, personalize, and develop Epic Websites or Applications.
To create, maintain, customize, and secure your account on any of our websites that require a personal login.
To process your requests, purchases, transactions, and payments and prevent transactional fraud.
To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
To personalize your experience on Epic Websites or Applications and to deliver content relevant to your interests.
For testing, analysis, and product development, including to develop and improve our Epic Websites or Applications.
We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.
Qualifications & exceptions
Epic "may" use information for these purposes; the list does not say every purpose applies to every site or app.
Use for materially different, unrelated or incompatible purposes requires notice to you first.
Not stated here
The list includes processing purchases, transactions and payments, but the collection table marks commercial information as not received in the last 12 months; the notice does not explain the difference.
Which purposes apply to which Epic Website or Application is left to each one's own privacy policy, which is not supplied.
Cross-references
contrast (model-proposed): Commercial, biometric, geolocation and sensory data marked not received — contrast: Reviewed tension: the purposes list includes processing purchases, transactions and payments, while the collection table marks commercial information (records of products or services purchased) as not received in the last 12 months. The notice does not reconcile the two.
Use & Processing · Permission or license
Epic may also use personal information for security, legal demands and uses described at collection or in the CCPA
The same list lets Epic use personal information to help maintain the safety, security and integrity of its websites and applications, products and services, databases and other technology assets, and business; to respond to law enforcement requests and as required by applicable law, court order or governmental regulations; and as described to you when Epic collects your personal information or as otherwise set forth in the CCPA. The last item is open-ended: it points to whatever Epic tells you at collection and to the CCPA, neither of which is set out in this notice.
Supporting quotations
We may use personal information for the following purposes:
To help maintain the safety, security, and integrity of Epic Websites and Applications, products and services, databases and other technology assets, and business.
To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
As described to you when collecting your personal information or as otherwise set forth in the CCPA.
Qualifications & exceptions
These are uses Epic "may" make, from the same list as the service purposes.
The final item extends the list to uses described at collection or set forth in the CCPA.
Not stated here
The notice does not say whether responses to law enforcement requests are limited to those required by law.
What Epic tells you at the time of collection, and the uses the CCPA sets forth, are not supplied by this source.
Use & Processing · Company commitment
Epic says it will give notice before collecting new categories or using data for materially different purposes
Epic commits that it will not collect additional categories of personal information, or use the personal information it collected for materially different, unrelated or incompatible purposes, without providing you notice. For the specific ways your information may be used, the notice sends you to the privacy policy associated with the Epic Website or Application you use.
Supporting quotations
We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.
Please review the privacy policy associated with the Epic Website or Application you use in order to review the specific ways in which your information may be used.
Qualifications & exceptions
The commitment is to give notice; the sentence does not mention asking for your consent.
Not stated here
The notice does not say how, where or how far in advance this notice would be given.
The privacy policies associated with each Epic Website or Application are not supplied by this source.
Epic may disclose personal information for a business purpose under a confidentiality and use-limit contract
Epic may disclose your personal information to a third party for a business purpose. When it does, Epic says it enters a contract that describes the purpose and requires the recipient both to keep that information confidential and not to use it for any purpose except performing the contract. Epic says it discloses personal information for a business purpose to its third party service providers. To see which individuals or third parties may have access to your personal information, the notice sends you to the privacy policy associated with the Epic Website or Application you use.
Supporting quotations
We may disclose your personal information to a third party for a business purpose.
When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.
We disclose your personal information for a business purpose to our third party service providers.
Please review the privacy policy associated with the Epic Website or Application you use in order to review the individuals or third parties that may have access to your personal information.
Qualifications & exceptions
The contract terms described cover disclosures made for a business purpose.
Recipients must keep the information confidential and use it only to perform the contract.
Not stated here
The notice does not name the service providers or other third parties.
"Business purpose" is not defined in this notice; as a CCPA-defined term it may carry the CCPA meaning, which is not supplied.
The associated privacy policies that list who may have access are not supplied by this source.
Sharing & Disclosure · Company practice
In the prior 12 months Epic disclosed seven categories of personal information for a business purpose
Epic says that in the preceding twelve months it disclosed these categories of personal information for a business purpose: A, identifiers; B, California Customer Records personal information categories; C, protected classification characteristics under California or federal law; F, internet or other similar network activity; I, professional or employment-related information; J, non-public education information; and K, inferences drawn from other personal information. These are the same seven categories the collection table marks Yes for at least some Epic Websites or Applications.
Supporting quotations
In the preceding twelve (12) months, Epic has disclosed the following categories of personal information for a business purpose:
Category A: Identifiers.
Category B: California Customer Records personal information categories.
Category C: Protected classification characteristics under California or federal law.
Category F: Internet or other similar network activity.
Category I: Professional or employment-related information.
Category J: Non-public education information.
Category K: Inferences drawn from other personal information.
Qualifications & exceptions
A look-back statement covering the preceding twelve months.
Not stated here
The list does not say which Epic Website or Application, or which recipients, each disclosed category relates to.
Sharing & Disclosure · Company commitment
Epic says it does not sell your information
The notice states that Epic does not sell your information. It makes this statement in the same paragraph that says Epic discloses personal information for a business purpose to its third party service providers.
Supporting quotations
We do not sell your information.
Qualifications & exceptions
Stated without exceptions in this notice.
Not stated here
The notice does not define "sell"; as a CCPA-defined term it may carry the CCPA meaning, which is not supplied.
Legal Rights & Agreement Rules · User right or choice
You can ask what Epic collected about you in the past 12 months and get a copy
The notice says the CCPA gives California residents specific rights over their personal information, and this section describes them. You have the right to ask Epic to disclose information about its collection and use of your personal information over the past 12 months. Once Epic receives and confirms your verifiable consumer request, it says it will tell you: the categories of personal information it collected about you; the categories of sources; its business or commercial purpose for collecting it; the categories of third parties with whom it shares it; the specific pieces of personal information it collected about you (a data portability request); and, if it disclosed your information for a business purpose, a list of those disclosures showing which categories each category of recipient obtained. These rights do not cover personal information, including health information, that is stored or otherwise used by healthcare systems or other HIPAA Covered Entities; if you have questions about these rights for that information, the notice tells you to contact your healthcare system(s). You may make an access or data portability request only twice within a 12-month period, and any disclosure covers only the 12 months before Epic receives the request.
Supporting quotations
The CCPA provides consumers (California residents) with specific rights regarding their personal information.
You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request (see Exercising Access, Data Portability, and Deletion Rights), we will disclose to you:
The categories of personal information we collected about you.
The categories of sources for the personal information we collected about you.
Our business or commercial purpose for collecting that personal information.
The categories of third parties with whom we share that personal information.
The specific pieces of personal information we collected about you (also called a data portability request).
If we disclosed your personal information for a business purpose, a list of the disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.
We do not provide these access and data portability rights for personal information (including health information) that is stored or otherwise used by healthcare systems or other Covered Entities (as that term is defined in the Health Insurance Portability and Accountability Act of 1996 (HIPAA)).
Contact your healthcare system(s) if you have questions about these rights with respect to information about you that is stored or otherwise used by them.
You may only make a verifiable consumer request for access or data portability twice within a 12-month period.
Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt.
Qualifications & exceptions
Requires a verifiable consumer request that Epic receives and confirms.
Excludes personal information (including health information) stored or otherwise used by healthcare systems or other HIPAA Covered Entities.
At most two access or data portability requests within a 12-month period.
Disclosures cover only the 12 months before Epic receives the request.
Not stated here
The notice does not explain how you can tell whether particular information is held by Epic or by a healthcare system.
HIPAA's definition of "Covered Entities" is referenced but not supplied by this source.
Retention & Deletion · User right or choice
You can ask Epic to delete information it collected from you, subject to listed exceptions
You have the right to ask Epic to delete personal information it collected from you and retained, subject to certain exceptions. Once Epic receives and confirms your verifiable consumer request, it says it will delete your personal information from its records, and direct its service providers to do the same, unless an exception applies. Epic may deny the request if keeping the information is necessary for Epic or its service providers to: complete a transaction for which the information was collected, provide something you requested, take actions reasonably anticipated within your ongoing relationship, or fulfill legal obligations; detect security incidents, protect against malicious, deceptive, fraudulent or illegal activity, or prosecute those responsible; debug products to repair errors that impair existing intended functionality; exercise free speech, ensure another consumer's free speech rights, or exercise another right provided by law; comply with the California Electronic Communications Privacy Act; engage in public or peer-reviewed scientific, historical or statistical research in the public interest that follows other applicable ethics and privacy laws, when deletion may likely make the research impossible or seriously impair it and you previously gave informed consent; enable solely internal uses reasonably aligned with consumer expectations based on your relationship with Epic; or make other internal and lawful uses compatible with the context in which you provided the information. If Epic cannot comply, its response will explain why. The deletion right does not cover personal information, including health information, that is stored or otherwise used by healthcare systems or other HIPAA Covered Entities.
Supporting quotations
You have the right to request that we delete any of your personal information that we have collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (see Exercising Access, Data Portability, and Deletion Rights), we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.
We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:
Complete a transaction for which we collected the personal information, provide something that you requested, take actions reasonably anticipated within the context of our ongoing relationship with you, or fulfill any legal obligations we may have.
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
Debug products to identify and repair errors that impair existing intended functionality.
Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.).
Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
We do not provide these deletion rights for personal information (including health information) that is stored or otherwise used by healthcare systems or other Covered Entities (as that term is defined in HIPAA).
The response we provide will also explain the reasons we cannot comply with a request, if applicable.
Qualifications & exceptions
Covers personal information Epic collected from you and retained.
Requires a verifiable consumer request that Epic receives and confirms.
Epic "may" deny deletion when retention is necessary for one of the listed reasons, for Epic or its service providers.
Excludes personal information (including health information) stored or otherwise used by healthcare systems or other HIPAA Covered Entities.
Not stated here
The notice does not say whether information Epic received about you from others, such as your representative, counts as collected from you.
The last two exceptions (internal uses aligned with consumer expectations, and other internal lawful uses compatible with the original context) are broad, and the notice does not say how Epic applies them.
The California Electronic Communications Privacy Act is cited as "Cal. Penal Code § 1546 seq." in this source; the Act itself is not supplied.
Legal Rights & Agreement Rules · Restriction or exception
Access, portability and deletion rights don't cover information healthcare systems store or use
Epic says it does not provide the access, data portability or deletion rights described in this notice for personal information, including health information, that is stored or otherwise used by healthcare systems or other Covered Entities, as HIPAA defines that term. If you have questions about these rights for information about you that a healthcare system stores or uses, the notice tells you to contact your healthcare system(s).
Supporting quotations
We do not provide these deletion rights for personal information (including health information) that is stored or otherwise used by healthcare systems or other Covered Entities (as that term is defined in HIPAA).
Contact your healthcare system(s) if you have questions about these rights with respect to information about you that is stored or otherwise used by them.
We do not provide these access and data portability rights for personal information (including health information) that is stored or otherwise used by healthcare systems or other Covered Entities (as that term is defined in the Health Insurance Portability and Accountability Act of 1996 (HIPAA)).
Qualifications & exceptions
Covers information stored or otherwise used by healthcare systems or other HIPAA Covered Entities, including health information.
Applies to both the access and data portability rights and the deletion right.
Not stated here
The notice does not say which information in MyChart or other Epic applications is stored or used by healthcare systems, so it does not draw the line for a particular user.
HIPAA and its definition of "Covered Entities" are not supplied by this source.
The notice does not say whether Epic passes such requests on to the healthcare system.
Cross-references
narrows (model-proposed): You can ask what Epic collected about you in the past 12 months and get a copy — exception_to: The access and data portability rights are not provided for personal information (including health information) stored or otherwise used by healthcare systems or other HIPAA Covered Entities.
Submit access, portability and deletion requests by email or phone; agents and parents may request
To exercise the access, data portability and deletion rights, you submit a verifiable consumer request by emailing PrivacyInquiries@epic.com or calling 608-271-9000. Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request about your personal information, and you may also make one on behalf of your minor child. To designate an authorized agent, you email PrivacyInquiries@epic.com with a designation that includes the agent's name, email address and other relevant information that will help Epic identify the agent. Making a verifiable consumer request does not require you to create an account with Epic.
Supporting quotations
To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to us by either:
Emailing us at PrivacyInquiries@epic.com; or
Calling us at 608-271-9000
Only you or someone legally authorized to act on your behalf may make a verifiable consumer request related to your personal information.
You may also make a verifiable consumer request on behalf of your minor child.
To designate an authorized agent, email us at PrivacyInquiries@epic.com and include a designation of your authorized agent in your email, including the agent’s name, email address, and other relevant information that will help us identify your authorized agent.
Making a verifiable consumer request does not require you to create an account with us.
Qualifications & exceptions
Requests may come only from you, someone legally authorized to act for you, or a parent for a minor child.
No Epic account is needed to make a request.
Not stated here
The notice does not say what documentation, if any, Epic requires to accept an agent's or parent's authority beyond the designation email and the verification information.
Legal Rights & Agreement Rules · Procedure
Requests must let Epic verify you and describe what you want; unverified requests can't be answered
A verifiable consumer request must give enough information for Epic to reasonably verify that you are the person whose personal information it collected, or an authorized representative; that information may include your first, middle (if available) and last name, your California address and a valid email address. The request must also describe what you want in enough detail for Epic to understand, evaluate and respond to it. Epic says it cannot respond to your request or provide personal information if it cannot verify your identity or authority to make the request and confirm that the information relates to you. Access or data portability requests are limited to twice within a 12-month period.
Supporting quotations
You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:
Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative, which may include:
First, Middle (if available), and Last Name
California Address
Valid Email Address
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.
Qualifications & exceptions
The verification items "may include" name, California address and email address; the notice does not present this as a complete list.
At most two access or data portability requests within a 12-month period.
Not stated here
The notice does not say what further verification Epic may ask for, or how an authorized representative is verified.
Use & Processing · Company commitment
Information you give in a request is used only to verify your identity or authority
Epic says it will only use personal information provided in a verifiable consumer request to verify the requester's identity or authority to make the request.
Supporting quotations
We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.
Qualifications & exceptions
Limited to information supplied in a verifiable consumer request.
Not stated here
The notice does not say how long Epic keeps information supplied for verification.
Legal Rights & Agreement Rules · Procedure
Epic aims to answer within 45 days, up to 90 with written notice, and picks a portable format
Epic says it endeavors to respond to a verifiable consumer request within 45 days of receiving it. If it needs more time, up to 90 days, it will tell you the reason and the extension period in writing. Any disclosure covers only the 12 months before Epic received the request, and the response will also explain the reasons Epic cannot comply with a request, if that applies. For data portability requests, Epic selects a format that is usable and should allow you to transmit the information from one entity to another.
Supporting quotations
We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt.
If we require more time (up to 90 days), we will inform you of the reason and extension period in writing.
Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt.
The response we provide will also explain the reasons we cannot comply with a request, if applicable.
For data portability requests, we will select a format to provide your personal information that is usable and should allow you to transmit the information from one entity to another entity.
Qualifications & exceptions
The 45-day timeframe is stated as an aim ("endeavor"); an extension up to 90 days comes with written notice of the reason and period.
Disclosures cover only the 12 months before the request was received.
Epic chooses the portability format.
Not stated here
The notice does not name the format Epic uses for data portability.
Charges & Financial Obligations · Company commitment
Requests are free unless excessive, repetitive or unfounded; Epic explains any fee first
Epic does not charge a fee to process or respond to your verifiable consumer request unless the request is excessive, repetitive or unfounded. If Epic determines that a request warrants a fee, it will tell you why it made that decision and give you a cost estimate before completing the request.
Supporting quotations
We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or unfounded.
If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
Qualifications & exceptions
A fee is possible only for excessive, repetitive or unfounded requests.
You get the reason and a cost estimate before Epic completes a request that warrants a fee.
Not stated here
The notice does not say how Epic decides a request is excessive, repetitive or unfounded, or how large a fee could be.
Legal Rights & Agreement Rules · Company commitment
Epic says it will not discriminate against you for using your CCPA rights
Epic will not discriminate against you for exercising any of your CCPA rights. Unless the CCPA permits it, Epic will not deny you goods or services, or give you a different level or quality of goods or services, because you exercised those rights.
Supporting quotations
We will not discriminate against you for exercising any of your CCPA rights.
Unless permitted by the CCPA, we will not deny you goods or services or provide you a different level or quality of goods or services for exercising any of your CCPA rights.
Qualifications & exceptions
The promise not to deny or change goods or services is subject to what the CCPA permits.
Not stated here
The notice does not say what the CCPA permits in this respect, and the CCPA is not supplied by this source.
Legal Rights & Agreement Rules · Permission or license
Epic may amend the notice at any time; continued use after posting means you accept the changes
Epic reserves the right to amend this notice at its discretion and at any time. When it makes changes, it will post the updated notice on this website and update the notice's effective date. Your continued use of an Epic Website or Application after changes are posted constitutes your acceptance of them. Separately, Epic says it will not collect additional categories of personal information, or use collected information for materially different, unrelated or incompatible purposes, without providing you notice.
Supporting quotations
We reserve the right to amend this Notice at our discretion and at any time.
When we make changes to this Notice, we will post the updated Notice on this website and update the Notice’s effective date.
Your continued use of an Epic Website or Application following the posting of changes constitutes your acceptance of such changes.
We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.
Qualifications & exceptions
Changes are communicated by posting the updated notice on the website and updating its effective date; the paragraph does not promise direct notification.
Acceptance is tied to continued use of an Epic Website or Application after the changes are posted.
Not stated here
The notice does not say whether posting an updated notice is the notice Epic promises before collecting new categories or making materially different uses.
Legal Rights & Agreement Rules · Procedure
Contact Epic by phone, email or mail with questions or to exercise California rights
For questions or comments about this notice, about how Epic collects and uses your information as described here and in the privacy policy associated with the Epic Website or Application you use, about your choices and rights regarding that use, or to exercise your rights under California law, the notice lists these contacts: phone 608-271-9000; email PrivacyInquiries@epic.com; and postal address Epic Systems Corporation, Attn: General Counsel, 1979 Milky Way, Verona, WI 53593. For questions about rights in information that healthcare systems store or otherwise use, the notice directs you to your healthcare system(s) instead.
Supporting quotations
If you have any questions or comments about this Notice, the ways in which Epic collects and uses your information described here and in the privacy policy associated with the Epic Website or Application you use, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:
Phone: 608-271-9000 Email: PrivacyInquiries@epic.com Postal Address: Epic Systems Corporation Attn: General Counsel 1979 Milky Way Verona, WI 53593
Contact your healthcare system(s) if you have questions about these rights with respect to information about you that is stored or otherwise used by them.
Contact your healthcare system(s) if you have questions about these rights with respect to information about you that is stored or otherwise used by them.
Qualifications & exceptions
Questions about rights in information stored or used by healthcare systems go to those healthcare systems.
Not stated here
The request section lists only email and phone for access, portability and deletion requests, while this contact section also lists a postal address for exercising California rights; the notice does not say whether a mailed request is accepted.