Policy covers nine listed Epic websites, for website visitors and job seekers
This is Epic Systems Corporation's privacy policy for the websites it lists: epic.com, careers.epic.com, cosmos.epic.com, link.epic.com, mychart.org, mychartcentral.com, shareeverywhere.epic.com, uwcs.epic.com and efficiency.epic.com. The title names website visitors and job seekers as the audience, and the policy says it describes how Epic collects and uses your information when you visit those sites. A later privacy-rights paragraph also refers to 'other websites that link to this policy', so the list may not be the only sites the policy reaches. This section lists websites only and does not say whether other Epic products, such as mobile apps, are covered by this document.
Supporting quotations
Epic Website Privacy Policy for Website Visitors & Job Seekers
Epic Systems Corporation
This Privacy Policy describes how we collect and use your information when you visit the websites listed below
epic.com
careers.epic.com
cosmos.epic.com
link.epic.com
mychart.org
mychartcentral.com
shareeverywhere.epic.com
uwcs.epic.com
efficiency.epic.com
other websites that link to this policy
Qualifications & exceptions
Applies to information Epic collects and uses when you visit the listed websites.
A later paragraph says rights apply to information sent to Epic through Epic.com and 'other websites that link to this policy', which is wider than the list.
Not stated here
Which other websites, if any, link to this policy is not stated.
Whether Epic's mobile apps or other products fall under this policy is not stated in this section.
Legal Rights & Agreement Rules · Context
This version is dated March 23, 2026; English is the official text
This version of the policy is marked 'Last Updated: March 23, 2026'. Epic says the English text is its official version and that machine translations are offered for convenience. The source does not say what happens if a translation differs from the English text.
Supporting quotations
Last Updated: March 23, 2026
We maintain the official version of our policy in English and make machine translations available for your convenience.
We maintain the official version of our policy in English and make machine translations available for your convenience.
Qualifications & exceptions
Translations are machine translations, offered for convenience.
Not stated here
The source does not say how a conflict between a translation and the English version is handled.
Legal Rights & Agreement Rules · Permission or license
Epic may change the policy at any time, effective as soon as published
Epic may update this policy at any time, and updates take effect as soon as they are published. The policy tells you to check back from time to time to review the most current version. This paragraph does not promise advance notice or direct notification of changes.
Supporting quotations
We may update this policy at any time, and future updates are effective as soon as they are published.
you should check back from time to time and make sure that you have reviewed the most current version of this policy
Qualifications & exceptions
Effective as soon as published, not on a later date.
The reader is expected to check back for the current version.
Not stated here
Whether Epic notifies people of changes beyond posting is not stated in this paragraph.
Data Access & Collection · Company practice
If you contact Epic, it may keep a record of the communication
You may contact Epic through the methods listed on its websites. If you do, Epic may keep a record of the communication to help answer or resolve the matter you contacted it about. You decide how much information to share when you make contact.
Supporting quotations
If you contact us, we may keep a record of the communication to help answer or resolve the matter you contacted us about.
You can decide how much information you want to share with us in those cases.
Qualifications & exceptions
Record is kept to help answer or resolve the matter you raised, as stated.
How much you share is up to you.
Not stated here
How long the record is kept is not stated in this paragraph.
Data Access & Collection · Company practice
Campus tour sign-ups collect name, email and phone, stored in Microsoft Bookings
If you sign up for a campus tour through the form on Epic's Visiting Us page, you provide your name, email address and phone number. That information is stored in Microsoft Bookings, a Microsoft service, and the policy points to Microsoft's website for more detail.
Supporting quotations
You may sign up for a campus tour by providing us with your name, email address, and phone number via the sign-up form on our Visiting Us page.
your information will be stored in Microsoft Bookings
Qualifications & exceptions
Applies to people who sign up for a campus tour through the Visiting Us page form.
Not stated here
Microsoft's handling of the information, and how long it is kept, are not described here beyond the link to Microsoft's website, which is not supplied.
Use & Processing · Permission or license
Share My Story submissions may be used to contact you about your story
If you submit your story and contact information through the Share My Story page on the MyChart Site, Epic may use the information you provided to contact you about your story. The sentence says what Epic may do and does not list other uses.
Supporting quotations
If you submit your story and contact information to us via the
we may use the information you provided to contact you about your story
Qualifications & exceptions
Applies to submissions made through the Share My Story page on the MyChart Site (mychart.org).
Not stated here
The paragraph does not say whether the story is published or shared, or how long it is kept.
Use & Processing · Company practice
Provider Efficiency Training form data is kept on Epic's US servers for class-related uses
If you submit the form linked on the Provider Efficiency Training Site, you provide your name, phone number, email address, organization and credentials. That information is stored on Epic-owned servers in the United States and used for purposes such as confirming you are employed by a healthcare organization that uses Epic software, registering you for provider efficiency classes and contacting you about future educational opportunities. 'Such as' means the list is examples, not necessarily every use. A later paragraph says people covered by GDPR who submitted this form can exercise their rights by contacting Epic at PrivacyInquiriesEurope@epic.com.
Supporting quotations
You may also provide us with your name, phone number, email address, organization, and credentials when you submit your information to Epic via the form linked on the Provider Efficiency Training Site.
This information will be stored on Epic-owned servers in the United States and used for purposes such as:
Confirming you are employed by a healthcare organization that uses Epic software
Registering you for provider efficiency classes
Contacting you about future educational opportunities
submitted your contact information to Epic via the form linked on the Provider Efficiency Training Site
Qualifications & exceptions
The listed purposes are examples ('such as'), not a closed list.
Stored on Epic-owned servers in the United States.
GDPR data subjects who used this form have a stated contact route for exercising rights.
Not stated here
Retention period for this form data is not stated in this section.
Sharing & Disclosure · Context
Viewing the Epic Almanac may subject your information to Issuu's privacy policy
Epic uses Issuu to host a digital copy of its magazine, the Epic Almanac. If you view the Almanac, your information may be subject to Issuu's privacy policy. The policy does not say what Issuu collects.
Supporting quotations
We use Issuu to host a digital copy of Epic’s magazine, the Epic Almanac.
If you view the Epic Almanac, your information may be subject to the
Qualifications & exceptions
Applies if you view the Epic Almanac hosted by Issuu.
Not stated here
What information Issuu collects and what Issuu's policy says are not supplied here.
Data Access & Collection · Company practice
Epic's servers may automatically record browser, device, IP address and request details
When you use Epic's websites, its servers may automatically collect and record information, in most cases generated by technologies such as cookies, flash LSOs, web beacons and clear GIFs. Your browser or device may tell Epic your browser type, language preference, IP address (which may tell Epic generally where you are located) and the type of device or system you used. Your browser may also tell Epic the time and date of your request, the page that led you to the website and, if applicable, what you typed into a search engine that led you there. This section lists what is collected; it does not state purposes for this log information.
Supporting quotations
When you use Our Websites, our servers may automatically collect and record information.
In most cases, this information is generated by technologies, such as
Your browser or device may tell us your:
Browser type
Language preference
Internet Protocol (IP) address (which may tell us generally where you are located)
Type of device or system you used
Your browser may also tell us:
The time and date of your request
The page that led you to Our Website
What you typed into a search engine that led you to Our Website, if applicable
Qualifications & exceptions
'May' automatically collect: describes what Epic's servers can receive, not a promise that every item is recorded every time.
IP address may indicate general location.
Search-engine terms are included only if applicable.
Not stated here
Purposes and retention for this automatically collected information are not stated in this section.
Security & Safeguards · Company practice
Epic uses strictly necessary cookies for security and load balancing
Epic uses strictly necessary cookies on its websites to prevent unauthorized access to or misuse of its systems, to prevent cybersecurity incidents, and to keep visitors on the same server they first connected to when they move between its websites, which the policy describes as load balancing.
Supporting quotations
We use strictly necessary cookies on Our Websites to prevent unauthorized access to or misuse of our systems, prevent cybersecurity incidents, and to keep website visitors on the same server they initially connect to when they navigate to one of our websites
Qualifications & exceptions
Described as strictly necessary cookies, with the purposes listed.
Not stated here
The paragraph does not say whether visitors can decline these cookies.
Data Access & Collection · User right or choice
Choosing a language on the MyChart Site sets a cookie you can clear
If you select a language preference on Epic's MyChart Site, Epic places a cookie in your browser to keep your language selection. You may clear this cookie at any time in your browser settings.
Supporting quotations
If you select a language preference on our MyChart Site, we will place a cookie in your browser to maintain your language selection.
You may clear this cookie at any time in your browser settings.
Qualifications & exceptions
Applies to the MyChart Site (mychart.org) when you select a language preference.
You clear the cookie yourself through browser settings.
Not stated here
The policy does not say how long the cookie lasts.
Data Access & Collection · Company practice
Taste of Epic Site uses Squarespace required cookies; Squarespace separately collects data
Epic builds its Taste of Epic Site on Squarespace, so that site includes Squarespace's functional and required cookies. Epic says it does not use the optional Squarespace analytics and performance cookies. Independently of Epic, Squarespace collects information about visitors to sites built on its platform, as described in section 4(b) of Squarespace's own privacy policy, which is not part of this document.
Supporting quotations
We use Squarespace to build our Taste of Epic Site
Note that Epic does not use the optional Squarespace
independent of Epic, Squarespace collects information about you when you visit our websites built on the Squarespace platform
Qualifications & exceptions
Applies to the Taste of Epic Site (uwcs.epic.com), which is built on Squarespace.
Epic's statement that it does not use the optional cookies does not limit what Squarespace collects independently.
Not stated here
What Squarespace collects and how it uses it are not stated here; the cited Squarespace policy section is not supplied.
Data Access & Collection · Company practice
Epic's websites do not respond to Do-Not-Track signals
Because there is no uniform standard for recognizing Do-Not-Track signals, Epic's websites do not respond to them. If a standard is adopted in the future and Epic follows it, Epic says it will describe its approach in an update to this policy.
Supporting quotations
As a result, Our Websites do not respond to DNT signals.
If a standard for recognizing DNT signals is adopted in the future and we follow that standard, we will inform you about our approach in an update to this Privacy Policy.
Qualifications & exceptions
Current practice: no response to DNT signals.
The future commitment depends on a standard being adopted and Epic following it.
Account & Service Control · Company practice
MyChart Central accounts: Epic stores name, birth date and contact details in the US to run the service
If you have a MyChart Central account, Epic stores limited personal information on Epic-owned servers in the United States. This includes your name, date of birth and the contact information you used to create your account and link it with your MyChart accounts at your healthcare organizations. Epic uses it to provide MyChart Central services and functionality, including helping you log in to your MyChart accounts at those organizations, MyChart Central password recovery and MyChart Central user support. 'Including' means these are examples. The policy calls this limited personal information. It mentions health data viewable within MyChart separately, only in connection with deletion.
Supporting quotations
MyChart Central
If you have a MyChart Central account, we store limited personal information on Epic-owned servers in the United States.
This information includes your name, date of birth, and the contact information you used to create your account and link it with your MyChart accounts at the healthcare organizations that care for you.
This information is used to provide services or functionality for MyChart Central, including: helping you log into your MyChart accounts at your healthcare organizations, MyChart Central password recovery, and MyChart Central user support.
Qualifications & exceptions
Applies to people who have a MyChart Central account.
Described as limited personal information stored for MyChart Central.
Listed uses are examples ('including').
Not stated here
The paragraph does not say whether Epic uses this information for anything beyond MyChart Central services and functionality.
Account & Service Control · User right or choice
You can edit MyChart Central account information and share it with linked healthcare organizations
The policy says you can edit and share MyChart Central account information with the healthcare organizations you have linked to your MyChart Central account. It does not describe the mechanics of editing or sharing.
Supporting quotations
You can edit and share MyChart Central account information with the healthcare organizations you have linked to your MyChart Central account.
Qualifications & exceptions
Sharing is described as going to healthcare organizations you have linked to your MyChart Central account.
Not stated here
How you edit or share the information, and what linked organizations do with it, is not described here.
Retention & Deletion · User right or choice
Deactivating a MyChart Central account deletes only the information used to create it, usually within a day
You can delete the information Epic uses to create your MyChart Central account through the Account Deactivation page within MyChart Central. After you submit a deactivation request, the account information is deleted by an automatic process that runs periodically, typically once per day. The deletion only applies to the information used to create your MyChart Central account. For guidance on deleting health data viewable within MyChart, the policy tells you to contact your healthcare organizations.
Supporting quotations
If you need to delete the information used by Epic to create your MyChart Central account, you can do so via the “Account Deactivation” page within MyChart Central.
Once you submit an account deactivation request, your account information will be deleted via an automatic deletion process that runs periodically (typically once per day).
The deletion only applies to the information used to create your MyChart Central account.
For guidance on deleting health data viewable within MyChart, please contact your healthcare organizations.
Qualifications & exceptions
Deletion covers only the information used to create the MyChart Central account.
Timing is periodic and 'typically' once per day, not guaranteed.
Health data viewable within MyChart is handled through your healthcare organizations.
Not stated here
Whether other records, such as backups or logs, are kept after deactivation is not stated.
Careers Site applications collect demographic, work, education and legal-status details with your consent
When you apply through Epic's Careers Site, Epic may ask for information so it can evaluate you as a candidate and meet certain legal obligations. The information you provide directly to the Careers Site as part of the application is collected with your consent, in addition to the information collected through Epic's websites generally. It may include demographic information (race, gender, veteran status and disability status), contact information, your qualifications, skills, experience and education, your employment history and salary, whether you have a disability for which Epic can make reasonable accommodations during recruitment, and your legal status to perform the position in the region where it is based. 'May include' means the list is not necessarily complete.
Supporting quotations
Information You Provide to Our Careers Site
we may ask you for certain information so we can evaluate you as a candidate and meet certain legal obligations
The information you provide directly to our Careers Site as part of the application process is collected with your consent
Demographic information, including race, gender, veteran status, and disability status
Contact information
Details of your qualifications, skills, experience, and education
Information about your employment history and salary
Whether you have a disability for which we can make reasonable accommodations during the recruitment process
Information about your legal status to perform the position for which you apply in the region where the position is based
Qualifications & exceptions
Applies to job applicants using the Careers Site (careers.epic.com).
Information provided directly through the Careers Site is described as collected with consent.
The list is introduced with 'may include', so it is not stated to be exhaustive.
Not stated here
Which items are required and which are optional is not stated here.
Whether demographic items are separated from hiring decisions is not stated.
Data Access & Collection · Company practice
Recruitment information comes from your application, resume, tests, transcripts and third parties
During recruitment, you may provide information through the Careers Site application form, your resume or CV if you submit one, tests or other assessments, and copies of transcripts or other documents you submit. Epic also collects information from third parties, including previous employers and educational institutions.
Supporting quotations
How Do We Collect Your Information?
During the recruitment process, you may provide information to us in the following ways:
The application form on the Careers Site
Your resume or CV (if you submit one with your application)
Tests or other forms of assessments administered during the recruitment process
Copies of transcripts or other documentation submitted by you during the course of your application
Information collected from third parties, including previous employers and educational institutions
Qualifications & exceptions
Resume or CV only if you submit one.
The list of third-party sources is introduced with 'including', so other sources may exist.
Not stated here
The policy does not say how Epic chooses which third parties to contact or whether you are told in advance.
Use & Processing · Company practice
Recruitment information is used to evaluate, contact and onboard you, and for internal metrics and site improvement
Information you provide during recruitment is retained and processed while Epic evaluates you for a position. Epic may use it for purposes such as evaluating your candidacy, contacting you during recruitment, processing your employment if Epic offers you a position, processing and storing your data for internal tracking metrics, meeting legal or regulatory obligations, and improving the Careers Site. 'Such as' means these purposes are examples, not necessarily every use.
Supporting quotations
How Do We Use Your Information?
The information that you provide to us during the recruitment process is retained and processed as we evaluate you for a position. We may use this information for purposes such as:
Evaluating your candidacy for a position at Epic
Contacting you during our recruitment process
Processing your employment if Epic offers you a position
Processing and storing your data for internal tracking metrics
Processing your data in order to meet certain legal or regulatory obligations
Improving the Careers Site
Qualifications & exceptions
Listed purposes are examples ('such as').
Includes internal tracking metrics and improving the Careers Site, in addition to evaluating your application.
Not stated here
The policy does not say what internal tracking metrics are or whether they are aggregated.
Legal Rights & Agreement Rules · Company commitment
Epic processes applicant data with consent and also relies on a legitimate interest in managing recruitment
In addition to processing your data with your consent, Epic says it has a legitimate interest in processing your data to manage its recruitment process and assess whether you are a viable candidate.
Supporting quotations
In addition to processing your data with your consent, Epic has a legitimate interest in processing your data to manage our recruitment process and assess whether you are a viable candidate for a career at Epic.
Qualifications & exceptions
Two stated bases: your consent and Epic's legitimate interest in managing recruitment and assessing candidates.
Not stated here
The paragraph does not say which uses rest on consent and which on legitimate interest.
Use & Processing · User right or choice
All applicants, wherever they are, may opt out of future contacts from Epic at any time
All applicants, regardless of location, may opt out of any future contacts from Epic at any time. The sentence concerns future contacts and does not say that opting out ends processing of an application already submitted.
Supporting quotations
All applicants, regardless of location, may opt out of any future contacts from Epic at any time.
Qualifications & exceptions
Applies to all applicants regardless of location.
Covers future contacts from Epic.
Not stated here
How to opt out is not stated here.
The effect on an existing application or on retained data is not stated.
Applicant information may be shared with Epic staff and service providers such as Avature
When you provide information as part of recruitment, it may be shared with Epic staff and certain third-party service providers, such as Avature Recruiting Solutions. Epic staff includes the human resources and recruitment teams, interviewers, staff in the business area you applied to, and IT staff. Other third-party service providers or contractors may also have access if Epic reaches out to references or conducts background checks.
Supporting quotations
Who Has Access to Your Information?
your information may be shared with Epic staff and certain third party service providers working with Epic, such as Avature Recruiting Solutions
Epic staff includes members of the human resources and recruitment teams, interviewers involved in the recruitment process, staff in the business area to which you are applying, and information technology (IT) staff.
Other third party service providers or contractors may also have access to your information if we reach out to references or conduct background checks.
Qualifications & exceptions
'May be shared': describes who can have access.
Reference and background-check providers get access only if Epic reaches out to references or conducts background checks.
Not stated here
Which other service providers are involved is not named beyond Avature as an example.
Retention & Deletion · Company practice
Applicant data is kept while Epic uses it for recruitment or other permitted purposes, and may continue into employment
Epic retains your information for as long as it makes use of it as part of the recruitment process and for other permitted purposes. If your application is successful, the information gathered during recruitment is added to your human resources file and may be retained throughout your employment with Epic. No fixed retention period is given, and the paragraph does not say what happens to the data of unsuccessful applicants once the recruitment process ends.
Supporting quotations
How Long Does Epic Keep Your Information?
Epic will retain your information for as long as it makes use of such information as a part of the recruitment process and for other permitted purposes.
If your application for employment is successful, information gathered during the recruitment process will be added to your human resources file and may be retained throughout your employment with Epic.
Qualifications & exceptions
Retention is tied to use in recruitment and 'other permitted purposes'.
If hired, information goes to your HR file and may be kept throughout employment.
Not stated here
The 'other permitted purposes' are not defined.
No time limit is given for unsuccessful applicants.
Security & Safeguards · Company commitment
Epic uses process, technology and physical controls, encrypts website submissions and limits staff access
Epic says it uses a combination of process, technology and physical security controls to protect the privacy, security, integrity and availability of your personal information. Information you submit through its websites is encrypted and transmitted securely, which you can check by looking for a closed lock icon or 'https' in the address. Epic also keeps internal policies that limit access to your information to staff and contractors who need to know it to perform their jobs and to develop or improve its websites, products and services.
Supporting quotations
How We Protect Your Personal Information
We use a combination of process, technology and physical security controls to protect the privacy, security, integrity, and availability of your personal information.
When you submit your information through Our Websites, that information is encrypted and transmitted to us in a secure way.
We maintain internal policies and processes that limit access to your information our staff and contractors who need to know the information to perform their jobs and develop or improve our websites, products, and services.
Qualifications & exceptions
Access is limited to staff and contractors with a need to know, which includes developing or improving websites, products and services.
The encryption statement covers information submitted through Epic's websites.
Not stated here
The specific controls and standards used are not described.
Legal Rights & Agreement Rules · Restriction or exception
Epic is not responsible for linked sites or embedded third-party media
Epic's websites link to other sites and may contain embedded media hosted by third parties, such as YouTube videos. Epic says it is not responsible for the content or privacy practices of other sites, and encourages you to read the privacy statements of any other site that collects your information.
Supporting quotations
Links to Other Sites
Our Websites contain links to other sites and may contain embedded media hosted by third parties, such as YouTube videos. Epic is not responsible for the content or privacy practices of other sites.
to read the privacy statements of any other site that collects your information
Qualifications & exceptions
Epic disclaims responsibility for other sites' content and privacy practices.
Not stated here
Which third parties receive information when you view embedded media is not stated.
Sharing & Disclosure · Context
Share Everywhere use is also subject to the participating healthcare organization's terms and privacy policy
Share Everywhere lets patients share a one-time, web-based view of their health record from their healthcare organization with anyone they choose. The person viewing the record can use Share Everywhere to add documentation to the patient's electronic health record. Besides being subject to this policy for the Share Everywhere website, your use of Share Everywhere is also subject to the terms of use and privacy policy of the participating healthcare organization, and the policy tells you to contact that organization for more information.
Supporting quotations
If you use Share Everywhere
Share Everywhere allows patients to share a one-time, web-based view of their health record from their healthcare organization with anyone they choose, and the individual viewing the record can use Share Everywhere to add documentation to a patient’s electronic health record.
your use of Share Everywhere is also subject to the terms of use and privacy policy of the participating healthcare organization
Qualifications & exceptions
This policy covers use of the Share Everywhere website; the healthcare organization's terms and privacy policy also apply.
The viewer, not only the patient, can add documentation to the record.
Not stated here
The participating healthcare organization's terms and privacy policy are not supplied here and may differ by organization.
Legal Rights & Agreement Rules · User right or choice
GDPR requests go to your healthcare organization for its data and to Epic for data Epic holds
If you are a GDPR data subject with questions about personal data held by a healthcare organization that uses Epic software, you should reach out to that organization. For personal data Epic itself holds, such as if you applied for a job through the Careers Site or submitted your contact information through the form linked on the Provider Efficiency Training Site, you can exercise your rights by contacting Epic at PrivacyInquiriesEurope@epic.com. The examples are introduced with 'for example', so they are not a complete list of the data Epic holds.
Supporting quotations
For European Site Visitors: GDPR and the US Data Privacy Framework
If you are a Data Subject as defined by GDPR and you have questions related to personal data held by a healthcare organization that uses Epic software, you should reach out to your healthcare organization for requests related to that personal data.
If you have questions related to your personal data held by Epic (for example, if you have applied for a job via our Careers Site or submitted your contact information to Epic via the form linked on the Provider Efficiency Training Site), you can exercise your rights by contacting Epic at PrivacyInquiriesEurope@epic.com.
Qualifications & exceptions
Applies to people who are Data Subjects as defined by GDPR.
Requests about data held by a healthcare organization go to that organization, not Epic.
The Careers Site and Provider Efficiency Training form are examples of Epic-held data.
Not stated here
Which GDPR rights are available, and any response timelines, are not described in this paragraph.
Legal Rights & Agreement Rules · User right or choice
EEA, UK and Swiss residents may have rights over information sent to Epic; details are in a separate policy
If you are a resident of the European Economic Area, the United Kingdom or Switzerland, you may have certain rights related to personal information you send to Epic directly to facilitate your use of certain features on Epic.com and other websites that link to this policy. The paragraph points to the Epic US Data Privacy Framework Privacy Policy for details. That separate policy is not part of this document and its contents are not supplied.
Supporting quotations
if you are a resident in the European Economic Area, the United Kingdom, or Switzerland, you may have certain rights related to your personal information you send to Epic directly to facilitate your use of certain features on Epic.com and other websites that link to this policy
Details about this can be found in the
Qualifications & exceptions
Applies to residents of the EEA, the UK or Switzerland.
Covers personal information sent directly to Epic to facilitate use of certain features on Epic.com and other websites that link to this policy.
'May have' certain rights: the paragraph does not list them.
Not stated here
The rights themselves and how to exercise them are in the Epic US Data Privacy Framework Privacy Policy, which is not supplied.
Which 'certain features' are meant is not stated.
Cross-references
qualifies (model-proposed): Policy covers nine listed Epic websites, for website visitors and job seekers — qualifies: The European rights paragraph refers to information sent through Epic.com and other websites that link to this policy, which is wider than the list of nine websites given as the policy's scope.
Legal Rights & Agreement Rules · Context
California residents are referred to a separate Privacy Notice for California Residents
For California residents, this policy tells you to visit Epic's separate Privacy Notice for California Residents. This document does not set out California-specific rights or practices itself, and the separate notice is not supplied here.
Supporting quotations
For California Residents
Please visit our Privacy Notice for California Residents.
Qualifications & exceptions
Applies to California residents.
Not stated here
The content of the California notice, including any rights, is not part of this document.
Account & Service Control · Procedure
Questions about your medical information go to your healthcare organization, not Epic
If you have questions about your medical information in an account with a healthcare organization using Epic's software, the policy tells you to contact that healthcare organization using the contact information in its privacy policy.
Supporting quotations
Contact Epic
If you have questions about your medical information in an account with a healthcare organization using Epic’s software, please reach out to your healthcare organization using the contact information in their privacy policy.
Qualifications & exceptions
Applies to medical information in an account with a healthcare organization using Epic's software.
The contact route is the healthcare organization's privacy policy.
Not stated here
Whether Epic can answer any questions about that information is not stated.
Legal Rights & Agreement Rules · Procedure
Epic privacy contacts: phone and email, plus a Data Protection Officer and EU Representative address
For questions about this policy, you can contact Epic at +1 608-271-9000 or PrivacyInquiries@epic.com. To reach Epic's Data Protection Officer or EU Representative, email EUPrivacyInquiries@epic.com or call +1 608-271-9000.
Supporting quotations
If you have any questions about this policy, contact us at +1 608-271-9000 or at PrivacyInquiries@epic.com.
If you need to contact our Data Protection Officer or EU Representative, please email EUPrivacyInquiries@epic.com or call +1 608-271-9000.
Qualifications & exceptions
General policy questions use PrivacyInquiries@epic.com; the Data Protection Officer or EU Representative use EUPrivacyInquiries@epic.com.
Not stated here
Response times are not stated.
Sharing & Disclosure · Company practice
Epic enables customers to exchange data over Carequality but says it does not handle that information
Epic is a member of Carequality, an initiative of The Sequoia Project. Epic makes functionality available to its customers so they can exchange data with other healthcare organizations that use the Carequality Framework. Epic says it does not handle information transmitted in the course of its customers' use of Carequality. The statement concerns Epic's own handling of that transmitted information, and the paragraph does not describe what the customers do.
Supporting quotations
Carequality Information Handling Practices Statement
Epic is a member of Carequality, an initiative of The Sequoia Project.
Epic makes functionality available to its customers to enable them to exchange data with other healthcare organizations using the Carequality Framework.
Epic does not handle information transmitted in the course of its customers’ use of Carequality.
Qualifications & exceptions
The exchange is done by Epic's customers (healthcare organizations) using functionality Epic provides.
Epic's statement that it does not handle the information is limited to information transmitted in the course of its customers' use of Carequality.
Not stated here
How participating healthcare organizations handle that information is not described here.
Security & Safeguards · Context
Security and vulnerability-reporting headings have no text in the saved copy
The saved text ends with a 'Security' heading and a 'Report a Potential Security Vulnerability or Concern' heading. No instructions or contact details appear beneath either heading in this saved copy, so this document does not say here how to report a vulnerability.
Supporting quotations
Security
Report a Potential Security Vulnerability or Concern
Qualifications & exceptions
Only the headings are present in the saved text.
Not stated here
How to report a security vulnerability or concern is not stated in the saved text.