Security & Privacy Policies

We maintain the official version of our policy in English and make machine translations available for your convenience.

• English is the official version; translations are offered for convenience Legal Rights & Agreement Rules

We maintain the official version of our policy in English and make machine translations available for your convenience.

• English is the official version; translations are offered for convenience Legal Rights & Agreement Rules

Epic Mobile Application Privacy Policy for Patients

Last Updated: August 12, 2025

• This copy of the policy is dated August 12, 2025 Legal Rights & Agreement Rules

Overview

Mobile Apps for Patients

• The policy covers Epic's patient mobile apps, including MyChart for iOS and Android Account & Service Control

Our mobile applications for patients, including MyChart for iOS and Android, connect to servers and systems operated and maintained by healthcare organizations that use Epic – to provide patients with secure, mobile access to health information in those servers and systems.

• The policy covers Epic's patient mobile apps, including MyChart for iOS and Android Account & Service Control

We refer to our mobile applications for patients as “mobile apps” in this policy.

• The policy covers Epic's patient mobile apps, including MyChart for iOS and Android Account & Service Control

Epic’s Commitments To You

• Epic says it does not sell or license your information Sharing & Disclosure

We do not sell or license your information.

• Epic says it does not sell or license your information Sharing & Disclosure

We do not receive or store copies of any health or fitness data that you transmit to your healthcare organizations using our mobile apps.

• Epic says it does not receive or store copies of health or fitness data sent to healthcare organizations Retention & Deletion

This Privacy Policy

• The policy describes how Epic interacts with your information when you use the apps Legal Rights & Agreement Rules

This policy describes how we interact with your information when you use our mobile apps.

• The policy describes how Epic interacts with your information when you use the apps Legal Rights & Agreement Rules

We may update this policy at any time, and future updates are effective as soon as they are published. Your use of any of our mobile apps is also subject to any applicable End User License Agreement terms and/or other applicable terms of use specified by your healthcare provider. If you use our mobile apps, you have agreed to the mobile apps’ End User License Agreement terms and/or the other applicable terms of use specified by your healthcare provider and consented to the use of your information as described in this policy.

• Epic may update the policy at any time; updates take effect when published Legal Rights & Agreement Rules
• Using the apps is treated as agreeing to the EULA or provider terms and consenting to the policy Legal Rights & Agreement Rules

Your Personal Information

The Limited Ways Our Mobile Apps Interact With Your Information

• The listed app interactions with your information are limited and depend on healthcare organization settings Use & Processing
• Android disclosure: access, collection, use and sharing are as stated in the earlier list, with permission Data Access & Collection

These are the limited ways our mobile apps interact with your information on behalf of your healthcare organizations, depending on the features your healthcare organizations enable for your use:

• The listed app interactions with your information are limited and depend on healthcare organization settings Use & Processing

• When you add a profile photo to our mobile apps, you may select an existing photo on your device or take a new photo using the camera app on your device. If you select an existing photo on your device or use a camera app on your device to take a new photo, a temporary copy of your chosen photo is stored in our mobile app via app-private storage on your device. Certain camera apps may save a copy of your new photo in locations outside of our mobile app's app-private storage; you should review the privacy policy for the camera app you use to understand how that app interacts with your photos. Temporary files stored in our mobile app’s app-private storage on your device are regularly deleted and are also deleted if you uninstall our mobile app. If you already have a profile photo stored in your profile through your healthcare organization – our mobile apps do not interact with that photo in any way.
• • Adding a profile photo stores a temporary copy in the app's private storage Use & Processing
  • Some camera apps may save the new photo outside the app; check that app's privacy policy Use & Processing
  • Data stays in app-private storage other apps cannot reach; saved files go elsewhere only with your explicit permission Security & Safeguards
• When you connect our mobile apps to Google Fit, Health Connect (by Google), or Apple Health, your health and fitness data is securely transmitted by our mobile apps and saved in your medical record at your healthcare organization. We do not store any health and fitness data within our mobile apps. Any information required for you to select recipients of your data is encrypted and stored in app-private storage. If you stop sharing your health and fitness data or uninstall our mobile app, the encrypted information is deleted from app-private storage.
• • Connected health platforms: data goes to your healthcare organization and is not stored in the app Sharing & Disclosure
• When you view documents from your healthcare organization (such as letters or images) using our mobile apps, to make the files viewable for you temporary copies are stored on your device in app-private storage. The temporary copies are deleted when you close your session on our mobile apps.
• • Viewing documents stores temporary copies on your device until you close your session Retention & Deletion
• When you include a photo or video in a message you send to your healthcare organization using our mobile apps, you may select an existing photo or video from your device or take a new photo or video using the camera app on your device. If you use the camera app on your device to take new photos or videos, temporary copies are stored on your device in app-private storage. These temporary files are regularly deleted and are also deleted if you uninstall our mobile apps.
• • Photos or videos taken with the camera app for messages leave temporary copies in app-private storage Use & Processing
  • Data stays in app-private storage other apps cannot reach; saved files go elsewhere only with your explicit permission Security & Safeguards
• If your healthcare organization offers telehealth appointments using our mobile apps, when you join a telehealth appointment with your provider, our mobile apps will ask for permission to access your device's video and audio functionality to make the appointment possible. Our mobile apps do not record or store video or audio data from these visits.
• • Telehealth: the apps ask for video and audio access and do not record or store the visit Data Access & Collection
  • Android disclosure: microphone only for voice navigation and camera roll only for a profile image Data Access & Collection
• If your healthcare organization offers automatic appointment arrival and you choose to enable it, our mobile apps temporarily store identifiers and times for your upcoming appointments in app-private storage to detect your arrival at an appointment. If you stop using our mobile apps or you disable automatic appointment arrival, the identifiers are deleted.
• • If you enable automatic appointment arrival, upcoming appointment identifiers and times are kept temporarily in the app Data Access & Collection
• If your healthcare organization offers location-based check in for in-person appointments, or allows you to find healthcare providers near you, you may choose to allow our mobile apps to temporarily interact with your device’s location data for those purposes. Our mobile apps do not store or use your location data in any other way.
• • Location access is optional and used only for location-based check-in or finding nearby providers Data Access & Collection
• If your healthcare organization allows you to notify front desk staff electronically when you arrive for an appointment, you may choose to allow our mobile apps to interact with your Bluetooth data for this purpose. Our mobile apps do not store your Bluetooth data.
• • Bluetooth access is optional, used to tell front desk staff you have arrived, and not stored Data Access & Collection
• While you use our mobile apps, if you choose to call a phone number displayed within the app, we will ask for permission to access your device’s phone to place a call to the phone number. Our mobile apps do not store your call history or data about the call.
• • Calling a number shown in the app asks for phone access; call history and call data are not stored Data Access & Collection
• Any temporary files created during the interactions described above are regularly deleted, and are also deleted if you uninstall our mobile apps.
• • Temporary files from the interactions above are regularly deleted and removed on uninstall Retention & Deletion
• If you have a MyChart Central account, we store limited personal information on Epic-owned servers in the United States. This information includes your name, date of birth, and the contact information you used to create your account and link it with your MyChart accounts at the healthcare organizations that care for you. This information is used to provide services or functionality for MyChart Central, including: helping you log into your MyChart accounts at your healthcare organizations, MyChart Central password recovery, and MyChart Central user support. You can edit and share MyChart Central account information with the healthcare organizations you have linked to your MyChart Central account. If you need to delete the information used by Epic to create your MyChart Central account, you can do so via the “Account Deactivation” page within MyChart Central. Once you submit an account deactivation request, your account information will be deleted via an automatic deletion process that runs periodically (typically once per day). The deletion only applies to the information used to create your MyChart Central account; for guidance on deleting health data viewable within MyChart, see "Your Healthcare Organizations" below.
• • Epic says it does not receive or store copies of health or fitness data sent to healthcare organizations Retention & Deletion
  • If you have a MyChart Central account, Epic stores limited account information on its US servers Account & Service Control
  • You can edit MyChart Central account information and share it with linked healthcare organizations Account & Service Control
  • Deactivating your MyChart Central account deletes the information used to create it, on a periodic schedule Retention & Deletion
  • Questions about their policies, health information storage and deletion requests go to your healthcare organizations Legal Rights & Agreement Rules
  • Epic has internal retention and deletion policies meant to keep only the information described in the policy Retention & Deletion

Your Healthcare Organizations

• Deactivating your MyChart Central account deletes the information used to create it, on a periodic schedule Retention & Deletion
• You need an account with a healthcare organization using Epic's software, and its privacy policy also applies Account & Service Control

To use our mobile apps, you must have an account with a healthcare organization using Epic's software. Because of this, your use of our mobile apps is also subject to each of your healthcare organizations' privacy policies.

• The listed app interactions with your information are limited and depend on healthcare organization settings Use & Processing
• You need an account with a healthcare organization using Epic's software, and its privacy policy also applies Account & Service Control

Please contact your healthcare organizations if you have any questions about their privacy policies, how they store and retain your health information, and how you can make requests to them about their disclosure, correction, or deletion of your health information.

• Questions about their policies, health information storage and deletion requests go to your healthcare organizations Legal Rights & Agreement Rules

For Android Users – Required Google Play Disclosures for Certain Health Apps

• Android users: Epic gives extra disclosures because Google treats the apps as Health Apps Legal Rights & Agreement Rules

Google has determined our mobile apps are subject to their Health Apps requirements. As a result, we are required to provide the following information so we can make our mobile apps available to you in the Play store.

• Android users: Epic gives extra disclosures because Google treats the apps as Health Apps Legal Rights & Agreement Rules

• Our mobile apps interact with your microphone only if you use your microphone to navigate our mobile apps. Our mobile apps interact with your camera roll only if you add a profile image to a profile in our mobile apps.
• • Android disclosure: microphone only for voice navigation and camera roll only for a profile image Data Access & Collection
• Our mobile apps access, collect, use, and share your information (including video, audio, images, files, phone) as stated above in the section titled, “The Limited Ways Our Mobile Apps Interact With Your Information.” We also prominently highlight these uses, describe the type of data being accessed, and obtain your permission for these purposes as you use our mobile apps.
• • Android disclosure: access, collection, use and sharing are as stated in the earlier list, with permission Data Access & Collection
• Your healthcare organization may allow you to use our mobile apps to conduct telehealth appointments with your healthcare providers. Our mobile apps only provide a technical mechanism for those appointments to occur. Our mobile apps do not interact with any health information about you exchanged during any telehealth appointments.
• • Telehealth: the apps ask for video and audio access and do not record or store the visit Data Access & Collection
  • Android disclosure: the apps only provide a technical mechanism for telehealth appointments Use & Processing

Limited Information Collected from You or Your Device

• Epic collects limited non-identifying usage and device information for customer service and to understand app use Data Access & Collection

Non-identifying Information Collected to Provide Customer Service and Support

• Epic collects limited non-identifying usage and device information for customer service and to understand app use Data Access & Collection

While you use our mobile apps, we collect the following non-identifying information so we can provide customer service to you or your healthcare organization and understand how people use our mobile apps:

• Epic collects limited non-identifying usage and device information for customer service and to understand app use Data Access & Collection

• the time you began using the app
• • Epic collects limited non-identifying usage and device information for customer service and to understand app use Data Access & Collection
• the name of the healthcare organization you interacted with
• • Epic collects limited non-identifying usage and device information for customer service and to understand app use Data Access & Collection
• any error messages or codes
• • Epic collects limited non-identifying usage and device information for customer service and to understand app use Data Access & Collection
• the model of device you used and its operating system
• • Epic collects limited non-identifying usage and device information for customer service and to understand app use Data Access & Collection
• the version of our mobile app used
• • Epic collects limited non-identifying usage and device information for customer service and to understand app use Data Access & Collection
• if you use Android devices, your connection type (cellular or Wi-Fi)during any errors
• • Epic collects limited non-identifying usage and device information for customer service and to understand app use Data Access & Collection

Information Used to Keep Data and Systems Secure

• Epic's servers automatically record IP address, language, date and time and device type Data Access & Collection

While you use our mobile apps, our servers automatically collect and record the following information:

• Epic's servers automatically record IP address, language, date and time and device type Data Access & Collection

• Internet Protocol (IP) address (which may tell us generally where you are located)
• • Epic's servers automatically record IP address, language, date and time and device type Data Access & Collection
• Language preference
• • Epic's servers automatically record IP address, language, date and time and device type Data Access & Collection
• Date and time
• • Epic's servers automatically record IP address, language, date and time and device type Data Access & Collection
• Type of device or system you use
• • Epic's servers automatically record IP address, language, date and time and device type Data Access & Collection

Epic has a legitimate interest in collecting, processing, and retaining this data in support of its information security operations to prevent unauthorized access to or misuse of our systems and to prevent cybersecurity incidents.

• Epic says it has a legitimate interest in collecting and retaining the server data for security Retention & Deletion

Personal Information Collected From You (If You Contact Us)

• If you contact Epic, it may keep a record of the communication; you choose what to share Data Access & Collection
• Where Epic collects or receives personal information, it uses technical controls and safeguards Security & Safeguards

If you contact us through [the methods listed on Our Website](https://www.epic.com/contact), we may keep a record of the communication. You can decide how much information you want to share with us in those cases

• If you contact Epic, it may keep a record of the communication; you choose what to share Data Access & Collection
• Where Epic collects or receives personal information, it uses technical controls and safeguards Security & Safeguards

How We Protect Your Personal Information

• Where Epic collects or receives personal information, it uses technical controls and safeguards Security & Safeguards

In the limited situations where Epic collects or receives your personal information (for example, if you contact us for support), we use technical controls and safeguards to protect the privacy, security, integrity, and availability of your personal information. Our mobile apps also use technical controls and safeguards to help keep your information safe while you use our mobile apps.

• Where Epic collects or receives personal information, it uses technical controls and safeguards Security & Safeguards

Safeguards and Controls Built Into Our Mobile Apps

• The apps use multi-factor authentication by default unless the healthcare organization changes it Security & Safeguards

• Our mobile apps use multi-factor authentication by default. Multi-factor authentication is required when you use our mobile apps unless your healthcare organization makes or allows changes to this control.
• • The apps use multi-factor authentication by default unless the healthcare organization changes it Security & Safeguards
• Our mobile apps store data on your mobile device in app-private storage that cannot be accessed by other apps. Files you download or save from our mobile apps may be placed in locations accessible to other apps, such as your files app, only with your explicit permission.
• • Data stays in app-private storage other apps cannot reach; saved files go elsewhere only with your explicit permission Security & Safeguards
• Our mobile apps use in-app notifications and permission requests to help you make informed decisions about when and how your data is shared with other apps on your device.
• • The apps use in-app notifications and permission requests to help you decide when data is shared with other apps Security & Safeguards
• Our mobile apps disable screen-shot functionality by default for Android devices (we cannot disable this functionality in iOS). Android users can enable the function if they want to.
• • Screenshots are disabled by default on Android, cannot be disabled on iOS, and Android users can enable them Security & Safeguards
• Our mobile apps use https for secure communication with servers.
• • The apps use https for secure communication with servers Security & Safeguards

Additional Steps We Take At Epic

• Epic limits internal access to information you send it to staff who need it for their jobs Security & Safeguards
• Epic has internal retention and deletion policies meant to keep only the information described in the policy Retention & Deletion

• At Epic, we maintain internal policies and processes that limit access to the information you send to us to our staff who need to know the information to perform their jobs.
• • Epic limits internal access to information you send it to staff who need it for their jobs Security & Safeguards
• At Epic, we maintain internal data retention and deletion policies to help us ensure we only store information about your use of our mobile apps as described above in this policy.
• • Epic has internal retention and deletion policies meant to keep only the information described in the policy Retention & Deletion

Each healthcare organization you connect to through our mobile apps also uses safeguards to protect your information. Contact them if you have any questions about their safeguards.

• Your healthcare organizations use their own safeguards; ask them about those Security & Safeguards

You can take other steps to protect your information:

• Steps Epic suggests you take: protect your password, use device security tools, and do not root or jailbreak Security & Safeguards

• Do not share the username and password you use with our mobile apps.
• • Steps Epic suggests you take: protect your password, use device security tools, and do not root or jailbreak Security & Safeguards
• Change your password immediately if you believe any unauthorized access has occurred.
• • Steps Epic suggests you take: protect your password, use device security tools, and do not root or jailbreak Security & Safeguards
• Use the security tools on devices you use with our mobile apps.
• • Steps Epic suggests you take: protect your password, use device security tools, and do not root or jailbreak Security & Safeguards
• Do not root or jailbreak devices you use with our mobile apps. Doing so can create security risks by removing your devices’ built-in security measures and exposing sensitive information on your device.
• • Steps Epic suggests you take: protect your password, use device security tools, and do not root or jailbreak Security & Safeguards

Links to External Websites

• Epic is not responsible for external websites or third-party embedded media linked from the apps Linking & Identification

Our mobile apps contain links to external websites and may contain embedded media hosted by third parties, such as YouTube videos. Epic is not responsible for the content or privacy practices of external websites. We encourage you to be aware when you leave our mobile apps or engage with media hosted by third parties and to read the privacy statements of any external website that collects your information.

• Epic is not responsible for external websites or third-party embedded media linked from the apps Linking & Identification

Your Privacy Rights

• GDPR questions: contact Epic's DPO or EU Representative; data subject requests go to your healthcare organization Legal Rights & Agreement Rules

GDPR and UK GDPR Privacy Questions

• GDPR questions: contact Epic's DPO or EU Representative; data subject requests go to your healthcare organization Legal Rights & Agreement Rules

If you need to contact our Data Protection Officer or EU Representative, please email EUPrivacyInquiries@epic.com or call +1 608-271-9000. If you are a Data Subject as defined by GDPR, you should reach out to your healthcare organization for requests related to your personal data accessed through our mobile apps.

• GDPR questions: contact Epic's DPO or EU Representative; data subject requests go to your healthcare organization Legal Rights & Agreement Rules

California Privacy Questions

• California privacy questions are directed to a separate Privacy Notice for California Residents Legal Rights & Agreement Rules

Please visit our Privacy Notice for California Residents .

• California privacy questions are directed to a separate Privacy Notice for California Residents Legal Rights & Agreement Rules

Contact Epic

• Medical-record questions go to your healthcare organization; policy questions go to Epic by phone or email Legal Rights & Agreement Rules

If you have questions about your medical information in an account with a healthcare organization using Epic’s software, please reach out to your healthcare organization using the contact information in their privacy policy.

• Medical-record questions go to your healthcare organization; policy questions go to Epic by phone or email Legal Rights & Agreement Rules

If you have any questions about this policy, contact us at +1 608-271-9000 or at PrivacyInquiries@epic.com.

• Medical-record questions go to your healthcare organization; policy questions go to Epic by phone or email Legal Rights & Agreement Rules

Changelog

• The changelog lists one update, August 12, 2025: clarified governing terms and MyChart Central information added Legal Rights & Agreement Rules

August 12, 2025 Update:

• The changelog lists one update, August 12, 2025: clarified governing terms and MyChart Central information added Legal Rights & Agreement Rules

• In the section titled “This Privacy Policy”
• • The changelog lists one update, August 12, 2025: clarified governing terms and MyChart Central information added Legal Rights & Agreement Rules
• Added clarification that use of Epic Mobile Applications is governed by this privacy policy, the Mobile Application End User License Agreement (EULA), and relevant terms of use from your healthcare provider
• • The changelog lists one update, August 12, 2025: clarified governing terms and MyChart Central information added Legal Rights & Agreement Rules
• In the section titled “The Limited Ways Our Mobile Apps Interact With Your Information”
• • The changelog lists one update, August 12, 2025: clarified governing terms and MyChart Central information added Legal Rights & Agreement Rules
• Added information specific to MyChart Central users
• • The changelog lists one update, August 12, 2025: clarified governing terms and MyChart Central information added Legal Rights & Agreement Rules

Security

• The saved text ends with a security vulnerability reporting heading and no instructions Security & Safeguards

Report a Potential Security Vulnerability or Concern

• The saved text ends with a security vulnerability reporting heading and no instructions Security & Safeguards