Epic Mobile Application Privacy Policy for Patients

Epic MyChart · agreement dated August 12, 2025 · Official agreement

Read the agreement

11 of 49 cards in Legal Rights & Agreement Rules

Legal Rights & Agreement Rules · Company practice

English is the official version; translations are offered for convenience

Epic says the English text is the official version of its policy and that it makes machine translations available for convenience. In practice, the English wording is the one Epic identifies as official; a translated copy is described as a convenience rather than as the official text.

Supporting quotations

We maintain the official version of our policy in English and make machine translations available for your convenience.
We maintain the official version of our policy in English and make machine translations available for your convenience.

Qualifications & exceptions

  • The same sentence appears twice in the saved text (two consecutive blocks), so both are anchored here.
  • The wording covers machine translations only; it does not mention human translations.

Not stated here

  • The passage does not say what happens if a machine translation differs from the English text.

Legal Rights & Agreement Rules · Context

This copy of the policy is dated August 12, 2025

The saved policy states it was last updated on August 12, 2025. That is the version this analysis explains; it is a last-updated date, not a statement that every practice described took effect on that day.

Supporting quotations

Last Updated: August 12, 2025

Qualifications & exceptions

  • The date is labeled 'Last Updated', not an effective date.
  • The policy says later updates take effect when published, so a newer version could exist after this saved copy.

Not stated here

  • Whether a later version has been published since this copy was saved is not shown by the saved text.

Legal Rights & Agreement Rules · Context

The policy describes how Epic interacts with your information when you use the apps

This policy's stated job is to describe how Epic interacts with a patient's information when the patient uses the mobile apps. It speaks for Epic's own interactions, not for the healthcare organizations the apps connect to.

Supporting quotations

This Privacy Policy
This policy describes how we interact with your information when you use our mobile apps.

Qualifications & exceptions

  • Later sections of the same policy say the patient's use of the apps is also subject to each healthcare organization's own privacy policy.
  • 'Interact' is the policy's own word; it is not defined in this passage.

Not stated here

  • The passage does not define 'interact' or 'your information'.

Legal Rights & Agreement Rules · Permission or license

Epic may update the policy at any time; updates take effect when published

Epic reserves the right to change this policy whenever it chooses, and a change takes effect as soon as it is published. The sentence does not describe any advance warning or separate notice to patients.

Supporting quotations

We may update this policy at any time, and future updates are effective as soon as they are published.

Qualifications & exceptions

  • Updates are effective immediately on publication, not after a waiting period.
  • The sentence says nothing about advance notice, notification to users, or a right to refuse an update.

Not stated here

  • This sentence does not say how patients learn of an update; the policy later contains a Changelog section, but whether it is meant as notice is not stated.

Legal Rights & Agreement Rules · Procedure

Questions about their policies, health information storage and deletion requests go to your healthcare organizations

Epic tells patients to contact their healthcare organizations for questions about those organizations' privacy policies, how they store and keep health information, and how to make requests to them about disclosing, correcting or deleting health information. This is also the guidance the MyChart Central deletion item points to for deleting health data viewable within MyChart.

Supporting quotations

Please contact your healthcare organizations if you have any questions about their privacy policies, how they store and retain your health information, and how you can make requests to them about their disclosure, correction, or deletion of your health information.
for guidance on deleting health data viewable within MyChart, see "Your Healthcare Organizations" below

Qualifications & exceptions

  • The requests described are made to the healthcare organizations, not to Epic.
  • This section is the one the MyChart Central deletion item refers to for health data viewable within MyChart.

Not stated here

  • The passage does not say how to contact a given healthcare organization or what each one will do with a request.

Legal Rights & Agreement Rules · Context

Android users: Epic gives extra disclosures because Google treats the apps as Health Apps

Epic says Google has decided the mobile apps are subject to Google's Health Apps requirements, and that Epic therefore must provide the following information in order to offer the apps in the Play store. The section is headed for Android users.

Supporting quotations

For Android Users – Required Google Play Disclosures for Certain Health Apps
Google has determined our mobile apps are subject to their Health Apps requirements.
As a result, we are required to provide the following information so we can make our mobile apps available to you in the Play store.

Qualifications & exceptions

  • The section is labeled for Android users and Google Play.
  • The disclosures are stated to be required for availability in the Play store.

Not stated here

  • The passage does not say whether the same disclosures apply on other platforms.

Legal Rights & Agreement Rules · Procedure

GDPR questions: contact Epic's DPO or EU Representative; data subject requests go to your healthcare organization

For people covered by the GDPR, Epic gives an email address and phone number for its Data Protection Officer or EU Representative. It also says that a person who is a Data Subject as defined by the GDPR should reach out to their healthcare organization for requests related to their personal data accessed through the mobile apps.

Supporting quotations

Your Privacy Rights
GDPR and UK GDPR Privacy Questions
If you need to contact our Data Protection Officer or EU Representative, please email EUPrivacyInquiries@epic.com or call +1 608-271-9000.
If you are a Data Subject as defined by GDPR, you should reach out to your healthcare organization for requests related to your personal data accessed through our mobile apps.

Qualifications & exceptions

  • Requests about personal data accessed through the apps are directed to the healthcare organization, not to Epic.
  • The heading mentions the UK GDPR as well, but the sentences under it refer to the GDPR and an EU Representative only.

Not stated here

  • The passage does not say how requests about information Epic itself holds, such as MyChart Central account information, server records or support communications, are handled.
  • The policy does not describe the rights a Data Subject has.

Legal Rights & Agreement Rules · Context

California privacy questions are directed to a separate Privacy Notice for California Residents

Under the heading for California privacy questions, the policy only points the reader to Epic's separate Privacy Notice for California Residents. This policy itself gives no California-specific rights or statements.

Supporting quotations

California Privacy Questions
Please visit our Privacy Notice for California Residents

Qualifications & exceptions

  • The policy refers to a separate notice and does not set out its content.

Not stated here

  • The Privacy Notice for California Residents is a separate document that is not supplied here, so its content is not analyzed.

Legal Rights & Agreement Rules · Procedure

Medical-record questions go to your healthcare organization; policy questions go to Epic by phone or email

Epic says that questions about medical information in an account with a healthcare organization should go to that organization, using the contact details in its privacy policy. Questions about this policy go to Epic at +1 608-271-9000 or PrivacyInquiries@epic.com.

Supporting quotations

Contact Epic
If you have questions about your medical information in an account with a healthcare organization using Epic’s software, please reach out to your healthcare organization using the contact information in their privacy policy.
If you have any questions about this policy, contact us at +1 608-271-9000 or at PrivacyInquiries@epic.com.

Qualifications & exceptions

  • Two different contacts: the healthcare organization for medical information, Epic for questions about this policy.

Legal Rights & Agreement Rules · Context

The changelog lists one update, August 12, 2025: clarified governing terms and MyChart Central information added

The policy's changelog lists an August 12, 2025 update. In the section titled 'This Privacy Policy', it added clarification that use of Epic's mobile applications is governed by this privacy policy, the Mobile Application End User License Agreement and relevant terms of use from the patient's healthcare provider. In the section on the limited ways the apps interact with information, it added information specific to MyChart Central users.

Supporting quotations

Changelog
August 12, 2025 Update:
In the section titled “This Privacy Policy”
Added clarification that use of Epic Mobile Applications is governed by this privacy policy, the Mobile Application End User License Agreement (EULA), and relevant terms of use from your healthcare provider
In the section titled “The Limited Ways Our Mobile Apps Interact With Your Information”
Added information specific to MyChart Central users

Qualifications & exceptions

  • Only one dated update is shown in the saved text.

Not stated here

  • The saved text does not show earlier changes.

Cross-references