English is the official version; translations are offered for convenience
Epic says the English text is the official version of its policy and that it makes machine translations available for convenience. In practice, the English wording is the one Epic identifies as official; a translated copy is described as a convenience rather than as the official text.
Supporting quotations
We maintain the official version of our policy in English and make machine translations available for your convenience.
We maintain the official version of our policy in English and make machine translations available for your convenience.
Qualifications & exceptions
The same sentence appears twice in the saved text (two consecutive blocks), so both are anchored here.
The wording covers machine translations only; it does not mention human translations.
Not stated here
The passage does not say what happens if a machine translation differs from the English text.
Legal Rights & Agreement Rules · Context
This copy of the policy is dated August 12, 2025
The saved policy states it was last updated on August 12, 2025. That is the version this analysis explains; it is a last-updated date, not a statement that every practice described took effect on that day.
Supporting quotations
Last Updated: August 12, 2025
Qualifications & exceptions
The date is labeled 'Last Updated', not an effective date.
The policy says later updates take effect when published, so a newer version could exist after this saved copy.
Not stated here
Whether a later version has been published since this copy was saved is not shown by the saved text.
Account & Service Control · Context
The policy covers Epic's patient mobile apps, including MyChart for iOS and Android
The policy is about Epic's mobile applications for patients, with MyChart for iOS and Android given as examples. Those apps connect to servers and systems that healthcare organizations using Epic operate and maintain, so that patients can see health information held in those servers and systems on a mobile device. The policy calls these apps 'mobile apps'.
Supporting quotations
Mobile Apps for Patients
Our mobile applications for patients, including MyChart for iOS and Android, connect to servers and systems operated and maintained by healthcare organizations that use Epic – to provide patients with secure, mobile access to health information in those servers and systems.
We refer to our mobile applications for patients as “mobile apps” in this policy.
Qualifications & exceptions
'including' makes MyChart for iOS and Android examples, not necessarily the complete list.
The health information being accessed is described as sitting in servers and systems operated by healthcare organizations, not by Epic.
The apps connect to systems of healthcare organizations that use Epic; the passage does not say that every healthcare organization or feature is enabled for every patient.
Not stated here
The passage does not list which other patient mobile apps, if any, are covered.
Legal Rights & Agreement Rules · Context
The policy describes how Epic interacts with your information when you use the apps
This policy's stated job is to describe how Epic interacts with a patient's information when the patient uses the mobile apps. It speaks for Epic's own interactions, not for the healthcare organizations the apps connect to.
Supporting quotations
This Privacy Policy
This policy describes how we interact with your information when you use our mobile apps.
Qualifications & exceptions
Later sections of the same policy say the patient's use of the apps is also subject to each healthcare organization's own privacy policy.
'Interact' is the policy's own word; it is not defined in this passage.
Not stated here
The passage does not define 'interact' or 'your information'.
Sharing & Disclosure · Company commitment
Epic says it does not sell or license your information
Under the heading 'Epic's Commitments To You', Epic states that it does not sell or license your information. The sentence rules out sale and licensing; it does not by itself describe other kinds of disclosure.
Supporting quotations
Epic’s Commitments To You
We do not sell or license your information.
Qualifications & exceptions
The commitment covers selling and licensing; other ways of passing information on are not addressed by this sentence.
The sentence states no exceptions or conditions.
Not stated here
'Your information' is not defined here, so it is not clear from this sentence whether it also covers the technical and security data the policy later says Epic collects.
Retention & Deletion · Company commitment
Epic says it does not receive or store copies of health or fitness data sent to healthcare organizations
Epic states that it does not receive or store copies of health or fitness data that a patient transmits to their healthcare organizations using the mobile apps. This is a narrow statement about that transmitted health and fitness data. It is not a statement that Epic holds no information at all: the policy elsewhere says Epic stores limited MyChart Central account information on its own servers, collects limited technical and security information, and may keep a record if you contact Epic.
Supporting quotations
We do not receive or store copies of any health or fitness data that you transmit to your healthcare organizations using our mobile apps.
we store limited personal information on Epic-owned servers in the United States
Qualifications & exceptions
Limited to health or fitness data the patient transmits to their healthcare organizations using the mobile apps.
For patients with a MyChart Central account, the policy says Epic stores limited personal information on Epic-owned servers in the United States; that is a different category of information from the transmitted health and fitness data.
Not stated here
The sentence does not say how it applies to health information other than data the patient transmits to a healthcare organization.
Legal Rights & Agreement Rules · Permission or license
Epic may update the policy at any time; updates take effect when published
Epic reserves the right to change this policy whenever it chooses, and a change takes effect as soon as it is published. The sentence does not describe any advance warning or separate notice to patients.
Supporting quotations
We may update this policy at any time, and future updates are effective as soon as they are published.
Qualifications & exceptions
Updates are effective immediately on publication, not after a waiting period.
The sentence says nothing about advance notice, notification to users, or a right to refuse an update.
Not stated here
This sentence does not say how patients learn of an update; the policy later contains a Changelog section, but whether it is meant as notice is not stated.
Legal Rights & Agreement Rules · Permission or license
Using the apps is treated as agreeing to the EULA or provider terms and consenting to the policy
The policy says use of the mobile apps is also subject to any applicable End User License Agreement terms and, or, other terms of use set by the patient's healthcare provider. It then says that by using the apps a patient has agreed to those EULA and provider terms and has consented to the use of their information as described in this policy. In other words, using the apps is how consent is treated as given; there is no separate acceptance step described here.
Supporting quotations
Your use of any of our mobile apps is also subject to any applicable End User License Agreement terms and/or other applicable terms of use specified by your healthcare provider.
If you use our mobile apps, you have agreed to the mobile apps’ End User License Agreement terms and/or the other applicable terms of use specified by your healthcare provider and consented to the use of your information as described in this policy.
Qualifications & exceptions
The condition is use of the mobile apps.
'and/or' means the agreement can be to the EULA terms, to the healthcare provider's terms, or to both, depending on which are applicable.
The consent described is to the use of information 'as described in this policy', so it is tied to the practices the policy sets out.
Not stated here
The text of the Mobile Application End User License Agreement and of any healthcare provider's terms of use is not part of this document and is not analyzed here.
The passage does not say which healthcare provider terms apply to a given patient.
Use & Processing · Context
The listed app interactions with your information are limited and depend on healthcare organization settings
This introduces a list of the limited ways the mobile apps interact with a patient's information. The policy says these interactions happen on behalf of the patient's healthcare organizations and depend on which features those organizations turn on for the patient. Because use of the apps also requires an account with a healthcare organization that uses Epic, the policy adds that the patient's use of the apps is also subject to each of those organizations' own privacy policies.
Supporting quotations
The Limited Ways Our Mobile Apps Interact With Your Information
These are the limited ways our mobile apps interact with your information on behalf of your healthcare organizations, depending on the features your healthcare organizations enable for your use:
Because of this, your use of our mobile apps is also subject to each of your healthcare organizations' privacy policies.
Qualifications & exceptions
Which interactions apply to a given patient depends on the features their healthcare organizations enable.
The interactions are described as being on behalf of the healthcare organizations.
Use of the apps is also subject to each healthcare organization's own privacy policy, so this list is not the only privacy policy that applies.
Not stated here
The healthcare organizations' own privacy policies are not part of this document and are not analyzed here.
Use & Processing · Company practice
Adding a profile photo stores a temporary copy in the app's private storage
When a patient adds a profile photo, they can pick an existing photo or take a new one with the device's camera app. A temporary copy of the chosen photo is kept inside the mobile app in app-private storage on the device. Those temporary files are regularly deleted and are also deleted if the app is uninstalled. If a profile photo is already stored through the healthcare organization, the apps do not interact with it.
Supporting quotations
When you add a profile photo to our mobile apps, you may select an existing photo on your device or take a new photo using the camera app on your device.
a temporary copy of your chosen photo is stored in our mobile app via app-private storage on your device
Temporary files stored in our mobile app’s app-private storage on your device are regularly deleted and are also deleted if you uninstall our mobile app.
If you already have a profile photo stored in your profile through your healthcare organization – our mobile apps do not interact with that photo in any way.
Qualifications & exceptions
Applies when the patient adds a profile photo in the mobile apps.
The temporary copy is stored on the device, in the app's private storage.
The apps do not interact with a profile photo already stored through the healthcare organization.
Not stated here
'Regularly deleted' is not tied to a stated interval.
Use & Processing · Restriction or exception
Some camera apps may save the new photo outside the app; check that app's privacy policy
If a patient takes a new profile photo with the device's camera app, some camera apps may save a copy of that photo in places outside this app's private storage. Epic tells the patient to review the privacy policy of the camera app they use to understand how that app handles photos. That copy is the camera app's, not covered by this policy's description of the app's own temporary copy.
Supporting quotations
Certain camera apps may save a copy of your new photo in locations outside of our mobile app's app-private storage; you should review the privacy policy for the camera app you use to understand how that app interacts with your photos.
Qualifications & exceptions
Applies to certain camera apps, not all; the policy does not name them.
The statement is about copies saved by the camera app, outside the mobile app's app-private storage.
Not stated here
Which camera apps do this, and how long their copies are kept, is not stated.
Sharing & Disclosure · Company practice
Connected health platforms: data goes to your healthcare organization and is not stored in the app
If a patient connects the mobile apps to Google Fit, Health Connect (by Google) or Apple Health, the health and fitness data is transmitted by the apps and saved in the patient's medical record at their healthcare organization. Epic says it does not store health and fitness data within the apps. Whatever information is needed for the patient to choose recipients of the data is kept encrypted in app-private storage, and it is deleted if the patient stops sharing or uninstalls the app.
Supporting quotations
When you connect our mobile apps to Google Fit, Health Connect (by Google), or Apple Health, your health and fitness data is securely transmitted by our mobile apps and saved in your medical record at your healthcare organization.
We do not store any health and fitness data within our mobile apps.
Any information required for you to select recipients of your data is encrypted and stored in app-private storage.
If you stop sharing your health and fitness data or uninstall our mobile app, the encrypted information is deleted from app-private storage.
Qualifications & exceptions
Applies when the patient connects the apps to one of the named health platforms.
The data ends up in the medical record at the healthcare organization, which is a separate party from Epic with its own privacy policy.
'Securely' is Epic's own description; the passage does not explain the security method.
Not stated here
The passage does not describe how Google or Apple handle the data on their side.
Retention & Deletion · Company practice
Viewing documents stores temporary copies on your device until you close your session
When a patient views documents from their healthcare organization in the apps, such as letters or images, temporary copies are stored on the device in app-private storage so the files can be viewed. The copies are deleted when the patient closes their session in the apps.
Supporting quotations
When you view documents from your healthcare organization (such as letters or images) using our mobile apps, to make the files viewable for you temporary copies are stored on your device in app-private storage.
The temporary copies are deleted when you close your session on our mobile apps.
Qualifications & exceptions
Applies to documents the patient views from their healthcare organization.
Storage is on the patient's device, in app-private storage.
Deletion is tied to closing the session, a more specific trigger than the general 'regularly deleted' wording elsewhere in the list.
Not stated here
The passage does not say what happens if a session ends without being closed.
Photos or videos taken with the camera app for messages leave temporary copies in app-private storage
When a patient attaches a photo or video to a message to their healthcare organization, they can choose an existing one from the device or take a new one with the device's camera app. If they take a new one with the camera app, temporary copies are stored on the device in app-private storage. These temporary files are regularly deleted and are also deleted if the apps are uninstalled.
Supporting quotations
When you include a photo or video in a message you send to your healthcare organization using our mobile apps, you may select an existing photo or video from your device or take a new photo or video using the camera app on your device.
If you use the camera app on your device to take new photos or videos, temporary copies are stored on your device in app-private storage.
These temporary files are regularly deleted and are also deleted if you uninstall our mobile apps.
Qualifications & exceptions
The temporary-copy statement is written for photos and videos taken with the device's camera app; the passage does not say what is stored when an existing photo or video is selected.
Storage is on the patient's device, in app-private storage.
Not stated here
'Regularly deleted' is not tied to a stated interval.
The passage does not say how the camera app's own copies are handled.
Data Access & Collection · Company practice
Telehealth: the apps ask for video and audio access and do not record or store the visit
If a healthcare organization offers telehealth appointments through the apps, joining one makes the apps ask permission to use the device's video and audio so the appointment can happen. Epic says the apps do not record or store video or audio data from these visits, and that they do not interact with health information exchanged during telehealth appointments.
Supporting quotations
If your healthcare organization offers telehealth appointments using our mobile apps, when you join a telehealth appointment with your provider, our mobile apps will ask for permission to access your device's video and audio functionality to make the appointment possible.
Our mobile apps do not record or store video or audio data from these visits.
Our mobile apps do not interact with any health information about you exchanged during any telehealth appointments.
Qualifications & exceptions
Applies only if the patient's healthcare organization offers telehealth through the apps.
The apps ask permission before accessing the device's video and audio.
The statements about not recording, storing or interacting are about the mobile apps; the passage does not describe what the healthcare organization or provider does with the visit.
Not stated here
The passage does not say whether the healthcare organization or provider records the visit.
Data Access & Collection · User right or choice
If you enable automatic appointment arrival, upcoming appointment identifiers and times are kept temporarily in the app
If a healthcare organization offers automatic appointment arrival and the patient turns it on, the apps temporarily store identifiers and times for the patient's upcoming appointments in app-private storage so the apps can detect arrival at an appointment. The identifiers are deleted if the patient stops using the apps or turns the feature off.
Supporting quotations
If your healthcare organization offers automatic appointment arrival and you choose to enable it, our mobile apps temporarily store identifiers and times for your upcoming appointments in app-private storage to detect your arrival at an appointment.
If you stop using our mobile apps or you disable automatic appointment arrival, the identifiers are deleted.
Qualifications & exceptions
Only applies if the healthcare organization offers the feature and the patient chooses to enable it.
The patient can turn the feature off, which triggers deletion.
The deletion sentence names the identifiers; it does not separately mention the appointment times.
Not stated here
This item does not say how arrival is detected, for example whether it uses location or Bluetooth.
Whether the stored appointment times are deleted along with the identifiers is not stated.
Data Access & Collection · User right or choice
Location access is optional and used only for location-based check-in or finding nearby providers
If a healthcare organization offers location-based check-in for in-person appointments or lets patients find providers near them, the patient may choose to let the apps temporarily interact with the device's location data for those purposes. Epic says the apps do not store or use location data in any other way.
Supporting quotations
If your healthcare organization offers location-based check in for in-person appointments, or allows you to find healthcare providers near you, you may choose to allow our mobile apps to temporarily interact with your device’s location data for those purposes.
Our mobile apps do not store or use your location data in any other way.
Qualifications & exceptions
Applies only if the healthcare organization offers location-based check-in or a nearby-provider search.
Access is the patient's choice.
The purposes are limited to location-based check-in and finding providers near the patient.
Not stated here
'Temporarily' is not defined.
The sentence says the apps do not store or use location data in any other way, which does not say whether location is stored for those two purposes.
Data Access & Collection · User right or choice
Bluetooth access is optional, used to tell front desk staff you have arrived, and not stored
If a healthcare organization lets patients notify front desk staff electronically when they arrive, the patient may choose to allow the apps to interact with their Bluetooth data for that purpose. Epic says the apps do not store Bluetooth data.
Supporting quotations
If your healthcare organization allows you to notify front desk staff electronically when you arrive for an appointment, you may choose to allow our mobile apps to interact with your Bluetooth data for this purpose.
Our mobile apps do not store your Bluetooth data.
Qualifications & exceptions
Applies only if the healthcare organization offers electronic arrival notification.
Access is the patient's choice.
Purpose is limited to the arrival notification.
Not stated here
The passage does not say what the apps do with Bluetooth data other than not storing it.
Data Access & Collection · Company practice
Calling a number shown in the app asks for phone access; call history and call data are not stored
If a patient chooses to call a phone number displayed in the apps, the apps ask permission to access the device's phone to place the call. Epic says the apps do not store the patient's call history or data about the call.
Supporting quotations
While you use our mobile apps, if you choose to call a phone number displayed within the app, we will ask for permission to access your device’s phone to place a call to the phone number.
Our mobile apps do not store your call history or data about the call.
Qualifications & exceptions
Applies when the patient chooses to call a number displayed within the app.
The apps ask permission first.
Not stated here
The passage does not say what the apps do with phone access beyond placing the call.
Retention & Deletion · Company commitment
Temporary files from the interactions above are regularly deleted and removed on uninstall
Epic says any temporary files created during the interactions listed above are regularly deleted and are also deleted if the apps are uninstalled. This general rule sits alongside more specific triggers in individual items, such as deletion when a session is closed.
Supporting quotations
Any temporary files created during the interactions described above are regularly deleted, and are also deleted if you uninstall our mobile apps.
Qualifications & exceptions
Covers temporary files from the interactions described above it in the list.
The MyChart Central account information in the following item is stored on Epic-owned servers and is described separately; it is not a temporary file on the device.
Not stated here
'Regularly' is not tied to a stated interval.
Account & Service Control · Company practice
If you have a MyChart Central account, Epic stores limited account information on its US servers
For patients who have a MyChart Central account, Epic stores limited personal information on Epic-owned servers in the United States. That information includes name, date of birth, and the contact information used to create the account and link it to the patient's MyChart accounts at their healthcare organizations. Epic uses it to provide MyChart Central services, including helping the patient log in to their MyChart accounts, password recovery and user support.
Supporting quotations
If you have a MyChart Central account, we store limited personal information on Epic-owned servers in the United States.
This information includes your name, date of birth, and the contact information you used to create your account and link it with your MyChart accounts at the healthcare organizations that care for you.
This information is used to provide services or functionality for MyChart Central, including: helping you log into your MyChart accounts at your healthcare organizations, MyChart Central password recovery, and MyChart Central user support.
Qualifications & exceptions
Applies only to patients with a MyChart Central account.
Storage is on Epic-owned servers in the United States.
The information is described as limited, and as including name, date of birth and the contact information used to create and link the account.
The listed uses are introduced by 'including', so they are examples.
Not stated here
The passage does not say how long the information is kept while the account is active.
You can edit MyChart Central account information and share it with linked healthcare organizations
A patient with a MyChart Central account can edit their MyChart Central account information and share it with the healthcare organizations they have linked to that account.
Supporting quotations
You can edit and share MyChart Central account information with the healthcare organizations you have linked to your MyChart Central account.
Qualifications & exceptions
Sharing is with healthcare organizations the patient has linked to their MyChart Central account.
Not stated here
The passage does not say how editing or sharing is done.
Retention & Deletion · User right or choice
Deactivating your MyChart Central account deletes the information used to create it, on a periodic schedule
A patient who wants Epic to delete the information used to create their MyChart Central account can do so through the Account Deactivation page within MyChart Central. After the request is submitted, an automatic deletion process that runs periodically, typically once per day, deletes the account information. This deletion applies only to the information used to create the MyChart Central account. For guidance on deleting health data viewable within MyChart, the policy points to its section titled 'Your Healthcare Organizations'.
Supporting quotations
If you need to delete the information used by Epic to create your MyChart Central account, you can do so via the “Account Deactivation” page within MyChart Central.
Once you submit an account deactivation request, your account information will be deleted via an automatic deletion process that runs periodically (typically once per day).
The deletion only applies to the information used to create your MyChart Central account; for guidance on deleting health data viewable within MyChart, see "Your Healthcare Organizations" below.
Your Healthcare Organizations
Qualifications & exceptions
Deletion is requested through the Account Deactivation page within MyChart Central.
The deletion process runs periodically and 'typically' once per day, so it is not described as immediate.
The deletion applies only to the information used to create the MyChart Central account, not to health data viewable within MyChart.
Not stated here
The passage does not say whether the technical and security data described in later sections is affected by an account deactivation request.
The passage does not say whether copies in backups or logs are removed.
You need an account with a healthcare organization using Epic's software, and its privacy policy also applies
To use the mobile apps a patient must have an account with a healthcare organization that uses Epic's software. Because of that, the patient's use of the apps is also governed by each of their healthcare organizations' own privacy policies, which are separate from this Epic policy.
Supporting quotations
Your Healthcare Organizations
To use our mobile apps, you must have an account with a healthcare organization using Epic's software.
Because of this, your use of our mobile apps is also subject to each of your healthcare organizations' privacy policies.
Qualifications & exceptions
Applies to every patient who uses the apps, since an account with a healthcare organization is required.
The healthcare organizations' privacy policies apply in addition to this policy; they are not part of this document.
Not stated here
The content of each healthcare organization's privacy policy is not supplied here.
Legal Rights & Agreement Rules · Procedure
Questions about their policies, health information storage and deletion requests go to your healthcare organizations
Epic tells patients to contact their healthcare organizations for questions about those organizations' privacy policies, how they store and keep health information, and how to make requests to them about disclosing, correcting or deleting health information. This is also the guidance the MyChart Central deletion item points to for deleting health data viewable within MyChart.
Supporting quotations
Please contact your healthcare organizations if you have any questions about their privacy policies, how they store and retain your health information, and how you can make requests to them about their disclosure, correction, or deletion of your health information.
for guidance on deleting health data viewable within MyChart, see "Your Healthcare Organizations" below
Qualifications & exceptions
The requests described are made to the healthcare organizations, not to Epic.
This section is the one the MyChart Central deletion item refers to for health data viewable within MyChart.
Not stated here
The passage does not say how to contact a given healthcare organization or what each one will do with a request.
Legal Rights & Agreement Rules · Context
Android users: Epic gives extra disclosures because Google treats the apps as Health Apps
Epic says Google has decided the mobile apps are subject to Google's Health Apps requirements, and that Epic therefore must provide the following information in order to offer the apps in the Play store. The section is headed for Android users.
Supporting quotations
For Android Users – Required Google Play Disclosures for Certain Health Apps
Google has determined our mobile apps are subject to their Health Apps requirements.
As a result, we are required to provide the following information so we can make our mobile apps available to you in the Play store.
Qualifications & exceptions
The section is labeled for Android users and Google Play.
The disclosures are stated to be required for availability in the Play store.
Not stated here
The passage does not say whether the same disclosures apply on other platforms.
Data Access & Collection · Restriction or exception
Android disclosure: microphone only for voice navigation and camera roll only for a profile image
In the Android disclosures, Epic says the apps interact with the microphone only if the patient uses the microphone to navigate the apps, and interact with the camera roll only if the patient adds a profile image to a profile. These statements are narrower than the earlier list, which also describes the apps asking for the device's video and audio for telehealth and letting patients choose an existing photo or video for a message.
Supporting quotations
Our mobile apps interact with your microphone only if you use your microphone to navigate our mobile apps.
Our mobile apps interact with your camera roll only if you add a profile image to a profile in our mobile apps.
our mobile apps will ask for permission to access your device's video and audio functionality to make the appointment possible
Qualifications & exceptions
Stated in the section for Android users.
The microphone statement is conditioned on the patient using the microphone to navigate the apps.
The camera roll statement is conditioned on adding a profile image to a profile.
The earlier list also describes access to the device's video and audio for telehealth appointments and choosing existing photos or videos for messages; these two sentences do not mention those uses.
Not stated here
The policy does not explain how these two narrow statements fit with telehealth audio and video access or with attaching existing photos or videos to messages.
Cross-references
contrast (model-proposed): Telehealth: the apps ask for video and audio access and do not record or store the visit — contrast: The Android disclosure says the apps interact with the microphone only if it is used to navigate the apps, while the telehealth item says the apps ask for access to the device's video and audio for appointments. The policy does not explain how the two fit together.
contrast (model-proposed): Photos or videos taken with the camera app for messages leave temporary copies in app-private storage — contrast: The Android disclosure says the apps interact with the camera roll only when a profile image is added, while the earlier list lets patients select an existing photo or video from the device for a message. The policy does not say whether selecting an existing item for a message counts as camera roll interaction.
Data Access & Collection · Company practice
Android disclosure: access, collection, use and sharing are as stated in the earlier list, with permission
Epic says the apps access, collect, use and share a patient's information, including video, audio, images, files and phone, as described in the earlier section on the limited ways the apps interact with information. Epic also says it prominently highlights these uses, describes the type of data being accessed, and obtains the patient's permission for these purposes as the apps are used.
Supporting quotations
Our mobile apps access, collect, use, and share your information (including video, audio, images, files, phone) as stated above in the section titled, “The Limited Ways Our Mobile Apps Interact With Your Information.”
We also prominently highlight these uses, describe the type of data being accessed, and obtain your permission for these purposes as you use our mobile apps.
The Limited Ways Our Mobile Apps Interact With Your Information
Qualifications & exceptions
Points back to the earlier list for what is accessed and why; it does not add new uses.
The listed data types are introduced by 'including'.
Permission is described as obtained as the patient uses the apps.
Not stated here
The data types named here do not include location or Bluetooth data, which the earlier list also covers; the word 'including' leaves the list open.
Android disclosure: the apps only provide a technical mechanism for telehealth appointments
Where a healthcare organization allows telehealth appointments through the apps, Epic says the apps only provide the technical mechanism for the appointment and do not interact with any health information exchanged during it.
Supporting quotations
Your healthcare organization may allow you to use our mobile apps to conduct telehealth appointments with your healthcare providers.
Our mobile apps only provide a technical mechanism for those appointments to occur.
Our mobile apps do not interact with any health information about you exchanged during any telehealth appointments.
Qualifications & exceptions
Applies where the healthcare organization allows telehealth through the apps.
The statement is about what the mobile apps do, not about the healthcare organization or provider.
Not stated here
The passage does not say what the healthcare organization or provider does with the appointment.
Epic collects limited non-identifying usage and device information for customer service and to understand app use
While a patient uses the mobile apps, Epic collects a short list of information it describes as non-identifying: the time the patient began using the app, the name of the healthcare organization they interacted with, any error messages or codes, the device model and operating system, and the app version. On Android devices it also collects the connection type, cellular or Wi-Fi, during errors. Epic says it collects this so it can provide customer service to the patient or their healthcare organization and understand how people use the apps.
Supporting quotations
Limited Information Collected from You or Your Device
Non-identifying Information Collected to Provide Customer Service and Support
While you use our mobile apps, we collect the following non-identifying information so we can provide customer service to you or your healthcare organization and understand how people use our mobile apps:
the time you began using the app
the name of the healthcare organization you interacted with
any error messages or codes
the model of device you used and its operating system
the version of our mobile app used
if you use Android devices, your connection type (cellular or Wi-Fi)during any errors
Qualifications & exceptions
'Non-identifying' is Epic's own label for this list.
The connection type is collected only on Android devices and only during errors.
The purposes are customer service to the patient or the healthcare organization, and understanding how people use the apps.
Not stated here
The passage does not say how long this information is kept, or who besides Epic and the healthcare organization receives it.
The passage does not say whether this information is linked to a patient's account.
Data Access & Collection · Company practice
Epic's servers automatically record IP address, language, date and time and device type
While a patient uses the mobile apps, Epic's servers automatically collect and record the patient's IP address, which the policy says may tell Epic generally where the patient is located, along with language preference, date and time, and the type of device or system used. These items are listed under the heading about keeping data and systems secure.
Supporting quotations
Information Used to Keep Data and Systems Secure
While you use our mobile apps, our servers automatically collect and record the following information:
Internet Protocol (IP) address (which may tell us generally where you are located)
Language preference
Date and time
Type of device or system you use
Qualifications & exceptions
The collection is automatic and happens while the patient uses the apps.
The IP address is described as possibly revealing general location.
This is a separate list from the customer-service information, though 'type of device or system' overlaps in kind with the device model and operating system listed there.
Not stated here
The passage does not say how long these records are kept.
Retention & Deletion · Company practice
Epic says it has a legitimate interest in collecting and retaining the server data for security
Epic states that it has a legitimate interest in collecting, processing and retaining this server-collected data to support its information security operations, to prevent unauthorized access to or misuse of its systems and to prevent cybersecurity incidents. The sentence names security as the reason and also says the data is retained.
Supporting quotations
Epic has a legitimate interest in collecting, processing, and retaining this data in support of its information security operations to prevent unauthorized access to or misuse of our systems and to prevent cybersecurity incidents.
Qualifications & exceptions
'This data' refers to the list of automatically collected server information immediately above it.
The stated reasons are security operations and preventing unauthorized access, misuse and cybersecurity incidents.
Not stated here
No retention period is given.
Data Access & Collection · Company practice
If you contact Epic, it may keep a record of the communication; you choose what to share
If a patient contacts Epic through the methods listed on Epic's website, Epic may keep a record of the communication. The patient decides how much information to share in those cases.
Supporting quotations
Personal Information Collected From You (If You Contact Us)
we may keep a record of the communication
You can decide how much information you want to share with us in those cases
Qualifications & exceptions
Applies when the patient contacts Epic.
Keeping a record is stated as something Epic 'may' do.
How much the patient shares is the patient's choice.
Not stated here
The listed contact methods are on a linked web page that is not part of this document.
The passage does not say how long the record is kept.
Security & Safeguards · Company commitment
Where Epic collects or receives personal information, it uses technical controls and safeguards
Epic says that in the limited situations where it collects or receives a patient's personal information, for example when the patient contacts Epic for support, it uses technical controls and safeguards to protect the privacy, security, integrity and availability of that information. It also says the mobile apps use technical controls and safeguards to help keep information safe while the patient uses them.
Supporting quotations
How We Protect Your Personal Information
In the limited situations where Epic collects or receives your personal information (for example, if you contact us for support), we use technical controls and safeguards to protect the privacy, security, integrity, and availability of your personal information.
Our mobile apps also use technical controls and safeguards to help keep your information safe while you use our mobile apps.
Personal Information Collected From You (If You Contact Us)
we may keep a record of the communication
Qualifications & exceptions
Limited to situations where Epic collects or receives the patient's personal information.
The apps' own safeguards are described as helping to keep information safe, which is softer wording than a guarantee.
Not stated here
The passage does not describe the safeguards used by Epic outside the mobile apps in detail; the following lists describe some.
Security & Safeguards · Company practice
The apps use multi-factor authentication by default unless the healthcare organization changes it
The mobile apps use multi-factor authentication by default, and it is required when using the apps. The exception is that a patient's healthcare organization can make or allow changes to this control.
Supporting quotations
Safeguards and Controls Built Into Our Mobile Apps
Our mobile apps use multi-factor authentication by default.
Multi-factor authentication is required when you use our mobile apps unless your healthcare organization makes or allows changes to this control.
Qualifications & exceptions
Stated as the default and as required, but a healthcare organization may make or allow changes to this control.
Not stated here
The passage does not say what changes a healthcare organization may allow or whether patients are told when the control is changed.
Security & Safeguards · Company practice
Data stays in app-private storage other apps cannot reach; saved files go elsewhere only with your explicit permission
Epic says the mobile apps store data on the device in app-private storage that other apps cannot access. Files a patient downloads or saves from the apps may be placed in locations other apps can reach, such as the files app, but only with the patient's explicit permission. This is the storage the earlier list refers to for temporary copies of photos, videos and documents.
Supporting quotations
Our mobile apps store data on your mobile device in app-private storage that cannot be accessed by other apps.
Files you download or save from our mobile apps may be placed in locations accessible to other apps, such as your files app, only with your explicit permission.
a temporary copy of your chosen photo is stored in our mobile app via app-private storage on your device
If you use the camera app on your device to take new photos or videos, temporary copies are stored on your device in app-private storage.
Qualifications & exceptions
The inaccessibility claim is about other apps on the device and about app-private storage.
Files a patient saves or downloads can end up in locations other apps can access, only with explicit permission.
A camera app may save its own copy of a new photo outside app-private storage, as the earlier list says; that copy is outside this description.
Not stated here
The passage does not address access by the device's operating system, backups, or other people using the device.
The apps use in-app notifications and permission requests to help you decide when data is shared with other apps
Epic says the mobile apps use in-app notifications and permission requests to help patients make informed decisions about when and how their data is shared with other apps on their device.
Supporting quotations
Our mobile apps use in-app notifications and permission requests to help you make informed decisions about when and how your data is shared with other apps on your device.
Qualifications & exceptions
The sentence is about sharing with other apps on the patient's device.
Not stated here
The passage does not list which notifications or permission requests appear.
Security & Safeguards · User right or choice
Screenshots are disabled by default on Android, cannot be disabled on iOS, and Android users can enable them
On Android devices the mobile apps disable screenshots by default, and Android users can turn screenshots on if they want. Epic says it cannot disable screenshots on iOS, so the protection applies to Android only.
Supporting quotations
Our mobile apps disable screen-shot functionality by default for Android devices (we cannot disable this functionality in iOS).
Android users can enable the function if they want to.
Qualifications & exceptions
The default protection is for Android only.
Epic says it cannot disable screenshots on iOS.
Android users can enable the function.
Security & Safeguards · Company practice
The apps use https for secure communication with servers
Epic says the mobile apps use https for secure communication with servers.
Supporting quotations
Our mobile apps use https for secure communication with servers.
Qualifications & exceptions
The statement concerns the apps' communication with servers.
Not stated here
The passage does not say which servers or describe other protections for data in transit.
Security & Safeguards · Company commitment
Epic limits internal access to information you send it to staff who need it for their jobs
Epic says it maintains internal policies and processes that limit access to the information a patient sends to Epic to staff who need to know the information to do their jobs.
Supporting quotations
Additional Steps We Take At Epic
At Epic, we maintain internal policies and processes that limit access to the information you send to us to our staff who need to know the information to perform their jobs.
Qualifications & exceptions
Applies to information the patient sends to Epic.
Not stated here
The passage does not describe how the policies are enforced or audited.
Retention & Deletion · Company commitment
Epic has internal retention and deletion policies meant to keep only the information described in the policy
Epic says it maintains internal data retention and deletion policies to help it store only the information about use of the mobile apps that this policy describes. The sentence is a general commitment; it does not give retention periods, and the specific deletion timings in the policy are the ones described for individual items, such as MyChart Central account deletion.
Supporting quotations
Additional Steps We Take At Epic
At Epic, we maintain internal data retention and deletion policies to help us ensure we only store information about your use of our mobile apps as described above in this policy.
we store limited personal information on Epic-owned servers in the United States
Qualifications & exceptions
The wording is 'to help us ensure', not an absolute guarantee.
'As described above' ties the commitment to the information described in earlier sections, including the limited MyChart Central account information stored on Epic-owned servers.
Not stated here
No retention periods are given in this sentence; the internal policies themselves are not supplied.
Security & Safeguards · Context
Your healthcare organizations use their own safeguards; ask them about those
Epic says each healthcare organization a patient connects to through the apps also uses safeguards to protect the patient's information, and tells the patient to contact the organization with questions about its safeguards.
Supporting quotations
Each healthcare organization you connect to through our mobile apps also uses safeguards to protect your information.
Contact them if you have any questions about their safeguards.
Qualifications & exceptions
The safeguards described are those of the healthcare organizations, not Epic.
Not stated here
The healthcare organizations' safeguards are not described in this document.
Security & Safeguards · Procedure
Steps Epic suggests you take: protect your password, use device security tools, and do not root or jailbreak
Epic lists steps a patient can take to protect their information: do not share the username and password used with the mobile apps, change the password immediately if unauthorized access is suspected, use the security tools on devices used with the apps, and do not root or jailbreak those devices. Epic explains that rooting or jailbreaking can create security risks by removing built-in device protections and exposing sensitive information on the device.
Supporting quotations
You can take other steps to protect your information:
Do not share the username and password you use with our mobile apps.
Change your password immediately if you believe any unauthorized access has occurred.
Use the security tools on devices you use with our mobile apps.
Do not root or jailbreak devices you use with our mobile apps. Doing so can create security risks by removing your devices’ built-in security measures and exposing sensitive information on your device.
Qualifications & exceptions
These are presented as steps the patient can take, written as instructions.
The policy gives a reason only for the root and jailbreak instruction.
Not stated here
The policy does not say what follows if a patient does not follow these steps.
Linking & Identification · Restriction or exception
Epic is not responsible for external websites or third-party embedded media linked from the apps
The mobile apps contain links to external websites and may contain embedded media hosted by third parties, such as YouTube videos. Epic says it is not responsible for the content or privacy practices of external websites and encourages patients to be aware when they leave the apps or engage with third-party media, and to read the privacy statements of any external website that collects their information.
Supporting quotations
Links to External Websites
Our mobile apps contain links to external websites and may contain embedded media hosted by third parties, such as YouTube videos.
Epic is not responsible for the content or privacy practices of external websites.
We encourage you to be aware when you leave our mobile apps or engage with media hosted by third parties and to read the privacy statements of any external website that collects your information.
Qualifications & exceptions
The responsibility disclaimer is stated for external websites' content and privacy practices.
Embedded third-party media, such as YouTube videos, is named as an example.
Epic encourages the patient to read the external website's privacy statement.
Not stated here
The passage does not say what third parties collect when a patient engages with embedded media.
Legal Rights & Agreement Rules · Procedure
GDPR questions: contact Epic's DPO or EU Representative; data subject requests go to your healthcare organization
For people covered by the GDPR, Epic gives an email address and phone number for its Data Protection Officer or EU Representative. It also says that a person who is a Data Subject as defined by the GDPR should reach out to their healthcare organization for requests related to their personal data accessed through the mobile apps.
Supporting quotations
Your Privacy Rights
GDPR and UK GDPR Privacy Questions
If you need to contact our Data Protection Officer or EU Representative, please email EUPrivacyInquiries@epic.com or call +1 608-271-9000.
If you are a Data Subject as defined by GDPR, you should reach out to your healthcare organization for requests related to your personal data accessed through our mobile apps.
Qualifications & exceptions
Requests about personal data accessed through the apps are directed to the healthcare organization, not to Epic.
The heading mentions the UK GDPR as well, but the sentences under it refer to the GDPR and an EU Representative only.
Not stated here
The passage does not say how requests about information Epic itself holds, such as MyChart Central account information, server records or support communications, are handled.
The policy does not describe the rights a Data Subject has.
Legal Rights & Agreement Rules · Context
California privacy questions are directed to a separate Privacy Notice for California Residents
Under the heading for California privacy questions, the policy only points the reader to Epic's separate Privacy Notice for California Residents. This policy itself gives no California-specific rights or statements.
Supporting quotations
California Privacy Questions
Please visit our Privacy Notice for California Residents
Qualifications & exceptions
The policy refers to a separate notice and does not set out its content.
Not stated here
The Privacy Notice for California Residents is a separate document that is not supplied here, so its content is not analyzed.
Legal Rights & Agreement Rules · Procedure
Medical-record questions go to your healthcare organization; policy questions go to Epic by phone or email
Epic says that questions about medical information in an account with a healthcare organization should go to that organization, using the contact details in its privacy policy. Questions about this policy go to Epic at +1 608-271-9000 or PrivacyInquiries@epic.com.
Supporting quotations
Contact Epic
If you have questions about your medical information in an account with a healthcare organization using Epic’s software, please reach out to your healthcare organization using the contact information in their privacy policy.
If you have any questions about this policy, contact us at +1 608-271-9000 or at PrivacyInquiries@epic.com.
Qualifications & exceptions
Two different contacts: the healthcare organization for medical information, Epic for questions about this policy.
Legal Rights & Agreement Rules · Context
The changelog lists one update, August 12, 2025: clarified governing terms and MyChart Central information added
The policy's changelog lists an August 12, 2025 update. In the section titled 'This Privacy Policy', it added clarification that use of Epic's mobile applications is governed by this privacy policy, the Mobile Application End User License Agreement and relevant terms of use from the patient's healthcare provider. In the section on the limited ways the apps interact with information, it added information specific to MyChart Central users.
Supporting quotations
Changelog
August 12, 2025 Update:
In the section titled “This Privacy Policy”
Added clarification that use of Epic Mobile Applications is governed by this privacy policy, the Mobile Application End User License Agreement (EULA), and relevant terms of use from your healthcare provider
In the section titled “The Limited Ways Our Mobile Apps Interact With Your Information”
Added information specific to MyChart Central users
Qualifications & exceptions
Only one dated update is shown in the saved text.
Not stated here
The saved text does not show earlier changes.
Cross-references
related (model-proposed): Using the apps is treated as agreeing to the EULA or provider terms and consenting to the policy — references: The changelog says the August 12, 2025 update added clarification that use of the apps is governed by the policy, the Mobile Application EULA and the healthcare provider's terms of use, which matches the sentence in 'This Privacy Policy' about agreeing to those terms.
Security & Safeguards · Context
The saved text ends with a security vulnerability reporting heading and no instructions
The saved policy ends with headings 'Security' and 'Report a Potential Security Vulnerability or Concern'. No text, contact method or process appears under them in the saved copy, so it does not say how to report a vulnerability.
Supporting quotations
Security
Report a Potential Security Vulnerability or Concern
Qualifications & exceptions
Only headings are present in the saved text.
Not stated here
How to report a potential security vulnerability or concern is not shown in the saved text.