MyChart is the patient-portal mobile app operated by Epic Systems Corporation, a private, employee-owned software vendor (Verona, WI) whose electronic health record platform powers thousands of health systems; each health system's MyChart instance is technically a separate deployment governed by that organization's own privacy notice, but the app itself is published and privacy-governed by Epic. Epic's Mobile Application Privacy Policy for Patients states Epic does not sell or license user information and does not store copies of health or fitness data transmitted to healthcare organizations, while still collecting device/IP/connection telemetry for security and support and, for MyChart Central users, limited account PII (name, DOB, contact info) on Epic-owned US servers. Apple's App Store privacy label self-declares a broader footprint at the app level - Health & Fitness, Financial/Payment Info, Contact Info, and Sensitive Info linked to identity, plus first-party Analytics (Usage Data for Product Interaction/Personalization) - but, unlike some peers, declares no 'Data Used to Track You' cross-app tracking category. Epic describes itself as employee-owned, developer-led, and built through organic growth with no acquisitions. No FTC or HHS OCR enforcement action against Epic Systems itself was found in this review (an FTC antitrust inquiry into Epic was reported in the press in August 2026 but has no confirmed regulator case page, and MyChart-pixel litigation found in search results targets individual health systems, not Epic, and lacks a primary judgment/settlement source), so track record is scored on Epic's self-described security posture (default multi-factor authentication) rather than any incident.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
7 ON FILE
COLLECTION
Apple's App Store privacy label for MyChart declares that data linked to a user's identity may include Health & Fitness, Financial Info, Payment Info, Contact Info (physical address, email, name, phone), User Content (photos, videos, audio), Identifiers (User ID, Device ID), and Sensitive Info - a broader identity-linked footprint than the app-operator's own policy alone would suggest, reflecting variation across the thousands of health-system MyChart deployments.
Epic's Mobile Application Privacy Policy for Patients states that Epic's servers automatically collect IP address, language preference, date/time, and device/system type for information-security purposes, and that for users with a MyChart Central account, Epic separately stores limited personal information - name, date of birth, and account contact information - on Epic-owned servers in the United States, deletable via an account-deactivation flow.
Epic Systems Corporation's own About page describes the company as privately held and grown organically: 'We are a software factory (no acquisitions)' and 'Employee-owned and developer-led,' with 35% of operating expenses stated to be invested in R&D - a self-description of ownership structure rather than an independently verifiable registry filing, since Epic does not publish investor filings.
Epic's Mobile Application Privacy Policy states as a top-line commitment that Epic does not sell or license user information and does not receive or store copies of any health or fitness data that patients transmit to their healthcare organizations through the mobile apps - meaning Epic structurally holds very little clinical data to share in the first place.
Epic's mobile privacy policy states its mobile apps use multi-factor authentication by default, required for all users unless a healthcare organization changes the setting - a self-reported baseline security control, not an independent audit or transparency report; no finalized FTC or HHS OCR enforcement action against Epic Systems Corporation itself was located via direct regulator-site checks during this review.
Apple's App Store privacy label for MyChart, self-declared by developer Epic, lists Analytics (Usage Data used for Product Interaction and Product Personalization) among the data categories linked to identity, alongside Diagnostics data collected but not linked to identity - conventional first-party product analytics rather than third-party ad-tech SDKs.
Epic's mobile privacy policy warns that its mobile apps 'contain links to external websites and may contain embedded media hosted by third parties, such as YouTube videos,' and disclaims responsibility for those third parties' privacy practices - a bounded, user-initiated third-party surface rather than background cross-app tracking.