Your health information and choices
Privacy Notice
This Privacy Notice explains how Atrius-Health-EPIC-FHIR handles information when you use this MyChart connection service. It applies to this connector, not to Epic, MyChart, or your healthcare organization, which have their own privacy practices. This is not your healthcare organization’s HIPAA Notice of Privacy Practices.
1. Information the service handles
Connection and authorization information
When you connect, the service handles a random browser-session identifier, OAuth authorization state, PKCE verifier, OpenID nonce, provider and FHIR endpoint details, granted scopes, token and session expiration times, your Epic patient identifier, an optional FHIR user identifier, and OAuth access or refresh tokens.
Health information you request
The service can retrieve your Patient resource and the resource types enabled by the operator: AllergyIntolerance, Binary, CarePlan, CareTeam, Condition, Device, DiagnosticReport, DocumentReference, Encounter, Goal, Immunization, Location, Medication, MedicationRequest, Observation, Organization, Practitioner, PractitionerRole, Procedure, Provenance, RelatedPerson. The exact information available depends on your healthcare organization, the application registration, and the permissions you approve.
Optional private health hub
The private health hub is not enabled in this deployment, so health resources are not added to a persistent hub.
Information the service does not request
Your MyChart username and password go directly to your healthcare organization and do not pass through this application. The application does not request your device address book, device geolocation, advertising identifiers, or payment-card information, and its code does not include advertising or behavioral-analytics trackers. Provider-supplied health records—especially the Patient resource—may themselves include postal address, telephone, email, or other contact details.
Technical information
The configured infrastructure provider, cloudflare, and network providers may process information such as IP address, request timing, security events, and basic device or browser metadata to deliver and protect the service. Application responses direct browsers not to cache health information. The application records sanitized authorization, consent, access-category, disconnection, rate-limit, and failure events for security and compliance; those events exclude callback query strings, FHIR identifiers, access credentials, and health-record contents. Infrastructure processing remains subject to the provider’s configuration and contract.
2. How information is used
Information is used only to initiate and validate authorization, maintain your connection, request the health information you select, return it to your browser, operate an optional hub you enable, create deterministic local source-linked fact projections and summaries, refresh or revoke authorization when supported, protect the service, troubleshoot failures, and comply with applicable law. Hub summaries and insights support organization and review; they are not a substitute for the source record or professional medical advice.
3. When information is disclosed
The service sends authorization and FHIR requests to Epic systems operated for your healthcare organization. cloudflare processes requests and, when persistent hosting is enabled, stores the connector’s encrypted connection records as the configured infrastructure provider. Other network providers may transmit information, subject to the operator’s arrangements with those providers. We may disclose information when required by law or when reasonably necessary to protect users, the service, or others.
The application does not sell health information, use it for targeted advertising, or disclose it to data brokers.
4. Storage and retention
- Pending OAuth state, including the PKCE verifier and nonce, is held in process memory or encrypted hosted storage depending on the deployment and normally expires after 10 minutes.
- The signed browser-session cookie is set for up to 8 hours. Connection records, patient identifiers, and OAuth tokens remain in memory by default. Cloudflare Durable Object and local encrypted-file modes encrypt records before persistent storage. Records become unusable after 30 minutes of inactivity or after 8 hours total, unless disconnected sooner, and are removed on use or scheduled cleanup shortly afterward.
- FHIR resources returned by your healthcare organization are transmitted to your browser and are not added to a persistent private health hub in this deployment.
- A local-development deployment may instead use memory-only storage or an operator-managed encrypted file, as described by that deployment’s configuration.
Deletion from active application storage may not immediately remove copies retained temporarily for infrastructure recovery, security, or legal obligations.
5. Security
Production hosting must use HTTPS. The connector uses signed HTTP-only cookies, OAuth state and nonce validation, PKCE, restricted FHIR resource types, no-store browser headers, and encryption whenever the included persistent-storage modes are enabled. Possession of the valid browser session is what lets the application retrieve its connected record, so protect the device and use Disconnect before sharing or disposing of it. No internet service can guarantee absolute security. Security incidents may trigger notification duties under applicable law.
6. Your choices
- Do not select “Connect MyChart” if you do not want the service to request access.
- Review and adjust the information and duration offered on your healthcare organization’s authorization screen when those controls are available.
- Use “Disconnect” in the application to remove the local connection and attempt remote revocation.
- Disconnecting MyChart does not delete an optional private health hub. Use “Permanently delete my hub” while connected to remove its active retained resources, versions, summaries, insights, and consent profile.
- Use Disconnect before clearing browser cookies. Clearing cookies alone does not revoke MyChart access or immediately remove the stored connection; an inaccessible record can remain until scheduled expiry cleanup.
- Use MyChart’s linked apps or devices settings to review or remove the grant directly.
- Contact your healthcare organization to access or correct information in its medical record.
7. Children and authorized representatives
The service is intended for people legally able to authorize access to the connected record, including a parent, guardian, or other authorized representative when permitted by the healthcare organization and applicable law. It is not directed to children who cannot provide that authorization on their own.
8. Changes and contact
We may update this notice as the service or legal requirements change. The effective date above identifies the current version. Privacy questions or requests can be sent to admin@moonba.ai. We may need to verify a request before acting on it.