Privacy Policy

Effective Date: June 15, 2026

1. Introduction

Mickey Health ("we," "our," or "the App") is committed to protecting your privacy. This Privacy Policy explains what health information we may access, how we use it, and your rights regarding your data.

2. What Data the App May Access

Mickey Health may access the following types of health information from your Epic MyChart account, depending on what you authorize and what your health system makes available through its FHIR API:

  • Demographics (name, date of birth, contact information)
  • Lab results and test values
  • Vital signs (blood pressure, heart rate, temperature, weight, etc.)
  • Medications and prescriptions
  • Allergies and adverse reactions
  • Medical conditions and diagnoses
  • Encounters and visit records
  • Procedures and treatments
  • Immunizations and vaccination records
  • Care plans and treatment plans
  • Goals and health objectives
  • Diagnostic reports and imaging results
  • Clinical documents and notes

3. How Data Is Accessed

Mickey Health accesses your health information only after you explicitly authorize it through the Epic MyChart SMART on FHIR OAuth process. Here's how it works:

  1. You select your health system in Mickey Health
  2. You are redirected to your MyChart login page
  3. You log in with your MyChart credentials (we never see your password)
  4. You review and approve the data access request
  5. Epic sends Mickey Health an authorization code
  6. Mickey Health exchanges this code for access tokens
  7. Mickey Health uses these tokens to retrieve your authorized health data

Important: Mickey Health does not ask for or store your MyChart username or password. Authentication is handled entirely by Epic/MyChart.

4. Persistent Access and Refresh Tokens

When you authorize Mickey Health, you may choose to grant persistent access, which allows the App to continue accessing your health information even when you're not actively using it. This is accomplished through "refresh tokens."

What are refresh tokens? Refresh tokens are secure credentials that allow Mickey Health to request updated health information from your Epic MyChart account without requiring you to log in again each time.

Rolling refresh tokens: Epic uses "rolling" refresh tokens, which means that each time Mickey Health uses a refresh token to get updated data, Epic issues a new refresh token and invalidates the old one. This enhances security by ensuring tokens are regularly rotated.

You can revoke persistent access at any time through Mickey Health or your MyChart account settings.

5. How We Use Your Data

Mickey Health uses your authorized health information solely to provide and improve the App's functionality. Specifically, we use your data to:

  • Display your health information in an organized, easy-to-understand format
  • Organize and categorize your health records
  • Track trends in your vital signs and lab results over time
  • Generate summaries of your health data
  • Notify you of updates to your health records (if you enable notifications)
  • Improve the App's features and user experience

We do not use your health information for advertising, marketing, or any other purpose unrelated to the App's core functionality.

6. Data Storage and Security

We take the security of your health information seriously. Mickey Health implements industry-standard security measures to protect your data:

  • Encrypted transport: All data transmitted between your device, Mickey Health servers, and Epic systems is encrypted using HTTPS/TLS
  • Server-side storage: Your health data is stored on secure servers with encryption at rest
  • Restricted access: Access to your data is limited to authorized personnel and systems necessary to operate the App
  • Regular security reviews: We regularly review and update our security practices

7. Data Sharing

Mickey Health does not sell your health information. We do not share your data with advertisers or third parties for marketing purposes.

We may share your information only in the following limited circumstances:

  • With your explicit consent: If you direct us to share specific information
  • Service providers: With trusted service providers who help us operate the App (such as hosting providers), under strict confidentiality agreements
  • Legal requirements: When required by law, such as in response to a valid court order or subpoena
  • Safety: To protect the safety and rights of Mickey Health, our users, or the public

8. Your Rights and Controls

You have the following rights regarding your data:

  • Disconnect your account: You may disconnect your MyChart account from Mickey Health at any time through the App settings
  • Revoke access: You may revoke Mickey Health's access to your health records through your MyChart account's connected applications settings
  • Request deletion: You may request that we delete your health data from our servers by contacting us at privacy@mickeyhealth.com
  • Access your data: You may request a copy of the data we have stored about you

9. Data Retention

We retain your health information for as long as your Mickey Health account remains active and connected to your MyChart account. If you disconnect your account or request deletion, we will delete your health data within 30 days, except where we are required to retain certain information for legal or regulatory purposes.

10. Children and Authorized Representatives

Mickey Health may be used to access health records of children or other individuals for whom you are a legally authorized representative (such as a parent, guardian, or healthcare proxy). You may only connect and view records that you are legally authorized to access. Unauthorized access to another person's health information may violate privacy laws.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the Effective Date at the top of this page and, where appropriate, by sending you a notification. Your continued use of Mickey Health after such changes constitutes your acceptance of the updated Privacy Policy.

12. Contact Information

If you have questions about this Privacy Policy or how we handle your data, please contact us at:

privacy@mickeyhealth.com