Patient medical records include patient health information known as Protected Health Information (“PHI”), which is regulated under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). PHI includes certain information that is (a) created or received by a health care provider and relates to an individual’s past, present, or future physical or mental health or condition, health care provided to an individual, or the past, present, or future payment for health care provided to an individual; and (b) that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual.  Please review our Notice of Privacy Practices (HIPAA) for information on how we may use and disclose your PHI. When we use the term “Personal Data” we mean information that we directly associate with a specific person, or that we can reasonably use to identify a specific person such as a name or email address.  Any Personal Data we collect through MSK MyChart that is also PHI will be handled as further described in our Notice of Privacy Practices (HIPAA). We collect and use Personal Data and PHI through your use of MSK MyChart in the following ways: 1. Personal Data You Provide to Us We collect Personal Data when you choose to share that information with us, including in the following ways. All MSK MyChart Users: When you set up an MSK MyChart account, you will be asked to submit Personal Data which could include your name, mailing address, email address, phone number, date of birth, legal sex, and social security number.  We use this information to set up and administer your MSK MyChart account. We may collect information and use it to manage how we communicate with you. For example, we may use your email address to alert you that you have a message waiting in MSK MyChart. Patient Users: If you are a registered MSK or MMC patient (“Patient”) setting up your MSK MyChart account, you may also be asked to provide other Personal Data such as your enrollment ID number, medical record number, and emergency contact information. Patients may choose to invite other people to access their MSK MyChart account.  This is called a “Proxy account”.  As a Patient, if you invite someone to set up a Proxy account, you can decide to give the Proxy user full access to your MSK MyChart, or you can limit their access to either clinical access only or scheduling/messaging access only. You can learn more about these access options in MSK MyChart. You can change your mind at any time. When you invite a user to create a Proxy account, you may be asked to provide other Personal Data such as the Proxy account user’s name and email address. Proxy Account Users: If you are registering for a Proxy account, when you set up an MSK MyChart account, you will be asked to provide Personal Data about yourself, including your name, mailing address, email address, phone number, date of birth, legal sex, and social security number. You may also be asked to provide other Personal Data such as the Patient’s name, date of birth, legal sex, Patient’s relationship to you. If you were not invited by a Patient to create a Proxy account, you may request a Proxy account subject to the consent or approval of the Patient or MSK, as required by law.        Patient and Proxy Account Users When a Patient or Proxy account user sends a message to the Patient’s health care providers or other MSK staff through MSK MyChart, we collect the content of the message and the metadata associated with the message. We use this information to respond to your messages and to manage the Patient’s care. When a Patient or Proxy account user books appointments for the Patient through MSK MyChart, we collect information about the Patient’s contact information, health care professional and appointment confirmation, which we use to facilitate scheduling the appointment and to send appointment reminders. When a Patient or Proxy account user orders prescription refills through MSK MyChart we collect information about the Patient’s medication, contact information and preferred pharmacy, which we use to facilitate the prescription renewal request. When a Patient or Proxy account user pays medical bills through MSK MyChart we will collect payment card information, billing information, and contact information, which we use to fulfill your payment, complete your transaction and deliver an invoice to you. Patients admitted to MSK for inpatient care and their authorized Proxy account users may be granted access to MSK MyChart Bedside, a specialized portal with additional features and functions related to an in-patient stay, such as real-time access to information on the Patient’s lab test results, medications, and treatment plans.  MSK MyChart Bedside users may also order meals, play games, or send messages to the Patient’s healthcare providers while they are in the hospital. When a Patient or Proxy account user uses MSK MyChart Bedside, we collect information about the Patient’s health, dietary preferences, medications, test results, and the content of any messages users send to the Patient’s health care providers and any metadata associated with the messages.   We use this information to provide you the services available through MSK MyChart Bedside, to respond to your messages and to manage the Patient’s care. Users Accessing MSK MyChart to Sign into Other Applications: MSK allows users to access certain other applications outside of MSK MyChart (“Other Applications”), which may be owned by MSK or a third party.  MSK uses MSK MyChart to verify your identity and connect you to those Other Applications. For example, you may be asked to use MSK MyChart to verify your identity if you use an Other Application as part of an MSK research study or use the MSK Remote Monitoring Application to connect to a wearable device such as a fitness tracker or heart rate monitor. If you use MSK MyChart to register for or access an Other Application, MSK will use the information you provide to create your MSK MyChart account, such as your name, mailing address, email address, phone number, date of birth, legal sex, and social security number, to verify your identity and connect you to the Other Application. Some Other Applications may be governed by their own terms and conditions and may collect and use Personal Data differently from MSK MyChart.  You may be required to accept or acknowledge the Other Application’s terms of use and privacy policy.      2. Information We Collect Automatically We use certain technologies on MSK MyChart to automatically collect information during your use of MSK MyChart (“Other Information”).  If we associate Other Information with Personal Data, we will treat the combined information as Personal Data in accordance with this Privacy Policy. The technologies we use to collect Personal Data and other information include the following: Web Log File Data.  Like most other websites or mobile applications, we collect some basic information automatically about you and store it in log files.  This information may include IP address, browser type, internet service provider, pages you visit from and pages you go to after leaving MSK MyChart, pages you visit on MSK MyChart, date and time stamp, and clickstream data.  We use this information for MSK MyChart management and administration, to improve the content, overall performance and user experience on MSK MyChart, for fraud protection and for protecting our rights. Data from Cookies and Other Data Collection Technologies.  We and our service providers use cookies, web beacons and similar technologies to manage MSK MyChart and to collect information about you when you use MSK MyChart.  These technologies help us to recognize you, analyze your use of MSK MyChart and identify solutions for how to make MSK MyChart more useful.  These technologies also allow us to enhance the usability of MSK MyChart by aggregating demographic and statistical data and providing this information to our service providers. Information for Analytics.   We use analytics providers to help us track certain information about your activity in MSK MyChart, and to evaluate and measure the use and performance of MSK MyChart.  We may combine this information with other information we have about you to help us improve MSK MyChart and our service to you.  Please see more information on analytics and data collection technologies and the choices you can make in the “Your Choices” section of this Privacy Policy. 3. Additional Uses of Personal Data In addition to the uses described above, we may, consistent with our other legal obligations, use your Personal Data for the following purposes: Maintaining, delivering and improving MSK MyChart and our services; Contacting you to respond to your requests or inquiries and provide support; Send you technical notices, updates, security alerts and support and administrative messages; Contacting you about programs, products, or services that we believe may be of interest to you, new service announcements, or event invitations; Developing new resources and services; Conducting, managing and growing our business operations; Analyzing Patient experience as well as provider and hospital performance; Preventing, investigating and providing notice of fraud, unlawful or criminal activity or unauthorized access to or use of Personal Data, MSK MyChart or our data systems, or to meet legal obligations; Investigating and resolving disputes and security issues and enforcing our MSK MyChart Terms and Conditions; and Carrying out any other purpose for which the information was collected. We also may use aggregated or de-identified information, which cannot reasonably be used to identify you. Once de-identified and aggregated so that data does not personally identify you (for example, we may aggregate data in order to improve our automation and improve care), it is no longer Personal Data. Such de-identified or aggregated information which does not identify individuals is not subject to this Privacy Policy.