Digital Privacy Policy

Northwestern Medicine Digital Privacy Policy

Effective Date: October 9, 2026

Northwestern Memorial HealthCare respects your right to privacy. As used here, “Northwestern Medicine”, “we”, “us” or “our” means Northwestern Memorial HealthCare and, where appropriate, its corporate affiliates, including but not limited to Northwestern Memorial Hospital, Northwestern Medicine Catherine Gratz Griffin Lake Forest Hospital, Northwestern Medical Faculty Foundation (d/b/a Northwestern Medical Group), Northwestern Memorial Foundation, Northwestern Medicine Central DuPage Hospital, Northwestern Medicine Delnor Hospital, Central DuPage Physician Group (d/b/a Northwestern Medicine Regional Medical Group), Northwestern Medicine Kishwaukee Hospital, Northwestern Medicine Valley West Hospital, Marianjoy Rehabilitation Hospital, Rehabilitation Medicine Clinic, Inc. (d/b/a Marianjoy Medical Group), Northwestern Medicine Huntley Hospital, Northwestern Medicine McHenry Hospital, Northwestern Medicine Woodstock Hospital, Centegra Physician Care, Palos Community Hospital, Palos Health Surgery Center, LLC, Palos Imaging LLC, Palos Medical Group LLC and South Campus Partners, Inc.

This Privacy Policy describes how we collect, use, and disclose information about you. This Privacy Policy applies to information we collect about you when you access or use our website located at www.nm.org (the “Website”), the MyNM mobile applications (the “Apps”), and other online products and services that link to this Privacy Policy, as well as information we collect when you otherwise interact with us, such as when you sign up for a newsletter, pay a bill, contact support, or make a donation (“Operations”). When we refer to the Website, Apps, and Operations together, we will call them the “Services.” This Privacy Policy does not apply to: (i) information about our employees, (ii) our medical and healthcare services; or (iii) any other data gathered or used by Northwestern Medicine, including through websites not controlled or operated by Northwestern Medicine.

This Privacy Policy does not apply to information that would be considered “Protected Health Information” or “PHI” under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Please refer to our Notice of Privacy Practices, which explains how we use and disclose our patients’ PHI pursuant to, as well as our patient’s privacy rights under, HIPAA. If you have any questions about our Privacy Policy, please contact us at compliance@nm.org.

Northwestern Medicine reserves the right to change this policy from time to time, so please check back periodically. If we make changes, we will notify you by revising the date at the top of this policy. If we make material changes, we may provide you with additional notice. We encourage you to review this Privacy Policy regularly to stay informed about our information practices and the choices available to you. We may provide different or additional notices of our privacy practices for certain offerings, in which case those notices will supplement or replace the disclosures in this Privacy Policy.

Please use the links below to jump to the sections of our Privacy Policy to learn more:

What Information Does Northwestern Medicine Collect?

Information You Provide to Us

We collect information you provide directly to us. For example, we collect information when you: create an account or profile, use the interactive areas and features of the Services, subscribe to a newsletter or email list, participate in a survey or events, pay a bill, make a donation, apply for a job, request customer or technical support, engage in online “chats” with live individuals or artificial intelligence, or otherwise communicate with us.

The types of information we may collect from you include:

(a) Account Information, such as your name, email address, password, postal address, phone number, date of birth and any other information you choose to provide.

(b) Transaction Information, such as your health insurance information and limited payment information from you, such as payment method and payment card information; however, we do not collect or store full payment card numbers and all transactions are processed by our third-party payment processor.

(c) Chat Content, such as conversations and related content that you choose to submit through our Apps. If you contact us through our chat features (including a chatbot) or by phone, we may monitor and retain those conversations, including for quality assurance and training purposes.

(d) Information about Others, such as the names and the contact information of your providers, your proxies, and any dependents under your care.

(e) Educational and Professional Background, such as your employment history, cv, and academic history, when you apply for a job, research grant, or fellowship.

(f) Health Information, such as your past and present medical condition, medication information, and treatment history. For example, our Apps may collect COVID vaccination status, COVID test results and associated encounter information from you or your providers affiliated with Northwestern Medicine. The App may also provide functionality for you to upload a copy of your COVID vaccination card. Our limited use of COVID-related information and other health information is in accordance with our Notice of Privacy Practices.

(g) Other Information You Choose to Provide, such as when you participate in a survey, assessment, contest, promotion, or interactive area of the Services or when you request technical or customer support.

Information We Collect Automatically When You Use the Services

When you access or use the Services, the types of information we may automatically collect about you include:

(a) Log Information: When you visit the Services, our servers automatically record certain log file information, such as your Internet Protocol (“IP”) address, operating system, browser type and language, referring URLs, access times, pages viewed, links clicked and other information about your activities on the Services.

(b) Mobile Device Information: We collect information about the mobile device you use to access or use the Services, including the hardware model, operating system and version, unique device identifiers, mobile network information, and information about your use of our Apps. With your consent, we may also collect information about the precise location of your device and access and collect information from certain native applications on your device (such as your device’s camera, photo album, microphone, storage, and phonebook applications) to facilitate your use of certain features of the Services. For more information about how you can control the collection of location information and/or our access to other applications on your device, please see “Your Choices” below.

(c) Information Collected by Cookies and Other Tracking Technologies: We and our service providers use various tracking technologies, including cookies and web beacons, to collect information about you when you interact with our Services. Cookies are small data files stored on your hard drive or in device memory that help us improve the Services and your experience, see which areas and features of the Services are popular, and count visits. Web beacons are electronic images that may be used in the Services or emails and help deliver cookies, count visits, and understand usage and campaign effectiveness. For more information about cookies, and how to disable them, please see “Your Choices” below.

(d) Analytics Services Provided by Others: We may allow others to provide analytics services on our behalf. These entities may use cookies, web beacons, and other technologies to collect information about your use of the Services and other websites, including your IP address, web browser, pages viewed, time spent on pages, links clicked and conversion information. For example, we use analytics partners (such as Google Analytics) to help us analyze and track data, determine the popularity of certain content, deliver advertising and content targeted to your interests on the Services and other websites and better understand your online activity. For more information about how you may control the collection and/or use of information for analytics purposes, please see our separate Cookies Policy to learn about how we use cookies on the Site and your choices in relation to the use of cookies.

Information Collected from Other Sources

We may also obtain information about you from other sources. For example, if you have an existing medical record at another organization outside of Northwestern Medicine, you may be able to see your test results, along with other functionality, from within our Apps. Additionally, you may be able to view your COVID-related information and test results from your outside organization, or from state registries, within our Apps. Once we combine information from other sources with your information collected pursuant to this Privacy Policy, we apply this Privacy Policy to the combined information as long as it is combined.

How Does Northwestern Medicine Use Information?

Northwestern Medicine uses the information about you for various purposes, including to:

  • Provide, maintain, and improve our Services and provide you with relevant information;
  • Send you technical notices, updates, security alerts and support and administrative messages;
  • Respond to your comments, questions and requests and provide customer service;
  • Communicate with you about products and services offered by us and others, and to provide news and information we think will be of interest to you;
  • Plan, administer and coordinate events, community groups, and outreach activities;
  • Process financial assistance applications and donations;
  • Monitor and analyze trends, usage, and activities in connection with our Services;
  • Improve our products and services, develop new products and services, and generate aggregated or de-identified information, which cannot reasonably be used to identify you;
  • Detect, investigate, and prevent fraudulent transactions and other illegal activities and protect the rights and property of Northwestern Medicine and others;
  • Maintain appropriate records for internal administrative purposes;
  • Process applications for employment, fellowships, and grants;
  • Comply with our financial and legal obligations; and
  • Carry out any other purpose described to you at the time the information was collected.

Northwestern Medicine and approved contractors providing services on behalf of Northwestern Medicine may use artificial intelligence to help provide our Services, and your personal information collected through the Services may be used to develop, improve, or customize AI tools used by Northwestern Medicine or our approved contractors (solely on behalf of Northwestern Medicine) in accordance with HIPAA and other applicable legal requirements. Please note, our use of your PHI is explained in the Notice of Privacy Practices.

If you use the MyNM App, the MyNM App may interact with sensitive data which includes your PHI (if you are a Northwestern patient), so that you will have the opportunity to use certain features of the MyNM App, such as video visits or mobile appointment check-in. The first time you attempt to use one of these features, MyNM App will request your consent within the MyNM App and will permit the interaction only if you provide consent. You are not required to provide consent if you do not want the MyNM App to interact with your data as requested.

The MyNM App may also offer location-based check-in for in-person appointments or permit you to locate nearby healthcare providers. The first time you attempt to use a feature that uses your location, the MyNM App will request your consent within the MyNM App and will access your location only if you provide consent. You are not required to permit the MyNM App to use your location. Northwestern Medicine does not store the location data used for these features.

The MyNM App is developed by Epic Systems Corporation. For additional information regarding the limited ways Epic may interact with information to make your use of MyNM App possible, please review Epic’s Mobile Application Privacy Policy for Patients.

If you are a Northwestern patient, the MyNM App will use your cell phone number to send an SMS text message for you to confirm your phone number unless you have opted out of such communication.

How Does Northwestern Medicine Disclose Information?

We may disclose information about you as follows, or as otherwise described in this Privacy Policy:

  • With vendors, consultants, and other service providers who need access to such information to carry out work or perform services on our behalf;
  • With certain integration partners, if you choose to use integrations we offer on our Services, such as sharing your location through our Google Maps integration, we provide certain information to the integration partners;
  • In response to requests from local, state, provincial or federal law enforcement officials, any judicial, administrative, or similar proceeding or order, such as a subpoena if we believe disclosure is in accordance with, or required by any applicable law;
  • If we believe your actions are inconsistent with our user agreements or policies, or to protect the rights, property and safety of Northwestern Medicine and others;
  • To investigate suspected fraud, harassment, physical threats, or other violations of any law, rule or regulation, the Services’ rules or policies, or the rights of third parties or to investigate any suspected conduct which we deem improper;
  • With our legal, financial, insurance, and other professional advisors where necessary to obtain advice or otherwise protect and manage our business interests;
  • In connection with, or during negotiations of, any merger, sale of company assets, financing or acquisition of all or a portion of our business by another company;
  • Between and among Northwestern Medicine and our current and future parents, affiliates, subsidiaries, and other companies under common control and ownership;
  • For recruitment in research studies. If you prefer not to be contacted by letter, phone, or email by a researcher not involved in your clinical care, you can contact Northwestern Medicine to be removed from the contact registry at 630-933-6528;
  • With your consent or at your direction;
  • To comply with transparency or other public reporting obligations; and
  • As otherwise permitted or required by law.

Additionally, we may disclose COVID test result information with state registries when required, as well as with other outside organizations for whom you have linked your MyNM account or have otherwise given permission to disclose your data. For more information about how we disclose your PHI, please review our Notice of Privacy Practices.

We may also disclose aggregated or de-identified information, which cannot reasonably be used to identify you.

We are based in the United States and the information we collect is governed by U.S. law. By accessing or using the Services or otherwise providing information to us, you consent to the processing and transfer of information in and to the U.S. and other countries, where you may not have the same rights as you do under local law. Where this is the case, we will take appropriate measures to protect information about you in accordance with this Privacy Policy.

Children's Privacy

Northwestern Medicine is committed to protecting the privacy of children. You should be aware that this Websites and Apps are not intended or designed to attract children. In addition, we do not collect personal information from any person known by Northwestern Medicine to be a child under the age of 13.

Security

We seek to use reasonable physical, technical, and administrative measures designed to protect personal information within our organization. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of your account has been compromised), please immediately notify us in accordance with the “Contacting Us” section below.

Region-Specific Disclosures

Additional Information for Individuals in the United Kingdom (“UK”) and European Economic Area (“EEA”)

In addition to the aforementioned information, the following information applies to any individual located in the UK or EEA. For the purposes of this section, any defined terms have the meaning under the European Union’s General Data Protection Regulation (“GDPR”) or the UK General Data Protection Regulation (“UK GDPR”), as applicable. Northwestern Medicine and its corporate affiliates, each in its own capacity, acts as a “Controller” under the GDPR and UK GDPR. Northwestern Medicine’s headquarters is located in the United States at 251 E. Huron St., Chicago, IL 60611.

Legal Basis of Processing

In this section, we identify the lawful ground we rely on for processing Personal Data.

Consent

If Northwestern Medicine relies on consent for the processing of Personal Data, we will provide transparent notice of the purposes for which we seek such consent at the time we collect your Personal Data.

If Northwestern Medicine wishes to process any special categories of Personal Data as set out in Article 9(1) of the GDPR or UK GDPR, Northwestern Medicine may obtain your explicit consent for such processing.

Contractual Necessity Northwestern Medicine processes Personal Data to fulfill our contracts with our business partners and service providers, such as for rendering payment or communicating with health care professionals or consultants.
Legal Obligation Northwestern Medicine may process Personal Data as specifically required by applicable legal obligations, such as laws and regulations that require Northwestern Medicine to process Personal Data for purposes of obtaining regulatory approvals and making transparency disclosures.
Public Interest

Northwestern Medicine may process Personal Data for scientific or historical research purposes, or statistical purposes in the public interest, as authorized by applicable law.

If Northwestern Medicine wishes to process any special categories of Personal Data as set out in Article 9(1) of the GDPR or UK GDPR, it may do so when necessary for scientific research purposes, medical diagnosis, or the protection of vital interests.

Legitimate Interests

Northwestern Medicine may process Personal Data subject to its own legitimate interests, such as to facilitate treatment; to schedule appointments; to offer support programs; to offer community initiatives; to promote scholarly research; to develop, administer and support research; to operate, evaluate and improve our business; to process donations; to support our recruitment activities; to process job applications; or to facilitate a sale of assets or merger or acquisition.

It may also be necessary for Northwestern Medicine to process Personal Data to establish, exercise or defend against fraud, illegal activity, and claims and other liabilities, including by enforcing the Terms of Use that govern the services we provide.
Compatible purposes Northwestern Medicine may also process Personal Data for purposes that are compatible with those described above. Such purposes may include scientific research.

Data Retention

We retain Personal Data for as long as is necessary to accomplish the purposes set out in this Privacy Policy unless a longer period is required under applicable law or is needed to resolve disputes or protect our legal rights.

The criteria used to determine the period for which Personal Data about you will be stored varies depending on the legal basis under which we process such Personal Data:

Consent For the period of time necessary to fulfill the underlying agreement with you, subject to your right, under certain circumstances, to have certain Personal Data about you erased (see Data Subject Rights below).
Contractual Necessity For the duration of the contract plus some additional limited period of time that is necessary to comply with law or that represents the limitation period for legal claims that could arise from the contractual relationship.
Legal Obligation For the duration of time that we are legally obligated to keep the information.
Public Interest For the period of time necessary to fulfill the purposes of the business process in the public interest and for any period of time that may be required to document the public interest or business process under applicable law.
Legitimate Interests For a reasonable period of time based on the particular interest, taking into account the fundamental interests and the rights and freedoms of the Data Subjects.

We may face any threat of legal claim and in that case, we may need to apply a “legal hold” that retains information beyond our typical retention period. In that case, we will retain the information until the hold is removed, which typically means the claim or threat of claim has been resolved.

Transfer of Personal Data Outside of the EEA or UK

Northwestern Medicine processes your Personal Data in the United States, which does not provide the same level of data protection as the EEA or UK. Where your Personal Data is processed by Northwestern Medicine or third parties outside of the EEA or UK, we will ensure that appropriate safeguards are in place to adequately protect your Personal Data, as required by applicable law, if the recipients are not located in a country with adequate data protection (as determined by the European Commission). Such safeguards may include the execution of standard contractual clauses; EU-US Privacy Shield framework; consent of the individual to whom the personal information pertains; or other safeguards permitted by applicable EEA or UK requirements.

Data Subject Rights under the GDPR and UK GDPR

Under the GDPR and UK GDPR, in certain circumstances, an EEA- or UK-resident Data Subject has certain individual rights with respect to the Personal Data that we hold about them. In particular, you may have the right to:

  • Request access to any data held about you;
  • Ask to have inaccurate data amended;
  • Request data held about you to be erased, provided the data is not required by Northwestern Medicine to perform a contract, protect its rights, interests or those of a third party, defend against a legal claim or to comply with applicable laws or regulations;
  • Prevent or restrict processing of data which is no longer required; and
  • Request transfer of appropriate data to a third party where this is technically feasible

Additionally, in the circumstances where you may have provided your consent to the collection, processing and transfer of your Personal Data for a specific purpose, you have the right to withdraw your consent for that specific purpose at any time. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

To exercise any of these rights, please contact us using the contact details set out under the “Contact Us” heading below. As a resident of the EEA or UK, you are also entitled to direct any complaints in relation to our processing of your Personal Data to your national or local data protection authority (i.e., your Supervisory Authority).

Links to Third-Party Websites

Our Services may reference or provide links to third-party websites. Other websites may also reference or link to our Services. Because Northwestern Medicine does not control these websites, we are not responsible for the third-party websites. We encourage our users to be aware when they leave our Services to review the privacy policies posted on each and every website that collects personally identifiable information. Please be aware that Northwestern Medicine does not control, endorse, screen, or approve, nor are we responsible for, the privacy policies or information practices of third parties or their websites or mobile applications. Visiting these other websites is at your own risk.

Your Choices

Account Information

You may update, correct or modify information about you or deactivate your account at any time by logging into your online account or by contacting us at 855.HLP.MYNM (855.457.6966), TTY: 711 during our business hours but note we may continue to store information about you as required by law or for legitimate business purposes.

Newsletters

Upon your request, we may send you information about Northwestern Medicine via email. You may unsubscribe from receiving marketing or other commercial emails from us by following the instructions included in the email. However, even if you opt out of receiving such communications, we retain the right to send you non-marketing communications (such as important transaction information, or changes in website or mobile application terms).

Location Information

With your consent, we may collect information about your actual location, including precise location information, when you use our Apps. You may stop the collection of this information at any time by changing the settings on your mobile device but note that some features of our Apps may no longer function if you do so. If you choose to enable and use location services for the App, your location data may be retained and used by the App’s location services vendor for a defined period of time.

Native Applications on Mobile Device

Some features of our Apps may require access to certain native applications on your mobile device, such as the camera and photo storage applications (e.g., to take and upload photos), microphone and the phonebook application. If you decide to use these features, your mobile device will ask for your consent prior to accessing the applications and collecting information. Note that you can revoke your consent at any time by changing the settings on your device. Please be advised of how this information is used, accessed, stored, and disclosed:

Features
Camera Our Apps allow you to use your camera to take new photos or to capture video in a recording that can be securely sent to your providers. The photos you take may be used to personalize your account or used as file attachments that are sent by you through our App. MyNM App may store data collected from the camera in your medical record.
Microphone Our Apps allow you to use your microphone to capture audio associated with videos that you capture that can be securely sent to your providers. The videos you take may be used as file attachments that are sent by you through our App. MyNM App may store data collected from the microphone in your medical record.
Storage Our Apps (including but not limited to the MyNM App) may access your device’s storage to read and write files you choose to use in the application. These files may be used as file attachments that are sent to your provider or they may be created from file attachments sent to you from your provider. Our Apps may store files uploaded from your device's storage in your medical record.
Phone Calls Our Apps may allow you to use your phone to call phone numbers displayed in the App. The App will not store your call history or other call data.

Cookies and Your Ad Choices

Most web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove or reject browser cookies. Please note that if you choose to remove or reject cookies, this could affect the availability and functionality of the Services. Please see our separate Cookies Policy to learn about how we use cookies on the Site and your choices in relation to the use of cookies.

Push Notifications

With your consent, we may send promotional and non-promotional push notifications or alerts to your mobile device. You can deactivate these messages at any time by changing the notification settings on your mobile device or within our Apps.

Contact Us

If you have any questions about this Privacy Policy or concerns about the way Northwestern Medicine processes your information, or require assistance in managing your privacy choices, please contact us at:

Northwestern Memorial HealthCare
Corporate Compliance and Integrity
541 N. Fairbanks
Chicago, Illinois 60611
compliance@nm.org
312.926.4800