Privacy Notice

Updated as of June 1, 2026

HCA Healthcare (“HCA,” "we," "us," or "our") is committed to the care and improvement of human life. Part of that commitment includes protecting your Personal Information (defined below). We maintain information confidentiality and comply with applicable regulatory requirements.

This privacy notice ("Privacy Notice") covers our privacy practices with respect to use and/or disclosure of information we may collect from you when you access or use our website ("Website"), Portals that offer secure, private access to records at our facilities, as well as certain internet-based services such as assistance in finding a doctor, assistance in scheduling appointments, the ability to register for classes and pre-register for procedures, the ability to make payment for medical services rendered, and access to health and patient education materials and secure messaging ("Portal"), when you apply for a job with us, and in other situations where you interact with us, including but not limited to interacting with or visiting our sites and offices or our events (e.g., tradeshows and conferences), (such products, services, Website, and other systems collectively, the “Products and Services”); and when we process your data as an employee of a company for which we provide Products or Services; or anywhere this Notice is posted or referenced. This Notice also applies to Personal Information that is collected or processed when you interact with us in person, by telephone, or by mail.

HCA may have other unique privacy notices that apply to certain specific situations. To the extent you were provided with a different privacy notice or policy and those policies or notices apply, those policies or notices will govern our interactions with you, not this one.
This Privacy Notice does not apply to information that would be considered “Protected Health Information” under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). HCA HealthCare’s’ use and disclosure of Protected Health Information is set forth in the HCA Healthcare Notice of Privacy Practices, which can be accessed at the bottom of the facility website.
If you provide us with Personal Information of anyone other than yourself (such as a family member), please note that you are responsible for complying with all applicable privacy and data protection laws prior to providing that information to HCA (including obtaining consent, if required).
Please review this Notice carefully. To the extent permitted by applicable law, by providing us your Personal Information or otherwise interacting with us, you are agreeing to this Notice.

Information Collected

As used in this Privacy Notice, "Personal Information" means any information that may be used, either alone or in combination with other information, to personally identify an individual as defined by applicable laws as noted below. Personal Information may include information considered sensitive in some jurisdictions, such as biometric information, genetic information, medical and health information, financial account information, geolocation, ethnic or racial origin, information concerning your sex life or your sexual orientation, and other information. Data that could be considered sensitive personal information is identified with a caret (^) in the summary charts below. We only collect and processes sensitive personal information for the purposes stated herein and do not use such data to infer characteristics about you.

We will process any Personal Information we collect in accordance with applicable law and as described in this Notice (unless, as explained above, a separate policy or notice governs). In some circumstances, if you do not provide us with your Personal Information, certain Products and Services may be unavailable to you.

Below is a high-level summary of the types of Personal Information we may collect from you. Following that high-level summary is additional detail and information on how we collect, process, and use Personal Information and the potential recipients of your Personal Information, and how we have done so in the preceding 12 months. Some jurisdictions require us to state the legal bases for processing your Personal Information, which are included below, but please note that not all jurisdictions may recognize all legal bases.

	Identity and contact information	Other personal information	Visual and audio information	Technical information	Professional and educational information	Anonymized / de‑identified data
	This may include name, email, phone number, etc.	This may include age, gender, date of birth, etc.	This may include still images, video, call recordings, etc.	This may include Internet Protocol (IP) address, browser, device type, etc.	This may include job title or position, employer, etc.	Data for which your individual personal characteristics have been removed****
Users of the Website, Visitors to Our Websites and Physical Locations, Survey Participants and Senders of Inquiries	X^	X^	X^			X
Employment and Apprenticeship Candidates	X^	X^		X	X	X
Business Partners and Their Employees, Agents, and Contractors	X^	X^		X		X
Attendees and Participants at Events	X^	X^	X^	X	X	X
Children

Users of and Visitors to Our Websites and Physical Locations, Survey Participants, and Senders of Inquiries
We may process your Personal Information when you: (1) visit our websites and our physical locations; (2) submit inquiries to us both online (e.g., via email) or offline (e.g., by written letters); (3) sign up for our newsletters or other informational or marketing materials; and/or (4) register for, visit, or use our online Products and Services.
Examples of the types of data we process:	Where do we get the data?	Why do we process the data?	The legal bases for processing:	Who receives the data?
Identity and contact information, such as: first and last name email address postal address phone number company/employer job position/role username and password^ Other personal information, such as: age gender^ marital status disability^ date of birth Visual and audio information, such as: still images^ video (including via CCTV)^ recordings of your calls with our customer service representatives^ Technical Information, such as: Internet Protocol (IP) addresses (which may identify your general geographic location or company) browser type and browser language device type advertising IDs associated with your device (such as Apple’s Identifier for Advertising (IDFA) or Android’s Advertising ID (AAID)) date and time you use our Products and Services Uniform Resource Locators, or URLs (i.e., website addresses) visited prior to arriving and after leaving our Products and Services activity on our Products and Services and referring websites or applications data collected from cookies or other similar technologies** generalized geolocation information Anonymized / De ‑ identified Data is data for which your individual personal characteristics have been removed such that you are not identified and the information is no longer considered Personal Information under data protection laws***	you directly your devices our security systems (including CCTV) third parties	to provide you with our Products and Services to communicate with you (about your inquiry) to administer our relationship with your organization to send you updates to identify and authenticate you to customize content for you to detect security incidents to protect against malicious or illegal activity to ensure the appropriate use of our Products and Services to improve our Products and Services for short-term, transient use for administrative purposes for marketing, internal research, and development for quality assurance and to assist in training and development of our representatives	for the purposes of our legitimate interests in preparation for or to perform a contract with you in circumstances where we have requested and received consent and for other purposes that may be required or allowed by law**	HCA, our affiliates, subsidiaries, and related companies partners that assist us in providing the Products or Services or help us improve our marketing or administration***

Employment and Apprenticeship Candidates
We may process your Personal Information when you apply or are a candidate for employment or apprenticeship at HCA.
Examples of the types of data we process:	Where do we get the data?	Why do we process the data?	The legal bases for processing:	Who receives the data?
Identity and contact information, such as: first and last name company/employer email address postal address phone number username and password^ Other personal information, such as: age gender^ marital status disability^ date of birth Technical Information, such as: Internet Protocol (IP) addresses browser type and browser language device type advertising IDs associated with your device (such as Apple’s Identifier for Advertising (IDFA) or Android’s Advertising ID (AAID)) date and time you use our Products and Services Uniform Resource Locators, or URLs (i.e., website addresses) visited prior to arriving and after leaving our Products and Services activity on our Products and Services and referring websites or applications data collected from cookies or other similar technologies** generalized geolocation information Professional and educational information, such as: job title or position employer work skills employment history graduate degrees certifications specialized training responses to surveys and questionnaires Anonymized / De ‑ identified Data is data for which your individual personal characteristics have been removed such that you are not identified and the information is no longer considered Personal Information under data protection laws***	you directly your employer or principal your devices our business partners and other third parties	to communicate with you to identify and authenticate you to detect security incidents to protect against malicious or illegal activity for short-term, transient use for administrative purposes for marketing, internal research, and development	for the purposes of our legitimate interests in preparation for or to perform a contract to comply with a legal obligation in circumstances where we have requested and received consent and for other purposes that may be required or allowed by law**	HCA, our affiliates, subsidiaries, and related companies partners that assist us in providing the Products or Services or help us improve our marketing or administration***

Business Partners and Their Employees, Agents, and Contractors
We may process your Personal Information when you act as a customer or business partner such as a vendor, healthcare provider with whom we work, supplier, distributor, retailer, or service provider.
Examples of the types of data we process:	Where do we get the data?	Why do we process the data?	The legal bases for processing:	Who receives the data?
Identity and contact information, such as: first and last name company/employer email address postal address phone number username and password^ Other personal information, such as: age gender^ disability^ date of birth Technical information, such as: Internet Protocol (IP) addresses browser type and browser language device type advertising IDs associated with your device (such as Apple’s Identifier for Advertising (IDFA) or Android’s Advertising ID (AAID)) date and time you use our Products and Services Uniform Resource Locators, or URLs (i.e., website addresses) visited prior to arriving and after leaving our Products and Services activity on our Products and Services and referring websites or applications data collected from cookies or other similar technologies** generalized geolocation information Anonymized / De ‑ identified Data is data for which your individual personal characteristics have been removed such that you are not identified and the information is no longer considered Personal Information under data protection laws***	you directly our business partners and other third parties your employer or principal your devices	to communicate with you (about your inquiry) to administer our relationship with your organization to send you updates to identify and authenticate you to detect security incidents to protect against malicious or illegal activity for short-term, transient use for administrative purposes for marketing, internal research, and development to provide you with our Products and Services to communicate with you to identify and authenticate you	for the purposes of our legitimate interests for medical diagnosis and the provision of healthcare and treatment in the public interest to comply with a legal obligation in preparation for or to perform a contract to protect vital interests to ensure high standards of quality and safety of healthcare in circumstances where we have requested and received consent and for other purposes that may be required or allowed by law**	HCA, our affiliates, subsidiaries, and related companies our customers partners that assist us in providing the Products or Services or help us improve our marketing or administration***

Attendees and Participants at Events
We may process your Personal Information when you attend or participate in professional and educational events we sponsor or hold.
Examples of the types of data we process:	Where do we get the data?	Why do we process the data?	The legal bases for processing:	Who receives the data?
Identity and contact information, such as: first and last name company/employer email address postal address phone number username and password^ Other personal information, such as: age gender^ marital status disability^ date of birth Technical information, such as: Internet Protocol (IP) addresses browser type and browser language device type advertising IDs associated with your device (such as Apple’s Identifier for Advertising (IDFA) or Android’s Advertising ID (AAID)) date and time you use our Products and Services Uniform Resource Locators, or URLs (i.e., website addresses) visited prior to arriving and after leaving our Products and Services activity on our Products and Services and referring websites or applications data collected from cookies or other similar technologies** generalized geolocation information Professional and educational information, such as: job title or position employer work skills employment history graduate degrees certifications specialized training responses to surveys and questionnaires Visual and audio information, such as: still images^ video (including via CCTV)^ Anonymized / De ‑ identified Data is data for which your individual personal characteristics have been removed such that you are not identified and the information is no longer considered Personal Information under data protection laws***	you directly your employer or principal your devices our business partners	to communicate with you (about your inquiry) to administer our relationship with your organization to send you updates to communicate with you to identify and authenticate you to detect security incidents to protect against malicious or illegal activity for short-term, transient use for administrative purposes for marketing, internal research, and development	for the purposes of our legitimate interests in preparation for or to perform a contract to comply with a legal obligation in circumstances where we have requested and received consent and for other purposes that may be required or allowed by law**	HCA, our affiliates, subsidiaries, and related companies other event attendees and participants partners that assist us in providing the Products or Services or help us improve our marketing or administration***

**The legal bases relied upon by HCA include those enumerated in Articles 6 and 9 of the European Union’s General Data Protection Regulation (“GDPR”), the equivalent provisions under Articles 6 and 9 of the UK General Data Protection Regulation ("UK GDPR") as supplemented by the Data Protection Act 2018, the consent and legitimate use provisions under Sections 6 and 7 of India's Digital Personal Data Protection Act, 2023 ("DPDPA"), and the criteria for lawful processing under Sections 12 and 13 of the Philippines' Data Privacy Act of 2012 (Republic Act No. 10173), in each case depending on the type of Personal Information and the applicable jurisdiction.

***In limited circumstances, recipients may include, (1) in the event of a sale, assignment, or transfer, to the buyer, assignee, or transferee; and, (2) government or regulatory officials, law enforcement, courts, public authorities, or others when permitted by this Notice or required by law.

****Please see the section below regarding Cookies, Web Beacons, and Marketing for more information on how we use cookies and similar technologies.

*****We will not attempt to re-identify you or anyone else from this Anonymized Data / De-identified Data, and if we disclose it to third parties, we will require that they commit to not attempting to re-identify you or anyone else from the Anonymized Data / De-identified Data. Anonymized Data / De-identified Data includes health information resulting from the removal of identifiers from protected health information required under the Health Insurance Portability and Accountability Act, 45 CFR § 164.514(b)(2).

Combination of Data. We may combine information we collect, whether Personal Information or not, with Personal Information that we may obtain from third parties.

Children’s Data. HCA does not knowingly collect, maintain, disclose, or otherwise process Personal Information from minors below the age of 16 without the permission of such minor’s parents or legal guardians.

Cookies, Web Beacons and Marketing

To the extent permitted by applicable law, including in accordance with your consent where required by applicable law, we may engage in the following activities:

We may use your contact details to contact you to determine whether you would like to initiate a business relationship with us or to send you marketing emails. If you do not wish to receive such marketing emails, you may opt out by declining to receive such emails when registering or in our subsequent communications by following opt-out instructions included in the email or at other information collection points on the Products and Services.
We may display advertisements to you regarding Products and Services that we believe are relevant to you based on your activities on the Website or on other web or digital properties. Such advertisements may be shown on our Websites or the online services of others. We achieve this by using, and allowing third parties (e.g., Facebook, LinkedIn) to use certain cookies, eTags, pixels, web beacons, and other tracking technologies to track your activities on our Products and Services and other online services.
We perform statistical analyses of the users of our Products and Services to improve the functionality, content, design, and navigation of the Websites.

We may accomplish the above using cookies. A "cookie" is a small text file that may be transferred to your computer's hard drive to personalize our services for you and collect information regarding usage of our Products and Services. Each computer is assigned a different cookie that contains a random, unique identifier. Your browser software can be set to warn you of cookies or reject all cookies. Most browsers offer instructions on how to reset the browser to reject cookies in the "Help" section of the toolbar. If you reject our cookies, this may disable some of the functionality of our Products and Services and you may not be able to use certain services.

We also may use technologies including "web beacons," "clear GIFs," "web bugs," or "pixel tags" which are tiny graphic files with a unique identifier that is similar in function to a cookie, but would allow us to count the number of users that have visited certain pages or screens of our websites, and to help determine the effectiveness of promotional or advertising campaigns. When used in HTML-formatted email messages, web beacons can tell the sender whether and when the email has been opened. In contrast to cookies, which may be stored on your computer's hard drive, web beacons are typically embedded invisibly on pages or screens. We may use web beacons in providing Products and Services.

We reserve the right to share aggregated site statistics monitored by cookies and web beacons with our affiliates and partner companies. We treat the information of everyone who comes to our Products and Services in accordance with this Privacy Notice.

Consent and Opt Out

You can manage your cookie preferences with us by clicking the Cookie Preferences link on our Site and customizing your cookie choices where applicable. The Cookie Preferences tool will record when you have consented to cookies and will ask for consent periodically to ensure users stay up to date with changes to our cookie and privacy practices. The Cookie Preferences tool controls the advertising, analytics, and performance cookies set by using the Site. Essential cookies cannot be disabled.

We do honor opt-out preference signals as a valid consumer request to opt-out of the sale or sharing of Personal Information and to limit the use of Sensitive Personal Information. This is based on your device and browser’s settings. One example of an opt-out preference signal is the use of a Global Privacy Control (GPC). GPC is a browser extension that makes it easy for consumers to set privacy preferences for their Personal Information as they browse the web. To turn on GCPs on your browser, go to your browser, open the Privacy or Security Settings, locate the GPC or other Opt Out Preference Signal setting in your browser extension and turn it on. If your browser does not have this option, you will need to implement a browser extension that can send these signals.

We may also send certain messages, including electronic newsletters, notification of account statuses, and marketing communications on a periodic basis. If you wish to be removed from such messages, you may request to discontinue future ones. All such material will have information as to how to opt-out of receiving it, although certain messages (such as a secure message sent by a doctor or an account status update via the Portal), may be required by law and will not have opt-out capabilities.

Third-Party Service Providers

Third-party service providers acting on our behalf must execute agreements including confidentiality requirements and will only process Personal Information as necessary to perform their functions in a manner consistent with this Notice, other applicable privacy notices, and as explicitly permitted or required by applicable laws, rules, and regulations. Our third-party service providers may be located in the United States and other jurisdictions.

Geolocation Data

We do not collect precise information (e.g., GPS data; latitude and longitude) concerning the location from which you access our Products and Services, but we collect information on your region or postal code to help us gather information useful for improving the relevance of our content and securing our Products and Services.

Links to Other Websites

Our Products or Services may contain links to other websites, applications, products, or services that are not owned or operated by HCA, such as social media websites and applications like Facebook and LinkedIn. You should carefully review the privacy policies and practices of other websites, products, and services as we cannot control and are not responsible for privacy policies, notices, or practices of third-party websites, applications, products, and services.

Information Security

No website can guarantee security, but we maintain industry accepted physical, electronic, and procedural safeguards to protect your Personal Information from loss, misuse, alteration, theft, unauthorized access, and unauthorized disclosure consistent with legal obligations and industry practices. However, as is the case with all websites, applications, products, and services, we unfortunately are not able to guarantee security for data collected through our Products and Services. In addition, it is your responsibility to safeguard any passwords, ID numbers, or similar individual information associated with your use of the Products and Services. Please see the Terms of Use available via the Website homepage (“Terms”) for more specific information about information security and your responsibilities.

Transfer of Personal Information Across National Borders

Please be aware that Personal Information we collect and process may be transferred and maintained outside your state, province, country, or other jurisdiction where the privacy laws may not be as protective as those in your location, including the United States. HCA has put in place lawful transfer mechanisms and adequate safeguards, in accordance with applicable legal requirements, to protect your Personal Information.

Retention of Information

We will retain the categories of Personal Information discussed herein for the period necessary to fulfill the purposes for which it has been collected as described in this Privacy Notice unless a longer retention period is required by law, for security, fraud & abuse prevention, to comply with legal or regulatory requirements, to ensure continuity of services or financial record-keeping purposes. Where practical, we dispose of certain categories of information, including Personal Information, on a regular schedule and aim to anonymize the information or remove unnecessary identifiers from records that we may need to keep for periods beyond the specified retention period.

User Communications

Email communications that you send to us via the email links on our Products and Services may be shared with a customer service representative, employee, medical expert or agent that is most able to address your inquiry. We make reasonable efforts to respond in a timely fashion once communications are received. Once we have responded to your communication, it is discarded or archived, depending on the nature of the inquiry and all applicable laws, rules and regulations.

The email functionality on our Products and Services does not provide a completely secure and confidential means of communication. It is possible that your email communication may be accessed or viewed by another Internet user while in transit to us. If you wish to keep your communication private, do not use our email.

Your Rights Regarding Your Personal Information

Please note that in many circumstances, we cannot effectively do business with you without processing some Personal Information about you (e.g., your contact information). For example, when you contact customer service representatives, we may require you to provide information to authenticate your identity to assist you with your request. If you are unable to provide this information, we may be unable to process your request.

You may have a right under your area’s data protection law to the following with respect to some or all of your Personal Information:

To request access to and a copy or representative summary of your Personal Information (including under GDPR Article 15);
To request that we rectify or erase your Personal Information (including under GDPR Articles 16 and 17);
To request that we restrict or block the processing of your Personal Information (including under GDPR Articles 18, 21 and 22 and to object to the sale or sharing of your Personal Information under other relevant laws);
- This includes the right to opt-out of solicitations, to opt-out of sharing your Personal Information for cross-context behavioral advertising or, in certain U.S. states, to opt-out of targeted advertising;
To provide your Personal Information directly to another organization, i.e., a right to data portability (including under GDPR Article 20);
When we previously obtained your consent, to withdraw consent to processing (including under GDPR Article 21);
To request to know about the Personal Information we process about you or, in other states, to request to acknowledge our processing of your Personal Information;
To opt out of he use of automated decision-making technology when processing your Personal Information;
To request a list of the categories of third parties to which your Personal Information is disclosed or, in other states, to request a list of specific third parties (other than natural persons) to which we have disclosed your Personal Information;
To request that we limit the processing of your Sensitive Personal Information;
To appeal the denial of a request; and
To lodge a complaint with the data protection authority in your area.

You can make a request with respect to your Personal Information or contact our Consent Manager by completing the Consumer Request Form, emailing our privacy team, calling us at (844) 422-3282, or writing us at:

HCA Healthcare
Attention: Privacy Requests
One Park Plaza
Nashville, TN 37203

We will make reasonable efforts to respond promptly to your requests in accordance with applicable laws. We may, after receiving your request, require additional information from you to honor the request and verify your identity. Please be aware that we may be unable to afford these rights to you under certain circumstances, such as if we are legally prevented from doing so. You may also find additional contact information in the list of data controllers here .

California Direct Marketing Privacy Rights

Under California’s “Shine the Light” law (Civil Code Section § 1798.83), California residents have the right to request in writing from businesses with whom they have an established business relationship, (a) a list of the categories of personal information, such as name, e-mail and mailing address and the type of services provided to the customer, that a business has disclosed to third parties (including affiliates that are separate legal entities) during the immediately preceding calendar year for the third parties’ direct marketing purposes; and (b) the names and addresses of all such third parties. To request the above information, please email our privacy team with a reference to California Disclosure Information.

We will endeavor to respond to such requests to information access within 30 days following receipt at the e-mail address stated above. If we receive your request at a different e-mail address, we will respond within a reasonable period of time, but not to exceed 150 days from the date received. Please note that we are only required to respond to each customer once per calendar year.

Policy Changes

We reserve the right to change the terms of this Privacy Notice at any time by posting those changes in revisions to this Privacy Notice, so that you are always aware of our processes related to collection, use and disclosure of information. We urge you to check here for any updates to this Privacy Notice from time to time. Unless otherwise indicated, any changes to this Privacy Notice will apply immediately upon posting to the Website.

What if I have questions or concerns regarding this Privacy Notice?

Email our privacy team or call us at (844) 422-3282 if you have any questions or concerns about this Privacy Notice or the information practices of our Products and Services.

You may also write to us at:
HCA Healthcare
Attention: Privacy Requests
One Park Plaza
Nashville, TN 37203

Specialties

Patients

Healthy Living

About Us

Privacy Notice

Privacy Notice

Information Collected

Cookies, Web Beacons and Marketing

Consent and Opt Out

Third-Party Service Providers

Geolocation Data

Links to Other Websites

Information Security

Transfer of Personal Information Across National Borders

Retention of Information

User Communications

Your Rights Regarding Your Personal Information

California Direct Marketing Privacy Rights

Policy Changes

What if I have questions or concerns regarding this Privacy Notice?