Skip to content

Practical answers

Is it safe to put client information into AI?

It depends on the account. On personal plans, what you type can be used to train future models. Business plans and the API don’t do that. Health information also needs a signed agreement, and lawyers generally need the client’s consent.

If you use a personal account

ChatGPT Free, Plus, and Pro, and Claude Free, Pro, and Max, can use your conversations to train future models. You can turn this off. In ChatGPT, the setting is “Improve the model for everyone.” In Claude, it’s the model training setting under Privacy. If training is on, Anthropic keeps your Claude conversations for up to five years. If it’s off, 30 days.

This is the case to watch for: someone on your team using a personal account for work.

If you use a business plan or the API

OpenAI doesn’t train on data from ChatGPT Business, ChatGPT Enterprise, or its API unless you opt in. Anthropic doesn’t train on data from Claude Team, Claude Enterprise, or its API.

Both still keep your data for a while, usually about 30 days, to check for misuse. Some providers will agree to keep nothing, but that takes a separate agreement and may not be available for their newest models.

If you handle health information

HIPAA requires a Business Associate Agreement (BAA) with any company that handles protected health information for you. A business plan doesn’t include one.

  • OpenAI signs BAAs for its API with a qualifying retention setup, ChatGPT Enterprise (through its sales team), and ChatGPT for Healthcare. Not for ChatGPT Business or personal plans.
  • Anthropic signs BAAs for its API and Claude Enterprise, each set up in a HIPAA-ready configuration. Claude Team isn’t included.

Don’t put patient information into a product unless your BAA covers it.

If you’re a law firm

The American Bar Association’s Formal Opinion 512 (2024) says a lawyer generally needs the client’s informed consent before putting client information into an AI tool that can learn from it. A line in the engagement letter isn’t enough. State bars have their own guidance.

Legal products like Harvey run on models from OpenAI and others. What you’re paying for is the contract, the security controls, and features built for legal work.

What I’d suggest

  • Find out which AI tools your team uses for work, and on which accounts.
  • Move work use onto a business plan.
  • If someone keeps using a personal account, turn training off.
  • If you handle health information, sign a BAA before anyone uses AI with patient data. If you’re a law firm, check your state bar’s guidance.

I’m not a lawyer, and this isn’t legal advice. If your information is regulated, check with your attorney or compliance advisor.

Sources

Last checked .

Ask me about your setup.

Tell me which AI tools your team uses and what kind of information goes into them. I’ll tell you what I’d change, if anything. I read and reply to every message myself.