Lesson 3 of 5
Privacy
Please note: This site is only a guide to help people understand. Consult your IT, security and/or privacy department for clarification.
What you type may be stored
Everything you type is your prompt. Many tools keep it for some time. That is called retention.
How long it is kept depends on the tool and on the plan you use.
Consumer, business and API plans
Most providers sell three kinds of access. Consumer plans are for individuals. Business plans, often called enterprise tiers, are for organizations. The API is for software that talks to the model.
The rules often differ by plan. Free and personal plans can have weaker privacy terms than business plans. Always check the plan you actually use.
Training on your data
Some tools may use chats as training data, to help build future models. That is the new employee remembering what they overheard.
The risk is that private details could shape a future model. In rare cases they could be repeated in an answer to someone else.
Many tools let you opt out, and some plans leave training off by default. The topic page lists what each provider says, with sources.
Personal information and a simple rule
Personal information means details that point to a real person, like a name with an address or a health note.
Use this rule. If it would be a problem on the front page of the local paper, or it breaks a promise to a client, it does not go in.
Open-weight models and the law
An open-weight model can be downloaded and run by anyone. When someone else hosts it for you, their privacy and security rules apply, not the model maker's. Ask the host.
Legal duties differ by place and by sector. A nonprofit may face health privacy rules (like HIPAA in the US), the EU's GDPR, or promises made to funders and donors.
A vendor agreement may be needed before client health data goes into any tool. No tool is made safe for you just by being popular. This guide is not legal advice, so ask a qualified professional.