I turned down an AI notetaker: every user could read every transcript
These are my stories and my fixes. An AI writes them up, and I check every fact and link before a post goes up.
At work I turned down an AI meeting notetaker because every user could read every transcript. We went with one scoped to the right people, and my team now vets every new AI tool with a short test.
Without that step you end up where a Pennsylvania pest control owner (opens another site) did, finding some internal personnel calls had been summarized by AI where team members could have seen them.
Staff pasting a customer's details into whatever AI is handy is the same problem. So before any AI tool sees customer information, I ask two questions: where does my data go, and who can see it?
Answering them is what lets you use AI around customer data at all. Small accounting firms (opens another site) already work this way, with client information kept out of public AI platforms and a person reviewing anything AI helped with. In a health, accounting, law or insurance office this comes before anything else.
Two questions first
Before any AI tool touches customer information, answer two questions: where does it go, and who can see it? If you can't answer both from its settings or its terms, it doesn't get the data.
House rules
- Customer data goes only into tools you've checked.
- Training switched off, or a business plan.
- Health information needs a signed BAA first.
- Recordings and summaries visible only to who needs them.
- No customer data in anyone's personal AI account.
One person in the office owns this list and checks it when a new tool shows up.
How you'd run the check yourself
Five steps, in order; the menu paths are as of October 2026, so look again if they've moved.
List every AI tool in use
Ask every person in the office what they use, including meeting notetakers and the AI apps on their phones. Guessing misses the apps people installed themselves.
Answer the two questions for each
For each tool, find where the data goes and who can see it, in its privacy settings or its terms (on a business plan, usually the contract). If you can't find both answers, it gets no customer data.
Switch off training where you can
ChatGPT (opens another site): Settings > Data Controls, 'Improve the model for everyone' off. Claude (opens another site) Free, Pro and Max: Settings > Privacy, 'Help Improve our AI models' off. Gemini (opens another site): in Gemini Apps Activity, Keep Activity off. Google still says not to enter 'confidential information that you wouldn't want a reviewer to see.'
Health offices: a BAA first
If HIPAA covers your office, HHS says (opens another site) a cloud service handling protected health information needs a business associate agreement (BAA), even if it only stores encrypted data. Until the BAA is signed, no patient information goes in, and that includes the notetaker.
Check who can see the recordings
Open the notetaker and the phone app and check who can see recordings, transcripts and summaries, since nobody in your office chose that setting. Narrow it to the people who need them, and look again whenever someone joins or leaves.
If you'd rather have help, I'll go through your tools with you, answer the two questions for each, and set up the ones worth keeping so your customers' information stays where it belongs.
