What’s Actually Private in AI

The short answer

“Is AI private?” is the wrong question. The right question is: which tier am I on? The same company, the same model, can treat your words in completely opposite ways depending on which door you walked in through.

There are three tiers, and almost everyone confuses them.

Anyone who tells you “it’s all the same” is wrong. And anyone who tells you “cloud means exposed” is also wrong.

Tier 1 — Consumer apps: you are the training data

This is the tier nearly everyone is actually using, and it is the one that disqualifies itself for client work.

Two details that surprise people

Google’s own documentation says it plainly: “Please don’t enter confidential information that you wouldn’t want a reviewer to see.” Believe them.

Tier 2 — Business and API: genuinely different, genuinely contractual

This is the tier most people don’t know exists, and it’s where the confusion has been costing you.

Microsoft’s is the clearest promise of the lot. Azure’s documentation states that your prompts “are NOT available to OpenAI,” “are NOT used to improve their models,” and “are NOT used to train any generative AI foundation models without your permission.”

The traps in this tier

Tier 3 — Local: the words never leave the room

A model running on your own computer sends nothing anywhere. No agreement needed, because there’s no second party involved. Here’s the honest picture of what that gets you today.

What you need

Memory is everything. A Mac with 16 GB is the practical entry point; 24–32 GB is where it becomes genuinely pleasant. An 8 GB machine can technically run something, but not anything you’d enjoy using. On Windows it’s the graphics card’s memory that matters, not system RAM — a laptop with 8 GB of video memory behaves roughly like a 16 GB Mac, and one with no dedicated graphics card will be painfully slow.

What to run

As of mid-2026 the sensible choices are Gemma 4 and Qwen 3.6. Beware download charts — the most-downloaded models are still from 2024, so popularity lags quality by about a year.

What they’re actually good at

• Summarising a document
• Cleaning up messy notes
• Drafting from bullet points, rewriting, translating
• Answering questions about a short passage you give them

What they’re bad at, honestly

Complex multi-step reasoning, factual accuracy without a source in front of them, arithmetic and dates, and — most importantly — long documents. One of these models advertising a huge context window still only retrieves about 44% of what’s buried in a long document. So “read a year of my notes and tell me what changed” is precisely the task they fail. On independent benchmarks they sit roughly 25 points below the frontier cloud models. They are a good assistant, not a brilliant one.

Otherwise, local tools are clean: both Ollama and LM Studio state that prompt content never leaves your machine. They do phone home to check for updates and to search for models — that reveals which model you downloaded, never what you typed.

The DeepSeek confusion — a category error worth understanding

This one deserves its own section, because it’s where nearly everyone gets muddled, and where the answer is genuinely two different answers.

DeepSeek’s own service — their app and their API — is the highest-exposure option covered here. Their published privacy policy states that data is “directly collect[ed], process[ed] and store[d] in People’s Republic of China.” Training on your data is listed as a purpose. No retention limit is given. Their API terms contain no no-training commitment at all, and prompt caching to disk is on by default. The only way to opt out is to email them. Governments including Italy, South Korea, Australia, the Czech Republic and much of the US federal government have restricted or banned it — and in 2025 Korean regulators found it had transferred user prompts to companies in China without consent.

But “DeepSeek the model” and “DeepSeek the company” are entirely different things. The model weights are released under the MIT licence — completely open, no telemetry, no strings. Running a DeepSeek model on your own computer, or through a US host like Amazon Bedrock or Together, sends nothing whatsoever to DeepSeek the company. None of those warnings apply. Amazon’s terms state plainly that inputs are never shared with model providers.

So both of these are true, and they are not in conflict: don’t send client material to DeepSeek’s servers, and DeepSeek’s models are perfectly fine to run privately.

The one test that settles it: look at the address

Every AI tool is configured with a destination. Find it and read it:

• https://api.deepseek.com → your words go to DeepSeek, in China
• https://api.anthropic.com  or  https://api.openai.com → to those companies, under their commercial terms — no training, ~30-day retention
• http://127.0.0.1  or  localhost → this machine. Nothing leaves.

127.0.0.1 means “the computer I am sitting at.” It is the only address that guarantees privacy, and it is the same regardless of whose model is running there. A DeepSeek model at 127.0.0.1 sends nothing to DeepSeek. A DeepSeek model at api.deepseek.com sends everything.

So “I use an open-source Chinese model” tells you nothing on its own. Ask where it’s pointed. That single question resolves most of the confusion in this field.

If you hold other people’s confidential information

Most of the people who need this page aren’t technologists. They’re professionals whose whole practice rests on discretion — and who have been quietly wondering whether the tool everyone’s raving about is something they’re allowed to touch.

The common thread across every profession below is the same: a duty of confidentiality doesn’t pause because the disclosure was convenient. If client material goes into a system that retains it, trains on it, or lets a stranger review it, that is a disclosure — whether or not anything bad ever comes of it.

• Lawyers. Confidentiality and privilege are the foundation of the work, and the profession has already issued formal guidance on generative AI — covering competence, confidentiality, supervision, and what clients must be told. Consumer-tier tools that train on your inputs are difficult to square with a duty to make reasonable efforts to prevent unauthorised disclosure.
• Lenders, mortgage brokers and financial professionals. Federal law requires firms handling customer financial information to maintain a written security program safeguarding it. A client’s income, assets and identifiers typed into a consumer chatbot is exactly the kind of disclosure that program exists to prevent.
• Accountants and tax preparers. Rules governing tax return information are among the strictest in any profession, with real penalties attached to improper disclosure.
• Realtors and brokers. You handle Social Security numbers, financial statements and contracts, under both a code of ethics and state licensing rules. Less codified than the professions above — which usually means less guidance, not less exposure.
• And anyone else holding a confidence: consultants, coaches, HR professionals, journalists protecting sources, writers working with other people’s stories.

For every one of these, the practical answer is the same and it’s genuinely reassuring: use a business or API tier with the proper agreement, or keep it local. Both are available today, neither is difficult, and one of them is free.

Therapists and counsellors — a special case

This profession deserves its own section, because it’s the one where the law moved fastest in 2025–2026, and most practitioners have no idea.

The federal rule (HIPAA) is straightforward. If an outside company’s servers touch protected health information, they are a “business associate” and you need a signed agreement with them — there’s no exception for “it’s only passing through.” Anthropic, OpenAI, Google and Microsoft all sign these on the right tiers. ChatGPT Business does not qualify. Consumer apps never qualify.

A local model changes the analysis, because there’s no second party to contract with — the same reason your word processor isn’t a business associate. But this removes one obligation, not all of them: the Security Rule still applies in full, meaning risk analysis, encryption and access controls remain your responsibility.

• Nevada (since July 2025) — a mental health provider “shall not use an artificial intelligence system in connection with providing professional mental and behavioral health care directly to a patient.” Administrative support only.
• Illinois (since August 2025) — AI may not make therapeutic decisions, communicate therapeutically, or detect emotional states. Recording or transcribing with AI requires written, purpose-specific consent — a general terms-of-use click expressly does not count. $10,000 per violation.
• Maine (since July 2026) — similar, and additionally requires disclosing how session data will be stored, used for training, and deleted. Client waivers are void.
• Colorado — written consent in advance of AI recording, effective 12 August 2026.
• Rhode Island and Vermont — consent requirements, 2026.
• Texas and Utah — disclosure requirements when AI is used in care.
• California — AI may not imply licensure; the Board of Psychology advises licensees to clearly identify AI-generated content, including treatment summaries.

Federal guidance, meanwhile, is a vacuum: as of August 2026 there is no HHS or OCR guidance on AI and protected health information, and the proposed Security Rule update from January 2025 still isn’t final.

Separately, ten states require all-party consent to record a conversation at all — a rule that predates AI and applies before any of the above.

How to choose, in one page

Ask three questions, in order.

1. Does confidential client material touch this at all? No → any tier is fine. Use a consumer app and enjoy it.
   Yes → consumer apps are out. Continue.
2. Do you need the work to be excellent, or merely useful? Excellent — nuanced reasoning, long documents, clinical complexity → business/API tier with a signed agreement.
   Useful — cleaning up notes, drafting, summarising one document at a time → a local model does this well, and nothing leaves your room.
3. What does your state say? Check this before anything else if you’re a licensed clinician. In some states the answer changes what you’re permitted to do regardless of which tier you choose.

Two tools, each honest about what it is. This is usually the right answer, and it costs very little.

How to check any of this yourself

Don’t take my word for it — and don’t ask a chatbot, because this is precisely what they’re worst at. Models are trained on old text and, when unsure, tend to answer with vague caution. That is why you may have been told “it’s all the same”: it isn’t, but a model that doesn’t know will hedge toward the gloomiest answer.

Go to the primary sources instead. Every company publishes these:

• Anthropic — anthropic.com/legal/privacy · platform.claude.com/docs
• OpenAI — openai.com/enterprise-privacy · openai.com/policies
• Google — ai.google.dev/gemini-api/terms · support.google.com/gemini
• Microsoft — learn.microsoft.com  (Azure OpenAI data, privacy and security)
• DeepSeek — cdn.deepseek.com/policies

Look for three things: does it train on my data by default, how long is it kept, and will they sign a HIPAA agreement? Those three answers tell you the tier you’re on.