"We do not train on your data" answers one important question about healthcare AI. It does not establish that the information is never stored, never accessed by people, never processed by another supplier or always deleted when a user closes a conversation. A useful privacy assessment follows the information through the service rather than stopping at its most reassuring sentence.
This article examines UK healthcare procurement and professional use as at 10 October 2026. It is a practical questioning framework, not approval to enter patient information into an unapproved tool. The appropriate local information-governance process remains essential.
Training and providing an answer are different activities
Training changes a model using examples. Inference is the processing used to produce a response to a request. A supplier may prohibit the first use of customer content while still needing the second to deliver its service. Logging, troubleshooting, quality review and storage are additional questions rather than synonyms for either process.
The ICO's AI data-minimisation toolkit, checked on 10 October 2026, specifically addresses the retention of information used during training and inference. That distinction is a helpful reason to ask for a data map rather than accept a binary training/no-training answer.
Consider a fictional clinical-reference request. The user writes a question in a browser, the platform sends necessary text to an AI provider, a response returns, and the service stores some interaction information. A promise that the provider will not train its model on that text does not identify which of those stages retain information, for how long, or for which purpose.
Ask what happens to each type of information
A vendor questionnaire should separate data types because the answers may differ. Audio, a transcript, the clinician's prompt, retrieved source passages, an output, an approved care record and technical metadata need not share the same destination or retention policy.
The following is a proposed questioning matrix. It does not describe a particular supplier's architecture.
| Processing stage | Precise question to ask | Why the answer matters |
|---|---|---|
| Capture | What leaves the device, and when? | A local interface does not establish local processing |
| Inference | Which organisation receives the necessary content? | The model provider may be a separate party |
| Logging | What is recorded for operation, security or troubleshooting? | A no-training promise may not address logs |
| Support | Can staff or subcontractors inspect content? | Human access needs its own scope and controls |
| Improvement | Which uses are permitted beyond delivering the request? | Product improvement can mean several different activities |
| Deletion | Which copies disappear, and which remain for a justified purpose? | Closing an account may not erase every record immediately |
Ask for answers that refer to the purchased service and account configuration. A general consumer privacy page may not describe an enterprise deployment, and a statement about one product should not automatically be transferred to another feature under the same brand.
Human access is not the same question as model training
A clinician might reasonably care whether support personnel can inspect a sensitive prompt even if no model is trained on it. Equally, a supplier may need controlled access to investigate a technical incident. The assessment should identify the circumstances, permissions and safeguards rather than assume that any human access is improper or that none occurs.
A useful demonstration would show how a support request is handled without the user pasting an entire consultation into an ordinary email. Could the supplier investigate with a transaction identifier? When more content is genuinely necessary, who approves that disclosure and where is it recorded?
The ICO's guidance on security and data minimisation in AI, checked on 10 October 2026, discusses how AI can complicate familiar security and minimisation challenges. It does not support treating the model's training policy as the whole security assessment.
Geography does not complete the data-flow diagram
A supplier describing UK storage has answered a location question about specified storage. The next questions are whether processing occurs elsewhere, whether another organisation receives information, whether support access crosses borders and which contracts govern those activities. These are questions to establish, not assumptions that overseas processing is occurring.
For a proposed NHS workflow, ask the information-governance lead to distinguish data location from the roles and purposes of each party. An approved diagram should show where content moves and which controls apply at each step. A photograph of a UK data centre would not answer that question, and neither would a broad claim of global compliance.
The NHS England guidance for ambient-scribing IG professionals, checked on 10 October 2026, provides a relevant deployment framework for that specific category. The same habit of asking precise questions is useful elsewhere, but the scribe guidance should not be treated as automatic permission for an unrelated service.
A fictional privacy review that discovers the real question
Imagine a practice considering an assistant for summarising correspondence. The initial assurance is that patient content is not used for model training. During assessment, the practice asks whether a rejected upload remains in a troubleshooting log and whether support staff can access it.
There are several potentially acceptable designs: rejection before transfer, limited technical logging without content, or justified temporary retention within agreed controls. The point of the exercise is to discover which design actually exists. It would be misleading to infer either a breach or complete protection from the original slogan alone.
The practice should also ask what happens when a patient challenges an inaccurate output. Deletion, correction and preservation for an active investigation may require different actions. The operational policy should explain that distinction rather than instructing staff to erase everything whenever a problem is reported.
Apply the same questions to iatroX
This article is published by iatroX and applies the same scrutiny to its own services. The iatroX privacy policy, checked on 10 October 2026, describes usage logs including queries and processing of necessary prompt or transcript content by AI service providers. It should therefore not be described as entirely local, zero-retention or free of external processing.
The policy also warns against real patient-identifiable information in clinical simulations. A fictional learning case is appropriate for an educational exercise; copying a recognisable patient narrative into a simulation is not justified by calling it revision. These are product and policy descriptions, not an independent security audit.
For a general clinical-learning question, remove unnecessary personal context rather than merely deleting a name. If individual patient information is required for a clinical workflow, use the organisation's approved systems and process. The ICO's lawfulness guidance for AI provides a separate reminder that purpose and lawful processing need explicit consideration.
What a useful answer from a supplier looks like
The useful answer names the data, purpose, recipient, location, access controls and retention approach, and makes clear which terms govern the proposed use. It explains what changes when a new feature or provider is introduced. It also identifies whom the organisation can contact when a real operational question arises.
A no-training commitment remains valuable. The error is to make it carry meanings it does not contain. Privacy confidence should come from understanding the whole processing arrangement, not from repeating a sentence whose scope nobody has examined.
Frequently asked questions
Does a no-training policy mean a healthcare AI tool never stores my input?
No. Training restrictions and retention arrangements are different matters; the relevant policy and contract should explain both.
Does UK hosting mean information never leaves the UK?
Not necessarily. Establish the locations and organisations involved in processing, support and any onward transfer rather than inferring them from a storage claim.
Can identifiable patient information be used in iatroX Simulations?
No: iatroX's privacy policy, checked on 10 October 2026, specifically warns against real patient-identifiable information in simulations. Use fictional educational material instead.
Explore a general clinical-learning question with Ask-iatroX →