Privacy When You Ask an AI About Your Health
A health question typed into an AI assistant is data. Depending on the service, that data may be used to train future models, retained in your conversation history, accessible to human reviewers for quality control, or all three. Understanding what you are handing over — and to whom — is a specific consideration for anyone asking AI a health question, particularly one that identifies you or a family member specifically.
What actually happens to your query
The details vary by provider, but the general pattern for consumer AI chat products:
- The query is sent to the provider's servers for processing.
- It may be stored in your conversation history for you to reference later.
- It may be reviewed by human quality-assurance staff — usually anonymised, sometimes not.
- It may be used, in aggregated form, to train future models.
- It is subject to the provider's data policies, which vary between free and paid tiers.
None of this is inherently problematic. All of it is worth knowing when the query includes your medical information.
What NOT to include in an AI health query
- Information: Full name · Why it is risky to share: Ties the query to you specifically
- Information: Date of birth or age + address · Why it is risky to share: Combined, uniquely identifying
- Information: Aadhaar or other ID numbers · Why it is risky to share: Never share these with any AI
- Information: Specific medical record numbers · Why it is risky to share: Traceable back to specific records at hospitals
- Information: Insurance policy numbers · Why it is risky to share: Financial + medical linkage
- Information: Photos of yourself or family (in most cases) · Why it is risky to share: Facial recognition + medical context is very sensitive
How to ask health questions without giving up privacy
The good news: most useful health questions do not need identifying information to get useful answers.
- Instead of 'my father Rajesh in Mumbai has type 2 diabetes...', ask 'a 68-year-old man with type 2 diabetes...'.
- Round approximate values. 'HbA1c around 7.5' rather than the exact number tied to a specific report.
- Skip the report photograph if it has the patient name visible. Retype the values you want interpreted.
- Do not upload documents that identify you specifically.
The specific case for health-record apps with AI features
A health record app that includes an AI assistant is a different case. Here, the AI is working on your identifiable data by design — that is the point of the feature. The relevant privacy question shifts from 'should I share this?' to 'how does this app handle my data?'. Reasonable expectations:
- The AI queries should not be sent to third-party providers with your full identity.
- The provider should have a specific privacy policy for the AI features, not the generic app policy.
- Human review of AI conversations should be minimised, and any review should be by staff bound by health data confidentiality.
- Under India's DPDP framework, health data has heightened protections that should apply to AI usage as well.
What good app design does here
Two specific design patterns that reduce risk:
- Run the AI inference on a provider that offers a zero-retention API tier for health data. Queries are processed and forgotten.
- Anonymise queries at the app layer before sending. The AI sees 'a 68-year-old with HbA1c 7.5'; not 'Aditya's father, HbA1c 7.5 on 2025-08-15'.
The one-line rule
For consumer AI chat products, treat every health query as if it might be reviewed by a stranger — because occasionally it is. If you would not put the specific detail on a postcard, do not put it in the query. The generality that works for consumer AI still gives you useful answers; the specific identification does not add value and adds risk.
References
Free for 90 days, no card needed. After that, keeping the record costs ₹349 for the year.
General information, not medical advice. Always talk to a qualified doctor about your own care. Where this and your doctor disagree, your doctor is right.