Do AI therapy scribes train their models on my session data?

Under a BAA, using PHI for model training would generally require explicit customer consent. The mainstream therapy-first scribes make no-training-on-customer-data an explicit default and document it on their trust pages.

The failure modes to watch: (1) vendors that reserve the right to use "de-identified" data for training — de-identification of clinical narrative is famously imperfect; (2) vendors that opt you in by default and require a manual opt-out; (3) sub-processors (transcription providers) that have separate training clauses.

Ask for the vendor's data-processing addendum, not just the trust page. The DPA is the enforceable document.