The privacy issue can begin before a finished clinical record
It is easy to think of sensitive information as the formal note in the chart. A health service can learn a great deal earlier: who sought help, what they disclosed during intake, and which details accompanied their request. That information deserves attention even when it is not a finished treatment record.
For an AI scribe, the comparable question is what arrives before the note. The recording and transcript can reveal far more than the short summary the clinician eventually files. Evaluating only the final-note policy overlooks the material used to produce it.
What the FTC case actually concerned
In the FTC BetterHelp case, the FTC alleged that BetterHelp shared sensitive health information with advertising companies despite privacy promises. The complaint describes email addresses, IP addresses, and certain intake-questionnaire responses. The 2023 final order restricted sharing for advertising and required $7.8 million for consumer redress.
This was an advertising-disclosure case, not evidence that therapy recordings from AI scribes were breached. Its relevance is more specific: information a company receives can be exposed through its business decisions as well as through an outside attack.
Read a privacy promise as a description of particular actions
For a note-taking service, ask what the promise actually covers. A ban on training models does not necessarily prohibit storing transcripts. Encryption does not mean the service never receives the conversation. Deleting a finished note may be different from deleting the source recording or backups.
A useful vendor answer names the information and the action. For example, it should distinguish uploading audio for transcription, sending a transcript elsewhere to write the note, storing the result, and using any of that material for a separate purpose. A single reassuring adjective cannot describe all of those decisions.
You can use those distinctions to compare providers without treating every online service as identical. They also reveal a simpler option: remove the clinical upload altogether.
Use AI without creating another company-held conversation
Astralcyte makes transcripts and note drafts on your device. The privacy policy explains that the app does not send session audio, transcripts, or notes to the company. An incident involving its servers cannot disclose clinical conversations that were never there.
You can still choose a familiar note format, edit the draft, and copy it into your existing patient record. The record system receives the note you choose to file. Astralcyte does not receive the fuller conversation merely because its software helped write that note.
That makes confidentiality a property of where the work happens, rather than an additional promise about how a provider will use a patient account after receiving it.