Foundations · Chapter 10 of 11
Handling personal data
Personal data and AI don't mix without care. Learn the rules around PII, patient data, and sensitive information in our work.
If the AI comes to the data — names can stay. If you take data to the AI — scrub the names first.
If a tool is built into your secure environment and the data never leaves it, automated features are usually fine. If you are uploading or pasting content into a tool, remove personal details before you do.
What counts as PII?
Any data that could identify a specific person. The obvious: names, emails, phone numbers, dates of birth. The less obvious: a job title combined with a company name, social media handles, health information, and location data.
If someone could work out who the person is from the text, treat it as PII.
Scrubbing data takes 2 minutes
Never upload — even after scrubbing:
- ✕Government IDs, passports, driver's licences
- ✕Passwords or login credentials
- ✕Banking or credit card details
- ✕Medical records tied to individuals
- ✕Raw HR files (salary, performance, disciplinary)
- ✕Anything involving ongoing legal disputes
- ✕Personal conversations about sensitive life events