Your privacy policy was true when you wrote it

You've seen the privacy policy box in Splose. It goes on your forms, it links to a page on your website, and once a client has ticked it the privacy side feels handled.

I'm not a lawyer, and this isn't advice on what your policy should say. It's a prompt to step back and look at how a client moves through your clinic.

There are three things worth checking: whether you've told the client before a tool touches their information, whether your privacy policy still describes what actually happens, and whether your team knows the rules.

I'm writing this because I recently walked through those three questions with a clinic that had done everything right on paper, and the answers still surprised them.

Are you telling people early enough?

The document can be perfectly good and still arrive after the thing it describes has already happened.

Here's what intake looked like at that clinic. Someone sends an enquiry through the website. The clinic rings them for a ten-minute intake call to check they're the right fit. That call goes through the phone system, which transcribes it.

Then a billing and privacy consent form goes out, followed by an initial appointment. After that comes a service agreement, tailored to what the clinician saw in the session. That service agreement was where the clinic explained that it used AI to help with notes and documentation in Splose.

Count back. By the time the family read that sentence, their call had already been transcribed and a session note had been drafted with AI.

It had been disclosed. Three steps too late.

The phone calls revealed another gap. They weren't recorded, the transcripts were deleted after three days, and neither of those things was said anywhere. It took drawing the steps out on a page to see it.

Nobody was hiding anything. The tools had arrived one at a time, and the paperwork was written before most of them existed.

Try it with your own clinic. Draw the journey from first contact through to first session. Mark every point where a call is transcribed, a session is recorded, or AI touches a note. Beside each mark, write down where the client was told.

If the telling happens after the tool has already entered the process, that's the gap.

A few that come up often:

• Telehealth sessions recorded for notes, with no question asked at the start of the call. Splose reminds you to ask. Plenty of clinics still don't.
• A phone system that transcribes calls or voicemails. There's no "this call is recorded" announcement because technically it isn't recorded, but there's still a written record sitting somewhere.
• Splose AI switched on, and the first note it helps write is for a client who has only ever seen the website policy.

The consent part is simpler than people make it. "Are you okay for this call to be recorded so I can focus on our conversation?" If yes, thanks, carry on. If no, no worries, I'll take some notes, and stop the recording. You've said what you're doing and why. Consent rules on recording differ by state, so check yours.

Is your privacy policy still true?

What Splose does with AI today isn't necessarily what it did six months ago. That's not a criticism of Splose, it's the whole industry. AI is being added to platforms clinics already use, and every new feature has the potential to change what happens to the information you're responsible for.

So a policy written last year may describe last year's tools.

Two things are worth checking when you review it.

Offshore processing. Where a company is based doesn't necessarily tell you where your information goes. A product can be Australian while some of the infrastructure or services behind it are overseas.

You don't need to become an expert in how every platform is built. You do need to understand what is actually happening to client information.

Ask each platform

1. Where is the information processed?
2. Where is it stored?
3. How long is it retained?

Then check that what your privacy policy says matches the answers.

The tools you've since adopted. For me this meant Plaud. I like it and I've written about it before. For a long time you couldn't get a data processing agreement from them without an enterprise plan, so it couldn't go on an approved list, and I used it for local recordings only, uploading to Splose myself.

That's since changed and they now offer one. Things move in both directions, which is the point. A review picks that up. An assumption doesn't.

Does your team know the rules?

So far, this has been about what the client knows. There's another side to it: what your team knows.

This matters even if you haven't switched Splose AI on.

If there's no written AI policy and you haven't told your team what they may and may not put where, don't assume nothing is happening. Assume someone is tidying up a report in ChatGPT on their own account and that some client information went in with it.

Not maliciously. They just haven't thought it through, because nobody has asked them to.

A useful internal policy can be short. Why it exists. Which tools are approved. What each one can be used for. What information can and can't go into them. What protections are in place.

It should also answer the practical question the consent script raises: if a client says no to recording or AI, does the clinician know what happens next?

If consumer AI tools are being used at all, turning off model training in the account settings is one basic safeguard. But that isn't the policy.

Decide as a business which tools are approved, what they're approved for, and put it in writing.

And if you're a clinician working somewhere that hasn't done any of this, don't assume that makes it someone else's problem. If something doesn't sit right, ask.

Block out a Monday

None of this is the exciting part of running a clinic. But "I didn't realise the tool did that" gets harder to rely on as these tools become part of everyday work.

The fix doesn't need to become a project. Block out a few hours.

1. Draw the client journey, from first contact to first session.
2. Mark where transcription, recording or AI enters. Check the client is told before each one.
3. Reread the privacy policy against the tools you actually use today.
4. Write the internal AI policy, even if you're a solo clinician. Approved tools, what they're for, and what can go into them.
5. Give the team a script for asking, and a plan for what happens when someone says no.

Then put a date in the diary to do it again, because the tools will have moved by then.