Last reviewed
The short answer. Gemini can be safe for approved work on a Google Workspace account, where Google states customer data is not used for training without permission. In a personal Gemini account, activity can train Google’s models and some chats are read by human reviewers. The Gemini API depends on whether the service is paid.
Pick the account before the tool. The guide to stopping data leaking into AI covers what stays out of every account, and the guide to AI and HIPAA covers health information.
What Gemini can access and collect
In Gemini Apps, Google’s privacy notice covers what a person says to Gemini, uploaded files, Gemini Live recordings and transcripts, generated content, app, browser, and device data, location information, and subscription information (Gemini Apps privacy notice).
In Google Workspace, Google states that Gemini retrieves only content the user can already access. Administrators can turn Gemini features off per service, and Information Rights Management and client-side encryption can further limit what Gemini reaches (Workspace privacy hub). As with any assistant that reads shared drives, broad sharing inside the company becomes broad access for Gemini.
Data handling by account type
Gemini Apps, personal Google account. As of 2026-10-10, with Keep Activity on, Google uses activity to “provide, develop, and improve its services (including training generative AI models).” A subset of chats is reviewed by human reviewers. Reviewed chats are kept for up to three years and disconnected from the account before they go to service providers. Activity is auto-deleted after 18 months by default, and the setting can be 3 months, 36 months, or off. With Keep Activity off, chats stay with the account for 72 hours so Gemini can respond and the service can be protected, and they are not used to train models (Gemini Apps privacy notice). Google notes that use with a work or school account may be subject to different terms.
Gemini in Google Workspace. Google states that “Workspace does not use customer data for training models without customer’s prior permission or instruction,” and that Gemini app chats and uploads are not reviewed by human reviewers. Prompts and responses in Gemini in Workspace are retained from 90 days to indefinitely as administrators decide. In the Gemini app they are retained for up to 36 months as administrators decide, with 18 months as the default (Workspace privacy hub).
Gemini API. Google’s terms separate paid and unpaid services. For unpaid services, Google uses submitted content to improve its products, human reviewers may read inputs and outputs, and Google advises against submitting sensitive, confidential, or personal information. For paid services, Google states it does not use prompts or responses to improve its products. It logs prompts and responses for a limited period solely to detect violations of its Prohibited Use Policy, and the data may be stored transiently or cached in any country where Google or its agents have facilities. Grounding with Google Search or Maps stores prompts and outputs for 30 days (Gemini API terms).
Where data is stored and processed
For Workspace, Google states that all processing occurs within Google’s secure infrastructure. The privacy hub does not describe regional processing options for Gemini, and it notes that an organization’s file sharing and data region settings do not apply to Gemini Notebook data (Workspace privacy hub). A company with a residency requirement should ask Google for the commitment in writing and not assume the Workspace region setting extends to every Gemini feature.
For the paid API, the terms permit transient storage or caching in any country where Google or its agents operate (Gemini API terms).
Safe setup for company work
- Use the company Workspace account. Record the account, owner, edition, and the Gemini features enabled for each service.
- Keep personal accounts out. A personal Gemini account with Keep Activity on follows the consumer terms above.
- Review sharing in Drive, Gmail, and Calendar, because Gemini reaches what each user can reach.
- Set retention for the Gemini app and Gemini in Workspace to match the records policy.
- Use paid API services for company data, and keep the unpaid tier for non-sensitive tests.
- Write the rule down. Add Gemini to the AI acceptable use policy, and read Is ChatGPT safe for work? to compare plan terms.
Frequently asked questions
Is Gemini safe to use?
For approved work, yes, on the right account. Google states that Workspace does not use customer data to train models without the customer’s prior permission or instruction. Consumer Gemini Apps follow different terms: with Keep Activity on, Google can use activity to train generative AI models, and some chats are read by human reviewers.
Does Gemini train on my chats?
In Gemini Apps with a personal account, activity can be used to provide, develop, and improve Google services, including training generative AI models, while Keep Activity is on. With a Workspace account, Google states that customer data is not used for training without prior permission or instruction. The Gemini API depends on whether the service is paid or unpaid.
Do humans read Gemini chats?
In Gemini Apps, Google states that a subset of chats is reviewed by human reviewers and that reviewed chats are kept for up to three years, disconnected from the account. For Gemini in Google Workspace, Google states that Gemini app chats and uploads are not reviewed by human reviewers. For the unpaid Gemini API, human reviewers may read inputs and outputs.
How long does Gemini keep my data?
Gemini Apps activity is auto-deleted after 18 months by default, and the setting can be 3 months, 36 months, or off. With Keep Activity off, chats are kept for 72 hours. In Workspace, administrators set retention, with a default of 18 months for the Gemini app.
Is Gemini HIPAA compliant?
That depends on the agreement, the product, and the configuration, not the model name. The guide to AI and HIPAA lists what to verify for Gemini, Copilot, ChatGPT, and Claude before health information goes into any of them.
Next
Keep going
Sources
All read on 2026-10-10.