Your child's health data and AI: what to remove before you ask

What happens when you paste your child's health info into a chatbot

When you type "my son Sipho, 2, at Little Stars crèche in Soweto, has had a 39 degree fever since last night", that sentence leaves your phone and lands on the chatbot company's servers. What happens next depends on that company's rules and on your settings.

Three things worth knowing:

• It may be stored. Chats usually sit in your account history. Google, for example, says Gemini activity is auto-deleted after 18 months by default, and that even with activity switched off, chats are kept for 72 hours.
• People may read it. Google says a subset of chats is reviewed by human reviewers (disconnected from your account), and that reviewed chats are kept for up to three years. Google itself asks users not to enter confidential information they wouldn't want a reviewer to see.
• It may be used for training. This depends on the service and the setting. In Gemini, with activity on, chats can be used to improve Google's services, including training AI models. In Anthropic's Claude, consumer chats are only used for training if you switch on "Model Improvement" (or if a chat is flagged for safety review, or you give thumbs-up/down feedback).

None of this means you shouldn't use AI. It means you should give it what it needs to answer, and nothing more.

What to remove before you ask AI

To explain what a 39 °C fever means in a two-year-old, the AI needs the age and the symptoms. Everything else just identifies your child.

Remove	Write this instead
Your child's name and surname	"my daughter", "an 18-month-old boy"
ID number, medical aid number, hospital folder number	Nothing. The AI doesn't need it.
Full date of birth	The age: "3 years", "7 months"
School, crèche, suburb, street address	Only what matters for health: "we've just been to a malaria area"
Names of the doctor, clinic or relatives	"the nurse", "her granny"
Phone numbers and email	Nothing.

Photos: the biggest leak

A photo of a rash can help describe it. But a photo shows far more than the rash.

• Photograph only the affected area, close up. No face, no school uniform, no recognisable background.
• Don't upload photos of the Road to Health Book, scripts or lab results with the name showing. If you need help with one word on a script, type the word instead of sending the photo. If you really must send it, cover the name, folder number and date of birth first.
• Never send photos of an undressed child to a chatbot. Show them to the nurse or doctor in person.

Which chatbot settings to check

Names vary between services and change with updates. Look under "privacy" or "data controls" for three things:

1. Model training. An option along the lines of "improve the model" or "use my chats for training". Switch it off for health conversations.
2. History or activity. How long chats are kept and how to delete them. In Gemini it's called "Keep Activity", and you can set auto-delete to 3, 18 or 36 months.
3. Temporary or incognito chats. Many services have a mode that stays out of your history. Claude's incognito chats are never used to improve the model; Gemini's temporary chats aren't reviewed by people to improve its AI, but they're still kept for 72 hours.

Remember: deleting your history doesn't delete everything. Google warns that chats already reviewed by people are kept for up to three years even if you delete them from your account.

Questions to ask any health app that uses AI

An app built to hold your family's health records should answer these clearly before it asks for your child's details:

1. Does it ask for my consent? Per child, and can I withdraw it later?
2. Who is the AI provider? Does the app run its own model or send data to another company? Which one?
3. What is removed before data leaves? The name? Phone numbers? What goes as-is? Be wary of "fully anonymous" claims that don't explain how.
4. Can I delete everything? The child's records, the chats, the account.
5. Can I export my data? To keep a copy or show another clinician.
6. Who else sees it? If I share with a doctor, can I choose what they see and for how long?

An example of honest answers: in Iasora, HealthAI answers questions about this child's record and only works once you've given consent for that child, which you can withdraw. Before the record goes to the AI provider (Anthropic or OpenAI), the child's name becomes "the patient" and the guardian's becomes "the guardian", even inside clinician notes; phone numbers, emails, the date of birth and the health card number never leave (the age goes instead). But it is not anonymous: the dates things happened and the rest of the record go as they are, and a photo of a document you ask it to read goes whole. HealthAI says which fact is missing, tells you to seek care when something sounds urgent, is not a medical device and does not diagnose.

What POPIA says about children's health data

South Africa's Protection of Personal Information Act (POPIA, Act 4 of 2013) is stricter about exactly this kind of data:

• Health information is "special personal information". Section 26 says a responsible party may not process information about a person's health, except under the conditions in section 27.
• Children's information has its own protection. Processing a child's personal information is generally prohibited. Section 35 lists the exceptions, the first being the prior consent of a competent person, usually the parent or legal guardian.

POPIA binds the companies and organisations that process the data (the "responsible parties"), not you as a parent typing at home. So an app or clinic handling your child's records in South Africa needs a lawful basis, and in practice that often means your consent. If you think an organisation has mishandled your child's information, the Information Regulator oversees POPIA. Its enquiries line is 010 023 5200 (toll-free 0800 017 160), and its website has a complaints section.

Keep in mind that many chatbots are run by overseas companies under their own terms. Your strongest protection is still the one you control: what you type, what you photograph and which settings you choose.

What WHO and UNICEF say

In 2021 WHO published six principles for AI in health. The first, protecting human autonomy, says privacy and confidentiality should be protected and patients must give valid informed consent. For a child, that consent comes from the parent or guardian.

UNICEF's Guidance on AI and children (version 3.0, December 2025) lists "protect children's data and privacy" among the requirements for child-centred AI. A child today will grow up with whatever someone wrote about them.

AI doesn't replace the clinic

Protecting the data is half the job. The other half is knowing when to stop typing and go. If your child has a danger sign, don't wait on a chatbot: see danger signs and when to go to hospital.

For everyday use, read how to ask AI about your child's health and when not to trust AI with symptoms.