AI Note Taker Privacy: Audio Retention, Model Training and HIPAA

Separate capture from storage. Ask whether the service saves audio, video, transcript and summary as different objects. Ask which of those can be deleted, and when. Ask whether customer content is used to train the vendor’s own models or a provider’s models; those are different claims. Ask where consent notices appear. Finally, if protected health information is involved, ask which plan and contract includes a signed business associate agreement (BAA). A HIPAA badge alone cannot answer the contract question.

The table summarizes first-party vendor statements available October 12, 2026. “Not stated here” is not a claim that a feature is absent. For training, see Granola’s help page, Fathom’s privacy policy, Fireflies’ privacy policy, Otter’s privacy policy and Read AI’s help page, all as of October 2026. Check Granola AI security, its deletion guide and plans; Fathom’s team statement, BAA guide and plans; Fireflies security and its desktop guide; Otter privacy and plans; and Read AI privacy and plans for the exact agreement and settings.

In re Otter.AI Privacy Litigation, No. 5:25-cv-06911-EKL (N.D. Cal.), is a putative class action. The first case, Brewer v. Otter.ai, was filed on 15 August 2025; it and three similar suits were consolidated on 22 October 2025, and a consolidated complaint was filed on 5 December 2025. As the court summarized them, the plaintiffs allege that Otter's meeting assistant records conversations without the consent of all participants and retains them "for its own commercial use, including to train its automatic speech recognition and machine-learning models." On 13 August 2026 the court granted Otter's motion to dismiss in part: some claims were dismissed, while claims under the federal wiretap law (ECPA), the California Invasion of Privacy Act (§631) and the Illinois Biometric Information Privacy Act (BIPA) may proceed. That is a pleading-stage ruling, not a finding on the merits. Otter answered the amended complaint on 17 September 2026. No class has been certified, and no court has found Otter liable. Per its privacy policy as of October 2026, Otter lists training on de-identified audio recordings and transcriptions.

Since December 2025, putative class actions under the Illinois Biometric Information Privacy Act (BIPA) have alleged that Fireflies.ai's speaker-recognition feature creates voiceprints of meeting participants without the written notice and consent BIPA requires. The first, Cruz v. Fireflies.AI Corp., No. 3:25-cv-03399 (C.D. Ill.), filed on 18 December 2025, was voluntarily dismissed by the plaintiff on 11 March 2026. Fricker v. Fireflies.AI Corp., No. 1:26-cv-02675 (N.D. Ill.), filed on 10 March 2026, was consolidated on 4 June 2026 with Martinez v. Fireflies.AI Corp., No. 1:26-cv-03512 (N.D. Ill.), filed on 30 March 2026. Fireflies moved to dismiss on 15 July 2026; briefing closed on 26 August 2026, and as of 12 October 2026 there is no ruling. A related California case, Parrinello v. Fireflies.AI Corp., No. 3:26-cv-02479 (N.D. Cal.), filed on 23 March 2026, was stayed on 24 April 2026 pending that ruling. The publicly available complaints concern voiceprints, not AI training. No court has found Fireflies liable. Per its privacy policy as of October 2026, Fireflies says it does not use personal information for AI model training.

Chamberlain v. Granola, Inc., No. 3:26-cv-07926-EMC (N.D. Cal.), is a putative class action filed on 30 July 2026. It alleges that Granola's bot-free note taker records other meeting participants without notifying them, in violation of the California Invasion of Privacy Act and federal wiretap law, and that transcripts are used to train AI models by default. On 6 October 2026 the plaintiff filed a stipulation to file a first amended complaint. No motion to dismiss has been decided, and no court has found Granola liable. Per its model-training help page as of October 2026, Granola may use anonymized data by default outside Enterprise workspaces and offers an opt-out.

Platform tools face similar allegations. Basich v. Microsoft Corp., No. 2:26-cv-00422 (W.D. Wash.), a putative class action filed on 5 February 2026, alleges that speaker identification in Microsoft Teams live transcription creates voiceprints in violation of BIPA; as of 12 October 2026, motions to dismiss and to compel arbitration are pending. Sheldon v. Zoom Communications, Inc., No. 3:26-cv-10962 (N.D. Cal.), a putative class action filed on 25 September 2026, alleges that Zoom's AI Companion creates voiceprints in violation of BIPA; the case is at an early stage. No court has found either company liable.

Chapman University prohibited Read AI in August 2025, citing security, privacy and institutional data risks. Cornell blocks Read.ai and Fireflies.ai bots on its Zoom meetings by default.

Case statuses are as of 12 October 2026 and can change; follow the docket links for the latest. Allegations in a complaint are not findings of fact.

• Does it train on your content by default, and can you opt out?
• Does it build voiceprints?
• Who is told a recording is happening?
• Where is audio stored, and for how long?

Pantheon’s recorder joins no meeting as a bot. The person recording confirms they have consent before each recording. Pantheon does not notify the other participants; the recorder is responsible for telling them. Pantheon’s privacy policy says it does not use the contents of your messages, conversations or communications to train machine-learning models, and that its agreements with AI providers prohibit them from retaining or training on your data. Transcription runs on Pantheon’s own servers, with optional on-device transcription on Apple-silicon Macs. Where a question is not answered here, ask us.

No. A recorder can capture locally and then send audio to a transcription service. Granola AI says its desktop audio is not stored; Fireflies says its desktop bot-free mode does not save audio or video files. Other products have different modes and retention controls. Ask separately where transcription runs and what happens to the transcript and summary. Learn how bot-free capture works.

If a meeting can include protected health information, a vendor’s general HIPAA statement is only a starting point. Confirm whether the specific plan is eligible, whether the vendor will sign a BAA, which features and subprocessors are covered, and how your organization configures access and retention. Fathom says a BAA is available; Granola AI lists HIPAA-compliant workspaces on Enterprise; Otter lists HIPAA as an Enterprise add-on. Do not infer plan coverage where a vendor has not specified it.

Pantheon’s invite-only meeting alpha runs transcription on its own servers and offers optional on-device transcription on Apple-silicon Macs. The local audio buffer is encrypted. Summaries are generated by a separate AI model provider. These facts do not establish an audio-deletion schedule or HIPAA suitability.