AI tools and client data
Is Overjet safe for client data?
Short answer: Whether Overjet is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself. On Providers (dentists, dental groups and DSOs) and on Payers (insurance companies and health plans), Overjet may use the radiographs you upload to train its models. Every fact on this page is Overjet's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap. Obsidian Ridge's free 30-day AI security assessment shows which AI tools your staff actually use.
See which AI tools your staff usePlan by plan, in Overjet’s own words
Dental AI that reads radiographs for disease and feeds charting, claims and insurance review. Overjet sells to practices and to insurers, and publishes its Business Associate Agreement on its own website — which is also where it says what it may do with de-identified patient images.
| What you are asking | Providers (dentists, dental groups and DSOs) | Payers (insurance companies and health plans) |
|---|---|---|
| Trains the vendor's models by default | Yes, on radiographs de-identified to HIPAA's standard at 45 C.F.R. 164.514(b), and the permission is in the Business Associate Agreement itself rather than a privacy page.“Overjet may de-identify PHI in accordance with the standards set forth in 45 C.F.R. § 164.514(b) … to train Overjet’s AI/ML algorithms” source, read | Yes, on radiographs de-identified to HIPAA's standard at 45 C.F.R. 164.514(b), and the permission is in the Business Associate Agreement itself rather than a privacy page.“Overjet may de-identify PHI in accordance with the standards set forth in 45 C.F.R. § 164.514(b) … to train Overjet’s AI/ML algorithms” source, read |
| How to turn training off | Not found in the pages we read. | Not found in the pages we read. |
| How long data is kept | Return or destruction on termination, with an exception below for copies Overjet keeps for its own administration.“upon termination of the MSA or this BAA for any reason, Overjet shall return or destroy all PHI received from Customer…” source, read | Return or destruction on termination, with an exception below for copies Overjet keeps for its own administration.“upon termination of the MSA or this BAA for any reason, Overjet shall return or destroy all PHI received from Customer…” source, read |
| What an admin can see or control | Not found in the pages we read. | Not found in the pages we read. |
| Single sign-on | Not found in the pages we read. | Not found in the pages we read. |
| Business Associate Agreement | Overjet publishes the Business Associate Agreement itself, as a document on its own site, which is where the training and retention lines above come from.“Overjet shall not use or disclose PHI other than as (i) permitted herein or the MSA, (ii) required to provide Covered Services to the Customer…” source, read | Overjet publishes the Business Associate Agreement itself, as a document on its own site, which is where the training and retention lines above come from.“Overjet shall not use or disclose PHI other than as (i) permitted herein or the MSA, (ii) required to provide Covered Services to the Customer…” source, read |
| Where the data is processed | Not found in the pages we read. | Not found in the pages we read. |
An empty cell is not a reassurance and not a criticism. "Not found in the pages we read." means the Overjet pages listed under Sources, read on the dates shown, do not answer it — so there is nothing for us to repeat, and something for you to ask Overjet before client information goes near it.
What this means for
The duty does not change because the tool is new. What changes is where the client information ends up.
- Law firms. A client confidence pasted into a personal account has left the firm’s control. Our law firm page sets out the duties we build evidence for; the decision here is whether a personal account may touch a client matter at all.
- Dental and medical practices. Overjet publishes a BAA position for this product on Providers (dentists, dental groups and DSOs), which is where that conversation starts. See dental practices.
- CPA and accounting firms. Your written information security plan has to describe the tools people actually use, not the ones you approved. See accounting firms.
- Financial advisers. Client account data in a personal assistant is the exposure; see financial advisers.
- Software teams. A coding assistant reads the repository and can run commands, so the question is what it can reach, not what it was asked. See what AI agents on work laptops can reach.
How to tell which version your staff use
The plan is the whole answer, and you cannot tell from the outside. Three ways to find out, in order of how much they prove.
1. Ask
Quick, free, and incomplete. People forget the tool they installed once and the account they signed in with.
2. Look at the billing and the admin console
This finds what the business pays for. It does not find a personal account, which is the one that matters here.
3. Look on the computers
A tool somebody installed themselves never appears in an IT list. Obsidian Ridge’s free 30-day AI security assessment takes a quiet inventory for 30 days and shows what each tool could reach, then a CISSP goes through it with you. See the assessment, or read a sample set of findings.
Settings to check today
From Overjet’s own documentation. Each one is a change somebody can make this afternoon.
- Read Overjet's own buyer's checklist and then apply it to Overjet. It is the clearest statement of what to ask for, written by the vendor you are asking.“end-to-end encryption, de-identified imagery, a signed Business Associate Agreement, and written confirmation that the vendor will not train its models on your patient data.” source, read
- Get the signed copy. The document on the website is a template, and a template is not an executed agreement.“Overjet shall not use or disclose PHI other than as (i) permitted herein or the MSA, (ii) required to provide Covered Services to the Customer…” source, read
- Ask which subcontractors handle your images. Overjet commits to binding them to the same terms, which means there are some.“Overjet shall enter into a written agreement with any agent or subcontractor that creates, receives, maintains, or transmits PHI on behalf of Overjet…” source, read
Worth knowing
- Overjet's buyer's guide tells a practice to require contract language barring training on patient data. Its own BAA permits training on images once they are de-identified to HIPAA's standard at 45 C.F.R. 164.514(b). Both are Overjet's own statements; ask Overjet whether a practice can opt out.“…a signed Business Associate Agreement, and contract language barring the vendor from training its models on your patient data.” source, read
- Termination does not clear everything. Overjet reserves copies for its own management, care coordination and legal records.“Overjet may maintain copies of PHI for the proper management and administration of Overjet, including care coordination and maintenance of legal records.” source, read
- And where returning or destroying is not feasible, Overjet keeps it under the agreement's protections instead, for as long as it holds it.“If it is infeasible for Overjet to return or destroy the PHI upon termination of the MSA or this BAA…” source, read
Questions we get asked
Is Overjet safe for client data?
Whether Overjet is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself.
On Providers (dentists, dental groups and DSOs) and on Payers (insurance companies and health plans), Overjet may use the radiographs you upload to train its models.
Every fact on this page is Overjet's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap.
Does Overjet train its models on what we put into Overjet?
On Providers (dentists, dental groups and DSOs) and on Payers (insurance companies and health plans), Overjet may use the radiographs you upload to train its models.
On Providers (dentists, dental groups and DSOs), Payers (insurance companies and health plans): Yes, on radiographs de-identified to HIPAA's standard at 45 C.F.R. 164.514(b), and the permission is in the Business Associate Agreement itself rather than a privacy page.
Overjet's own words: "Overjet may de-identify PHI in accordance with the standards set forth in 45 C.F.R. § 164.514(b) … to train Overjet’s AI/ML algorithms" (read 2026-11-03).
How long does Overjet keep what we put into Overjet?
On Providers (dentists, dental groups and DSOs), Payers (insurance companies and health plans): Return or destruction on termination, with an exception below for copies Overjet keeps for its own administration.
Overjet's own words: "upon termination of the MSA or this BAA for any reason, Overjet shall return or destroy all PHI received from Customer…" (read 2026-11-03).
Can an administrator read what we put into Overjet?
On Providers (dentists, dental groups and DSOs), Payers (insurance companies and health plans): Not found in the pages we read.
Will Overjet sign a Business Associate Agreement for Overjet?
On Providers (dentists, dental groups and DSOs): Overjet publishes the Business Associate Agreement itself, as a document on its own site, which is where the training and retention lines above come from.
Overjet's own words: "Overjet shall not use or disclose PHI other than as (i) permitted herein or the MSA, (ii) required to provide Covered Services to the Customer…" (read 2026-11-03).
A signed BAA is between your practice and Overjet; we do not sign it for you, and we do not read a compliance badge as one.
How do we find out which version of Overjet our staff are using?
Overjet sells this to practices rather than to individuals, so there is no personal account to find.
What decides the answers above is which plan your practice is on and what your own administrator has switched on, both of which are in your subscription and your admin console rather than on anybody's laptop.
Obsidian Ridge's free 30-day AI security assessment covers the tools nobody approved, which is the other half of the picture.
Sources
Overjet’s own pages, with the date each was read. Nothing on this page comes from anywhere else.
All 35 tools, side by side, or run the AI tool risk checker over the ones you know about.
Other tools people ask about
Same question, different answers. The ones in the same category are the ones staff swap between.
Is Jump safe for client data?
Meeting notetaker · Jump
Is Pearl safe for client data?
Dental imaging · Pearl
Is ChatGPT safe for client data?
General assistant · OpenAI