AI tools and client data
Is Pearl safe for client data?
Short answer: Whether Pearl is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself. On Single practices and on DSOs and multi-location groups, Pearl may use the radiographs you upload to train its models unless somebody turns that off. Every fact on this page is Pearl's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap. Obsidian Ridge's free 30-day AI security assessment shows which AI tools your staff actually use.
See which AI tools your staff usePlan by plan, in Pearl’s own words
FDA-cleared AI that reads dental radiographs and flags disease, plus charting, claims and notes tools around it. The input is a patient's x-rays, which is about as identifiable as clinical data gets.
| What you are asking | Single practices | DSOs and multi-location groups |
|---|---|---|
| Trains the vendor's models by default | On by default. Pearl frames it as something a practice opts out of, which means nobody has opted out until somebody does.“Practices retain full control over their data — including the ability to opt out of model training…” source, read | On by default. Pearl frames it as something a practice opts out of, which means nobody has opted out until somebody does.“Practices retain full control over their data — including the ability to opt out of model training…” source, read |
| How to turn training off | There is a switch, and it is the practice's to throw. Pearl does not say where it lives, so ask.“including the ability to opt out of model training, request full deletion on termination…” source, read | There is a switch, and it is the practice's to throw. Pearl does not say where it lives, so ask.“including the ability to opt out of model training, request full deletion on termination…” source, read |
| How long data is kept | Pearl publishes no period. What it publishes is that you can ask for everything to go when you leave.“request full deletion on termination…” source, read | Pearl publishes no period. What it publishes is that you can ask for everything to go when you leave.“request full deletion on termination…” source, read |
| What an admin can see or control | Not found in the pages we read. | Audit logs and enforced multi-factor, listed for groups. The page written for single practices does not mention either.“with selectable US or EU data jurisdictions, SSO/MFA enforcement, comprehensive audit logs…” source, read |
| Single sign-on | Not found in the pages we read. | Single sign-on appears on the groups page, with enforcement, and nowhere on the single-practice page.“SSO/MFA enforcement, comprehensive audit logs, and dedicated BAA and SOC 2 documentation.” source, read |
| Business Associate Agreement | Not found in the pages we read. | Pearl lists a dedicated BAA as documentation for groups. We did not find a BAA statement on the page written for single practices, so a one-location practice has to ask for the same thing by name.“…comprehensive audit logs, and dedicated BAA and SOC 2 documentation.” source, read |
| Where the data is processed | You choose the region. Pearl publishes US or EU storage as a configuration rather than a default.“with configurable US or EU data storage for regional compliance.” source, read | Selectable US or EU, same as for a single practice.“with selectable US or EU data jurisdictions, SSO/MFA enforcement, comprehensive audit logs…” source, read |
An empty cell is not a reassurance and not a criticism. "Not found in the pages we read." means the Pearl pages listed under Sources, read on the dates shown, do not answer it — so there is nothing for us to repeat, and something for you to ask Pearl before client information goes near it.
What this means for
The duty does not change because the tool is new. What changes is where the client information ends up.
- Law firms. A client confidence pasted into a personal account has left the firm’s control. Our law firm page sets out the duties we build evidence for; the decision here is whether a personal account may touch a client matter at all.
- Dental and medical practices. Pearl publishes a BAA position for this product on DSOs and multi-location groups, which is where that conversation starts. See dental practices.
- CPA and accounting firms. Your written information security plan has to describe the tools people actually use, not the ones you approved. See accounting firms.
- Financial advisers. Client account data in a personal assistant is the exposure; see financial advisers.
- Software teams. A coding assistant reads the repository and can run commands, so the question is what it can reach, not what it was asked. See what AI agents on work laptops can reach.
How to tell which version your staff use
The plan is the whole answer, and you cannot tell from the outside. Three ways to find out, in order of how much they prove.
1. Ask
Quick, free, and incomplete. People forget the tool they installed once and the account they signed in with.
2. Look at the billing and the admin console
This finds what the business pays for. It does not find a personal account, which is the one that matters here.
3. Look on the computers
A tool somebody installed themselves never appears in an IT list. Obsidian Ridge’s free 30-day AI security assessment takes a quiet inventory for 30 days and shows what each tool could reach, then a CISSP goes through it with you. See the assessment, or read a sample set of findings.
Settings to check today
From Pearl’s own documentation. Each one is a change somebody can make this afternoon.
- Find the model-training opt-out and use it, or decide in writing that you are not going to. Pearl's own wording makes that a choice somebody has to make.“Practices retain full control over their data — including the ability to opt out of model training…” source, read
- Turn on the PHI toggle before any case presentation on a screen a patient or a visitor can see.“use the built-in PHI toggle to anonymize patient information during screen sharing or case presentations.” source, read
- Ask for the BAA and the SOC 2 report by name. Pearl says both exist as documents; a single practice is not told how to get them.“and dedicated BAA and SOC 2 documentation.” source, read
Questions we get asked
Is Pearl safe for client data?
Whether Pearl is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself.
On Single practices and on DSOs and multi-location groups, Pearl may use the radiographs you upload to train its models unless somebody turns that off.
Every fact on this page is Pearl's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap.
Does Pearl train its models on what we put into Pearl?
On Single practices and on DSOs and multi-location groups, Pearl may use the radiographs you upload to train its models unless somebody turns that off. On Single practices, DSOs and multi-location groups: On by default.
Pearl frames it as something a practice opts out of, which means nobody has opted out until somebody does.
Pearl's own words: "Practices retain full control over their data — including the ability to opt out of model training…" (read 2026-11-03).
How long does Pearl keep what we put into Pearl?
On Single practices, DSOs and multi-location groups: Pearl publishes no period. What it publishes is that you can ask for everything to go when you leave. Pearl's own words: "request full deletion on termination…" (read 2026-11-03).
Can an administrator read what we put into Pearl?
On Single practices: Not found in the pages we read. On DSOs and multi-location groups: Audit logs and enforced multi-factor, listed for groups. The page written for single practices does not mention either.
Pearl's own words: "with selectable US or EU data jurisdictions, SSO/MFA enforcement, comprehensive audit logs…" (read 2026-11-03).
Will Pearl sign a Business Associate Agreement for Pearl?
On DSOs and multi-location groups: Pearl lists a dedicated BAA as documentation for groups. We did not find a BAA statement on the page written for single practices, so a one-location practice has to ask for the same thing by name.
Pearl's own words: "…comprehensive audit logs, and dedicated BAA and SOC 2 documentation." (read 2026-11-03). A signed BAA is between your practice and Pearl; we do not sign it for you, and we do not read a compliance badge as one.
How do we find out which version of Pearl our staff are using?
Pearl sells this to practices rather than to individuals, so there is no personal account to find.
What decides the answers above is which plan your practice is on and what your own administrator has switched on, both of which are in your subscription and your admin console rather than on anybody's laptop.
Obsidian Ridge's free 30-day AI security assessment covers the tools nobody approved, which is the other half of the picture.
Sources
Pearl’s own pages, with the date each was read. Nothing on this page comes from anywhere else.
All 35 tools, side by side, or run the AI tool risk checker over the ones you know about.
Other tools people ask about
Same question, different answers. The ones in the same category are the ones staff swap between.
Is Overjet safe for client data?
Dental imaging · Overjet
Is ChatGPT safe for client data?
General assistant · OpenAI
Is Microsoft Copilot safe for client data?
General assistant · Microsoft