Gemini / Google Workspace: which plan do I need for patient data?
Short answer
Plans with a BAA: Gemini in Google Workspace: Workspace Business / Enterprise (work account).
No BAA: Gemini in Google Workspace: Gemini Notebook (formerly NotebookLM) in Workspace.
Not confirmed: Gemini app (personal Google account): Free / Google AI Pro / Ultra (personal).
Only a plan with a signed BAA should be used with PHI. Staff on other plans, including personal accounts, shouldn't enter patient data.
| Plan | BAA? | How you get the BAA | Trains on your data? | Retention | Fine print |
|---|---|---|---|---|---|
| Gemini app (personal Google account): Free / Google AI Pro / Ultra (personal) | Unverified | Unverified | Yes when Keep Activity is onyes when Keep Activity is on[source] | Auto-delete default 18 months (3/36/never); 72 hours with Keep Activity off; reviewed chats up to 3 years[source] | Unverified |
| Gemini in Google Workspace: Workspace Business / Enterprise (work account) | Yesyes (admin accepts BAA in Admin console; Gemini is in HIPAA Included Functionality)[source] | Yesyes (admin accepts in Admin console)[source] | Nono[source] | Admin sets 90 days to indefinite[source] | Third-party add-ons are not covered; Gemini Notebook is excluded.[source] |
| Gemini in Google Workspace: Gemini Notebook (formerly NotebookLM) in Workspace | Nono[source] | n/a | Unverified | Prompts/responses not retained after session[source] | Explicitly 'not covered by the Google Business Associate Agreement'.[source] |
Full detail and certifications: Gemini app (personal Google account), Gemini in Google Workspace. Checked 2026-10-16.
Not legal advice. From the vendor's own pages on the date shown. Confirm the current terms with the vendor.