What Changed

DeepSeek’s privacy policy (last updated January 2025, still in effect as of March 2026) explicitly states that all user data — including prompts, conversations, and uploaded content — is stored on servers in the People’s Republic of China. This data is subject to Chinese national security and data access laws, which can compel disclosure to government entities without user notification.

Why This Matters for SLPs

Even if you de-identify clinical content before entering it into DeepSeek, the data residency issue creates legal and ethical risks that de-identification alone does not resolve:

• HIPAA jurisdiction. HIPAA’s protections apply to U.S.-based entities and their business associates. Data stored in China falls outside this framework entirely. No BAA is available or meaningful.
• FERPA implications. School-based SLPs handling student educational records should be aware that FERPA’s protections similarly do not extend to foreign data storage.
• Re-identification risk. Even de-identified clinical data may be re-identifiable when combined with other data sources. Data stored in a jurisdiction without equivalent privacy protections increases this risk.
• Employer liability. If your district, hospital, or practice has policies restricting data transfer to foreign servers, using DeepSeek for any work-related content may violate those policies regardless of de-identification.

What to Do

• Do not use DeepSeek for clinical documentation, even with de-identified content.
• If you use DeepSeek for personal learning (e.g., studying for Praxis, exploring clinical concepts), do not enter any content derived from real cases.
• Check your employer’s acceptable use policy for AI tools. Many healthcare systems and school districts have explicit prohibitions on foreign-hosted AI services.

Context

DeepSeek offers competitive model performance at lower cost, which has driven adoption. The privacy concern is not about the model’s clinical accuracy — it’s about where your data goes after you type it. This is a data residency issue, not a model quality issue.

Sources

• DeepSeek Privacy Policy (states data is stored in the People’s Republic of China)
• Proton: Why your privacy is at stake with DeepSeek
• Security Magazine: Dangers of DeepSeek’s privacy policy