Privacy and ethics checklist
Before sending an unpublished manuscript or research data to AI
A file on your computer does not necessarily stay there when you send a model request. Check your authority to share it, the actual data flow and the terms of the specific product you use.
AcademicFix Editorial Team · · Türkçe
Who may share it?
Authors, coauthors, reviewers and data custodians have different roles.
Check it 02 / FlowWhat leaves the device?
A local interface is different from offline model processing.
Check it 03 / TermsWhich product's rules?
Training, retention and third-party access are separate questions.
Check itScope: This guide is for authors, researchers and reviewers considering AI use with unpublished work or research data. It does not decide legal permission, ethics approval or whether a provider is secure for a particular file. Current journal, institutional and data-agreement rules take priority. ICMJE is a primary publishing source for medical journals; it is not a single policy for every discipline.
2. Separate a local app from a local model
Providing your own API key or using a desktop app does not show that the model runs on your computer. The app may send selected text to a cloud model. In a fully offline setup, inference can happen on the device; still inspect update, sync, backup and logging settings. Decide from the actual data flow, not the product label. [5] [7]
| Setup | Transfer to check |
|---|---|
| AI chat in a browser | Submitted text and files go to the service provider; inspect the account and product settings. |
| Desktop app connected to a cloud API | The interface may be local while selected content travels to the provider for a model request. Inspect scope and logs. |
| Offline local model | Inference may stay on the device. Verify network, sync, backup and extensions before saying that no data leaves it. |
3. Read the provider terms for your product and account
'Not used for model training' does not mean 'never stored'. Chat history, safety logs, file storage, human review and sharing with connected tools can have different terms. Read the current documentation for your exact product, account and region. [4] [5] [7]
For example, OpenAI describes different controls for consumer ChatGPT and the API Platform. API content is not used to train models by default, while some API features store application state and abuse-monitoring logs can be retained for a period. Anthropic documents the default training treatment of commercial products separately from API retention exceptions. Gemini API terms distinguish unpaid and paid use, with qualifications. None of these examples automatically approves another account or workflow. [4] [5] [6] [7] [8]
4. Send the smallest useful amount
Reviewing the clarity of one paragraph may not require an entire manuscript. First consider whether a synthetic example, summarised variable description or short de-identified excerpt would answer the same question. Do not assume de-identification eliminates every re-identification risk. [9]
Before submitting, inspect attachments, confidential reviewer comments, participant identifiers, access keys and file metadata. Record which version and portion you used so the permission and disclosure decisions remain traceable.
5. Verify the output and disclose the use
Under ICMJE recommendations, an AI tool should not be named as an author; people remain responsible for accuracy, sources, attribution and originality. Authors submitting to journals that follow ICMJE should disclose the tool and how they used it in the appropriate place. Your target journal may require different detail or wording. [1] [2]
Compare each scientific claim against the original source and data. Do not treat a suggested citation, calculation, method interpretation or new finding as verified merely because an AI produced it. Record the tool, version if known, purpose, scope of submitted content and human revisions. [2]
Nine checks before you send
This is a decision and record-keeping aid, not a security certificate or permission form.
- State your role: author, coauthor, data user, reviewer or editor.
- Check journal, institution, ethics, data-agreement and coauthor conditions for the proposed transfer.
- Mark personal, health, student, unpublished or contract-restricted information in the file.
- Verify whether the tool is truly offline or connected to a cloud model.
- For your exact product and account, read training, retention, logging, region and connected-tool terms.
- Remove unnecessary files and identifiers; begin with a synthetic example or short excerpt where possible.
- Check the submission scope and selected attachments once more, then record the dated decision.
- Have a person verify sources, numbers, methods and any confidential information in the output.
- Prepare an AI-use record that fits the target journal's disclosure instructions.
Three common mix-ups
Is turning off model training enough to send a manuscript?
No. The setting alone does not resolve permission to share, retention and logging terms, or journal and institutional rules. [4] [5] [1]
Does using my own API key keep the file on my computer?
No. Key ownership and model location are different questions. A cloud API request transfers selected content to the provider; inspect the app's actual submission scope. [5]
May a reviewer upload a submitted paper for a summary?
ICMJE says reviewers should seek the journal's permission before using AI in a review. Journal policy and confidentiality assurances also matter; do not treat cloud upload of a submitted paper as the default step without explicit permission. [3] [1]
Primary sources and scope
Official publishing and provider pages were checked on 16 October 2026. Provider terms can change; reread your account's current settings and agreement just before submitting any file. No real research document was uploaded to a model to prepare this guide.
- 1ICMJE: Use of artificial intelligence in publishing
Confidentiality, transparency, human responsibility and permission boundaries.
- 2ICMJE: Use of AI by authors
Disclosing the tool and its purpose; authors' verification responsibility.
- 3ICMJE: Responsibilities in submission and peer review
Reviewer confidentiality and journal permission before using AI in a review.
- 4OpenAI: Data handling in consumer services
Account-dependent model-improvement controls, temporary chats and retention.
- 5OpenAI API: Data controls
API training, abuse-monitoring logs and feature-dependent storage.
- 6Anthropic: Model training for commercial products
Default training treatment of inputs and outputs in commercial products.
- 7Anthropic: Retention of organisation data
API retention and contractual, safety or legal exceptions.
- 8Google: Gemini API additional terms
Unpaid/paid use and particular regional or account exceptions.
- 9US HHS: De-identification of health information
Residual re-identification risk in a health-data example; not a universal legal rule.
Keep a decision record
Keep a dated note of what you decided to send, to which tool, under which permission and settings.
Browse the English guides →