Lesson 2: Choosing Approved Tools and Following Policy

Why the tool you choose matters

In Level 1 you saw what AI assistants can and cannot do in pharmacy. This level covers the next question: which tool are you allowed to use, and under which account?

The same assistant can treat your data in very different ways depending on how you sign in. A personal chatbot account and a work-licensed version from the same company may look almost the same, but they are covered by different contracts. Think of it like a pharmacy fridge. A domestic fridge and a validated medicines fridge both keep things cold, but only one is monitored, documented and approved for stock. Using AI follows the same logic.

This course gives general information, not clinical advice. Always follow local policy, approved references and your own professional judgement.

Task 1: Find your organisation's AI policy

Most employers now cover AI either in a separate AI policy or inside an acceptable-use, IT security or information governance (IG) policy.

Do this:

1. Search your intranet, staff handbook or policy library for "artificial intelligence", "AI", "generative", "Copilot" and "acceptable use".
2. If you find nothing, check the IT security and IG policies. AI rules are often a short section in one of these.
3. If you still find nothing, ask your line manager or superintendent pharmacist (community), or your IG team (hospital and primary care), whether there is a policy.
4. Write a summary of no more than five lines that covers:
   • which tools are approved (named products and account types)
   • which tools are prohibited or blocked
   • which tasks are allowed (for example, drafting emails or rotas)
   • what information must never be entered (Level 3 covers this in detail)
   • the date of the policy and who owns it

Example summary: "AI policy v1.2 (March 2026), owner: IG lead. Approved: Microsoft 365 Copilot Chat signed in with a work account. Not approved: personal chatbot accounts on work devices. Allowed: admin drafting and learning. No patient-identifiable data in any tool."

Task 2: Understand consumer and enterprise versions

What changes how your data is handled is the type of account, not the brand. Paying for a personal subscription does not turn it into a work tool.

Here is what each vendor's help pages said in October 2026. Check them again, because terms change.

• ChatGPT (OpenAI)
  • Personal accounts: conversations can be used to train models unless you turn off "Improve the model for everyone" under Settings → Data controls.
  • ChatGPT Business, Enterprise, Edu and ChatGPT for Healthcare: OpenAI says it does not use inputs or outputs for training by default.
• Microsoft 365 Copilot / Copilot Chat
  • Signed in with a work (Entra ID) account: enterprise data protection applies. Prompts and responses are not used to train foundation models and are covered by the same commercial terms as your work email and files.
  • Signed in with a personal Microsoft account: consumer terms apply.
• Gemini (Google)
  • Personal Gemini Apps: human reviewers may read conversations to improve Google's products. Reviewed chats can be kept for up to three years, separately from your account, even after you delete your activity. Google advises users not to enter confidential information.
  • Gemini in qualifying Google Workspace editions: content is not human-reviewed or used for model training outside your organisation without permission.
• Claude (Anthropic)
  • Personal plans (Free, Pro, Max): you choose in Privacy Settings whether your chats are used for training. If you allow it, data can be kept for up to five years. If you don't, it is kept for 30 days.
  • Commercial plans (Claude for Work, Enterprise, API): data is not used for training.

Do this:

1. For each tool your policy approves, open the vendor's current privacy or data-controls help page.
2. Record three facts: Is data used for training? How long is it kept? Can people at the vendor read it?
3. Check which account you are actually signed in with. Look for a work badge, shield icon or your organisation's name.

Task 3: Know who to ask when policy is silent

Policies fall behind new tools. If a tool or use is not covered, you are not allowed to assume it's fine. Ask before you use it.

Typical contacts:

• Line manager or pharmacy manager: first point of contact for day-to-day questions
• Superintendent pharmacist: in community pharmacy, responsible for how the business operates
• Data Protection Officer (DPO): advises on data protection compliance and impact assessments
• Caldicott Guardian: senior role that protects the confidentiality of patient information in NHS and care organisations
• IT or digital team: decides whether software is approved and set up safely

Do this:

1. Write the name and contact details of each person above who applies to your workplace.
2. When you ask, describe the tool, the account type, the task and the type of information involved.
3. Keep the reply in writing.

Checklist

• I have found (or asked about) my organisation's AI or acceptable-use policy
• I have written a five-line summary that names the approved tools
• I know whether I am signed in with a work or personal account
• I have checked the current help page for training, retention and human review
• I have written down who to ask when policy is silent

Key takeaways

• Use only the tools your employer approves, under the approved work account.
• Account type matters more than brand: consumer and enterprise versions handle data differently.
• Always check three things: training, retention and human review, using current help pages.
• A paid personal subscription is still a consumer account.
• If the policy doesn't cover something, ask the named person and get the answer in writing.