Zoom's AI note taker (AI Companion's Meeting Summary, plus the participant-level My Notes) can summarise a telehealth session, but it was built for meetings, not clinical records. Australian clinicians who use it need the client's informed consent, an account set up for Australian data handling, and a careful review of every summary. A summary is never a finished clinical note.
That is the short version. The rest of this guide works through what the feature captures, where the data goes for an Australian account, what your clients can see, and the legal and professional obligations that apply before you switch it on for a therapy session.
What does Zoom's AI note taker actually capture?
"Zoom AI note taker" usually means one of two features, and they behave differently.
- Meeting Summary is turned on by the host. Zoom uses the speech-to-text of the conversation, text recognised on screen and the in-meeting chat to produce a written summary after the meeting.
- My Notes is turned on by an individual participant and produces a transcript for that person.
Under Zoom's default "federated" approach, these features can be processed by Zoom's own models or by third-party models. Zoom's AI whitepaper currently lists Anthropic, OpenAI and Google Gemini models alongside Zoom-hosted ones, and notes that the models used in this federation can change at any time.
For a therapy session, that means the raw material is the most sensitive conversation your client will have all week: symptoms, history, relationships, risk. Under the Privacy Act that is health information, which is sensitive information.
Does Zoom train its AI on your therapy sessions?
Zoom's published position is that it does not. The whitepaper states that Zoom does not use customer audio, video, chat, screen sharing, attachments or other communications-like content to train Zoom's or its third-party models, and that its third-party model providers operate under zero data retention policies, with limited exceptions for trust and safety purposes.
Two points matter for clinicians:
- "Not used for training" is not the same as "not processed". The content still has to be processed to produce the summary, and Zoom retains generated content according to the retention rules for that service and your settings.
- The Ahpra guidance on AI asks you to understand "where data is located and how it is stored", not just whether it trains a model (Ahpra, Meeting your professional obligations when using AI in healthcare). A vendor's training policy answers only one of those questions.
Where is the data processed if your practice is in Australia?
This is the detail most guides miss. According to Zoom's regional availability notes, for customers whose accounts are hosted in the EU or Australia, Zoom delivers supported AI features through "Zoom-Hosted Models Plus" (ZM+). In that model, third-party models run as dedicated instances on Amazon Bedrock, inside Zoom's own cloud provider, and data is not sent to the third-party AI companies. A stricter "Zoom-Hosted Models Only" option is also available on request.
So the question to ask is not "is Zoom Australian?" but "is our account hosted in Australia, and which AI deployment model is it on?" Zoom says customers can contact its support team to confirm their default deployment and choose an alternative.
There is one catch for telehealth. Zoom notes that when you meet with external participants, content exchanged between accounts "may be processed according to the external account settings". Your client is usually an external participant, so if they turn on My Notes from their own account, their account's settings apply to that transcript, not yours.
Will your client know the AI note taker is on?
Zoom shows an illuminated "AI Sparkle" icon in the top-right corner of the meeting window when Meeting Summary is active, and participants can hover over it to see which features are running (Zoom, User Transparency and Notice). A participant can ask the host to turn the features off and delete what has been generated so far.
My Notes works differently: participants see a banner saying the meeting is being transcribed, unless they have previously chosen not to see that banner again.
An icon in the corner of a video window is a notification. It is not consent. The Office of the Australian Information Commissioner says consent to collect sensitive information through AI must be specific and current, and cannot be inferred from a privacy notice alone (OAIC, Guidance on privacy and the use of commercially available AI products). Ask, explain and record the answer before the session starts.
What do Australian privacy and recording laws require?
Three layers apply, and they overlap.
Privacy law
The OAIC guidance says privacy obligations apply both to personal information you put into an AI system and to what the system produces. In practice that means:
- obtaining consent for collecting health information through the tool
- using the content only for the purpose the client agreed to (APP 6)
- taking reasonable steps to make sure what ends up in the record is accurate (APP 10)
- updating your privacy policy so it describes your use of AI
Recording laws
Surveillance device laws are state and territory based and differ. In NSW, for example, it is an offence to use a listening device to record a private conversation even when you are a party to it, unless the principal parties consent or a narrow exception applies (Surveillance Devices Act 2007 (NSW), s 7). Medical indemnity insurer MIPS has advised clinicians using AI scribes to get consent every time, even for returning patients, because each recording without consent could be a separate offence (Ausdoc, 3 December 2024).
Professional obligations
Ahpra's guidance says you should obtain informed consent for AI tools that capture the consultation, "ideally note the patient's response in the health record", and that you remain responsible for the care you deliver. If your consent form does not yet mention AI, see our guide to informed consent forms for counselling.
Is a Zoom meeting summary a clinical note?
No. A meeting summary is designed to capture discussion points, decisions and action items. A clinical note needs to record the clinical content, such as presentation, risk, interventions, the client's response and the plan, in a form a colleague or a court could rely on. Our guide to telehealth documentation requirements in Australia covers what that record has to include.
If you use a Zoom summary at all, treat it as raw material. Check it against your own recollection, correct anything that is wrong, add what it missed, and write the note in your clinical record system. The OAIC expects human oversight of AI outputs and checks for accuracy, and Ahpra is clear that the practitioner, not the tool, is accountable for the record.
Also think about where the summary lives afterwards. A copy sitting in a Zoom account or a participant's email is part of your information-handling picture, and it sits outside your clinical record and its retention settings.
How should a practice set up Zoom AI if it decides to use it?
If your practice decides to allow Zoom AI features in client sessions, make it a deliberate policy rather than a default.
- Confirm your hosting region and AI deployment model with Zoom support (Australian hosting, ZM+ or ZMO).
- Minimise retained transcripts. Zoom's whitepaper describes a zero data retention option for Meeting Summary: admins can disable and lock the Meeting transcript setting, or set transcript retention to zero days, so no persistent transcript is kept once the summary is generated. Cloud recording can still create its own transcript, so check that setting separately.
- Decide who receives summaries and make sure they never go to anyone outside the treating team without the client's agreement.
- Script the consent conversation and record the client's answer at every session.
- Update your privacy policy and client information sheet to describe the tool, as the OAIC recommends.
- Train clinicians to review every output and to switch the feature off if a client hesitates.
Ahpra's AI guidance for health practitioners is a useful companion for writing that policy.
When does a purpose-built clinical AI scribe make more sense?
A general meeting tool asks you to bolt clinical safeguards onto software that was not designed around a clinical record. A clinical scribe starts from the record.
PractaLuma is AI-native practice management software for Australian mental-health practices. Its AI Scribe drafts the session note inside the client's record, with the full transcript alongside so you can check every line before you approve it. Retention settings for recordings, transcripts and generated notes are set separately, and our security page sets out the Australian storage commitment and our commitment not to use your data to train foundation models. The Zoom integration creates meeting links for telehealth appointments and does not request access to Zoom recordings, audio, video, chat or meeting content.
For a broader comparison of options, see the best AI for therapy notes and our AI medical scribe guide. Plans are on the pricing page.
Frequently asked questions
Is Zoom AI Companion HIPAA compliant?
That is a US question, and the answer depends on your agreement with Zoom. Zoom's whitepaper says AI features are subject to limitations for customers in specific industry verticals, so confirm with Zoom which features are available under your account terms. For Australian practices, the Privacy Act and state recording laws are the relevant tests.
Can my client record or transcribe our session with Zoom?
Yes, a participant can use My Notes from their own account, and its settings follow their account. The host sees an option to stop transcription. Set expectations about recording in your consent and session agreements.
Do I need consent every session, or once at intake?
Ahpra and the OAIC frame consent as informed and current, and MIPS advises asking every time. A signed intake form plus a quick verbal check at the start of each session, noted in the record, covers both.
Can I paste a Zoom summary straight into my notes?
You can use it as a starting point, but you are responsible for the accuracy of the record. Review, correct and complete it before it becomes part of the clinical file.
This article is general information, not legal advice. Check the surveillance device law in your state or territory and your indemnity insurer's guidance before using any AI recording tool in client sessions.