I saw today someone had Grammarly installed during a conference call. They were entering HIPAA-protected data into an internally-managed Jira instance, which presumably was being vacuumed directly up into Grammarly's database.

This might be a much bigger issue than I had considered :(