I think it would only need inclusion if their data were training a model for public use. If their data are being used internally only (as stated in the consent form etc) and being used in analysis by internal (contained/walled) tools, then I don’t see the need.