Internal observations and client-facing updates serve different purposes. Putting them in the same field makes an accidental disclosure easier. I prefer a clear separation in both the form and the data structure.
The owner should be able to see which information is shared before saving it. The portal should request only the fields it needs, and tasks can have an explicit visibility setting. These boundaries make the workflow more dependable than relying on careful wording every time.