Correct. In this case, I left all my data public (not optimal, but proves a point). This was mentioned here:

“Even though getData has the modifier onlyOwners, meaning that the function cannot be called by others, this does not mean that the data stored is private. All information stored on the Ethereum blockchain can be viewed by others.”

What I could have done is encrypted the data off-chain, as mentioned by J Robison IV in the comment above.