Complaint responses and AI confidentiality: what a reply to a family gives away in ChatGPT or Claude.

A complaint response is the document managers most want help with, because it has to be defensible, honest and humane at the same time, and because the same letter may be read later by the Aged Care Quality and Safety Commission. It also carries the whole story: the allegations, the resident’s care, the staff involved and what the investigation found. This page marks every item in a response to a family complaint that the Aged Care Act 2024 and the Privacy Act protect, and shows how the same letter is drafted on Ermos inside the service.

The complaint response

Sent by the facility manager after a formal complaint has been investigated, and often provided to the Commission if the complaint escalates.

Kurrajong Gardens Aged Care

Mr Graham Baxter¹
By email

Re: Your complaint of 25 October 2026 regarding the care of your father, Harold Baxter¹

Dear Mr Baxter,

Thank you for meeting with me on 27 October. I have now completed our investigation and set out our findings.

1. Rough handling on 23 October. We have confirmed that your father was handled with unreasonable force by an agency worker during morning care. This was reported to the Commission and to NSW Police on the day. The worker has not returned and the agency has been told he is not to be rostered to any of our homes. We have also reviewed why a worker without dementia care induction was allocated to your father, and we have changed our agency booking process so that this cannot recur.²

2. Your concerns in August. You told us on 27 October that you had raised rough handling with the care manager, Deb Farrelly, on 12 August. We have found a file note of a conversation on that date recording a concern about “staff being in a hurry”, with no action recorded. That was a failure on our part, and I apologise for it.³

3. The missing watch. Your father’s watch was found on 28 October in the laundry, caught in a bedsheet. We do not believe it was taken. We have, however, reviewed the two earlier occasions it went missing and have arranged a locked drawer in his room.⁴

4. His blood sugar. The episode on 22 October was caused by his evening insulin being given without a check that he had eaten dinner, which he had not. Dr Nair has adjusted his regime and our RNs now check intake before insulin. We note that your father’s dementia makes his intake unpredictable, which the care plan now reflects.⁵

You asked whether you should move your father to another home. That is your decision and we will support it either way. We would ask you to consider that he has settled well with the staff he knows, and that the changes above are in place.⁶

If you are not satisfied with this response, you may contact the Aged Care Quality and Safety Commission on 1800 951 822. You may also ask us to review this response. We have shared a summary of the incident and our findings with your sister Linda, as you requested.⁷

Lorraine Keane⁸
Facility Manager⁸

An invented letter. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the service

The complainant and the resident

A named son and his father. Both identified, with the fact of a complaint. Privacy Act guide.

Frontier Models (ChatGPT, Claude)	Transmitted to the provider, generally offshore on personal plans
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

A substantiated assault, the police and the agency

That a resident was assaulted, that police were involved, and what was done about the worker and the agency. Protected information under section 21, and a reportable incident’s whole history. Patient data guide.

Frontier Models (ChatGPT, Claude)	A substantiated assault and its handling transmitted; on consumer tiers it can train future models
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

An earlier warning ignored, and a named manager

An admission that a concern was recorded and nothing was done, naming the manager. The sentence that decides a claim. Privacy Act guide.

Frontier Models (ChatGPT, Claude)	An admission of failure, with a named manager, now on a third party’s servers
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

The watch

A suspected theft that was not one. Resolved, and still the resident’s private business. Privacy Act guide.

Frontier Models (ChatGPT, Claude)	Transmitted and kept on the provider’s terms
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

A clinical error and its cause

Insulin given without checking intake. Health information, an admitted error, and a change to the care plan. Patient data guide.

Frontier Models (ChatGPT, Claude)	A clinical error transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

A conversation about leaving

That the family is considering moving him. Commercially sensitive to the provider and personal to the family. Privacy Act guide.

Frontier Models (ChatGPT, Claude)	A family’s deliberations transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

Escalation and a sister

A reference to the Commission, and the fact that a summary was shared with another family member. Her personal information, and the family’s arrangements. Privacy Act guide.

Frontier Models (ChatGPT, Claude)	A sister’s involvement transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

The manager

Ties the response, and its admissions, to the responsible person.

Frontier Models (ChatGPT, Claude)	Transmitted, and the leak is traceable to you
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

What happens in Frontier Models (ChatGPT, Claude)

The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
On consumer tiers, prompts can be retained and used to train future models.
The provider’s staff and systems can reach the content under the provider’s own policies.
Once sent, the service no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Ermos Dominion

The document is drafted on a unit in your office, from your own templates and the resident’s record. Every marked item stays on the unit, which keeps working with the internet switched off. Nothing in it is transmitted to an AI provider, so there is no disclosure to analyse: the confidentiality work is the same as for your file server.

Ermos Edge

Your documents, the index and your access boundaries stay on your own instance in an Australian data centre. When a staff member asks for this draft, only their question and the excerpts they are permitted to see go to a named Australian provider, who is contractually barred from keeping the content or training any model on it. Nothing is processed outside Australia.

	Frontier Models (ChatGPT, Claude)	Ermos Edge	Ermos Dominion
Where the document is processed	Provider servers, generally offshore on personal plans	Your instance in an Australian data centre; answers generated in Australia	The unit in your office
Who can read it	Provider staff and systems, under policy	Your staff, within the boundaries you set. The named Australian provider processes only permitted excerpts, under contract, and keeps nothing	Your staff only
Is it kept	On the provider’s terms	Kept on your instance; the provider is barred from retaining it	Stays on the unit
Can it train a model	On consumer tiers, yes	No, by contract	Only your own unit learns from it, on your hardware

Part of AI data leakage in aged care providers.

Common questions

Do ChatGPT and Claude use the information in a complaint response?

Yes, a pasted response is sent to the AI company and processed there to produce the reply. As at October 2026, whether a conversation on a personal plan (ChatGPT Free, Plus or Pro; Claude Free, Pro or Max) can be used to train the models depends on a setting each user controls. Business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) and the developer APIs sit under commercial terms, and OpenAI and Anthropic each say they do not train on that content by default (OpenAI, Anthropic). On either product, the thumbs up and thumbs down buttons can send a whole conversation back for training. It holds a substantiated assault, an admitted earlier failure and a clinical error.

Is it safe to paste a complaint response into ChatGPT or Claude?

No, because the letter holds admissions written for one family and, if the complaint escalates, the Aged Care Quality and Safety Commission. The Office of the Australian Information Commissioner (OAIC) recommends in its guidance on commercially available AI products that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks. It records that a resident was handled with unreasonable force, that a concern in August led to no action and that insulin was given without a check on intake. Removing the names would leave a dated assault, a missed warning and an insulin error that anyone involved in the complaint would recognise.

Is it safe to use an AI note-taker or meeting recorder for the meeting behind a complaint response?

Only after the service has asked where the audio and transcript go. Recording and transcription tools send the audio or transcript to the tool's vendor. The same questions apply as for ChatGPT and Claude (where it is stored, whether it trains a model, who can review it). The OAIC's guidance also tells organisations to review carefully the terms and settings that will apply to their use of any AI product. A complaint meeting is spoken live, so the transcript would hold the family's allegations, an earlier concern about rough handling and any admission the manager makes, word for word.

How can an aged care service use AI for a complaint response without sending it to ChatGPT or Claude?

Ermos is built so the document stays under your control. On the Dominion AI unit it is drafted inside your office and none of it is sent to an AI provider. On Ermos Edge your documents and index stay on your own instance in an Australian data centre, and only the question and the excerpts the user is permitted to see go to a named Australian provider that is contractually barred from keeping them or training any model on them. The manager asks for a chronology and a draft letter in the service's usual format, built from the incident reports, progress notes, August file note and care plan. Every statement is checked against the record it cites before the manager signs.

The letter admits fault. Should it?

That is a question for the provider and its advisers; open disclosure is generally expected and the Commission values it. What this page is about is where the letter was written. Admissions drafted inside the service are the provider's to make. Admissions drafted on a frontier model provider's servers exist there too, retained on terms the provider never saw.

Does the Commission's involvement change anything?

The Commission is entitled to the response, and the provider is entitled to write it carefully. Neither entitles a third party with no role in the complaint to hold the draft, the resident's care history and the manager's admissions.

How is a complaint response drafted on Ermos?

From the incident reports, the progress notes, the file note from August and the care plan, all on your own unit. The manager asks for a chronology and a draft, checks every statement against the record it cites, and sends the letter. Nothing leaves the service to produce it.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo

Keep reading

AI data leakage in aged care providers AI for healthcare AI and patient data All professions