Policy reinstatement emails and AI data leakage: what a lapsed policy request gives away in ChatGPT or Claude.

A policy lapses because a direct debit failed, a card expired or a client changed banks, and the client rings the adviser in a panic. The adviser asks the insurer to reinstate it, and the email has to explain what happened, what has changed in the client’s health since, and why the insurer should agree. That is delicate writing done in a hurry, so it goes into ChatGPT or Claude. This page marks the items in an invented reinstatement request that the Insurance Contracts Act, the Privacy Act and the Code of Ethics bear on, and shows the same email drafted on Ermos inside the practice.

The lapsed policy reinstatement email

Sent to the insurer’s underwriting team after a policy has lapsed and the client wants cover back. Under the Insurance Contracts Act 1984, section 11(9)(c) treats the reinstatement of a previous contract as entering into a contract. For a consumer insurance contract the insured must then take reasonable care not to make a misrepresentation to the insurer (section 20B); the section 21 duty of disclosure applies to contracts that are not consumer insurance contracts (section 20E).

To: Underwriting, Meridian Life
From:
Date: 30 October 2026
Subject: Reinstatement request: policy

Further to your letter of 15 October, with the client’s authority:

  1. The lapse.
  2. Your reinstatement terms.
  3. Health since the policy was issued.
  4. Occupation and income.
  5. The cover.

An invented email about an invented client. The policy number, adviser number, GP and account are placeholders. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the practice

  1. 1
    The client, his date of birth and the policy number

    Identity and a live policy reference. A date of birth and policy number are two of the facts used to verify a caller at an insurer. Privacy Act guide.

  2. 2
    Why the policy lapsed

    A failed payment, a change of bank and a cash shortage after time off work. Financial information about the client’s business, and a reason he would not want repeated. Privacy Act guide.

  3. 3
    The insurer’s reinstatement terms

    The insurer’s own letter wording and a deadline. It sets out a term of the contract but contains no health or financial details about the client beyond the policy it relates to.

  4. 4
    Health since the policy was issued

    A surgery, a medication, a dose, a hospital and a named GP. Health information is sensitive information under the Privacy Act, and it is the information the insurer needs to decide whether to reinstate. Patient data guide.

  5. 5
    Occupation and income

    A trade, self-employment and an income figure from a tax return. Employment and financial information the insurer asked for. Privacy Act guide.

  6. 6
    The cover, the premium and the arrears

    What the client is insured for, what he pays and what he owes. Financial information about the client, and the amount at stake.

  7. 7
    The adviser’s candid view about disclosure

    The adviser says the reinstatement is treated like a new application and records that the client forgot the surgery. Section 11(9)(c) of the Insurance Contracts Act treats a reinstatement as entering into a contract. For a consumer insurance contract the insured must take reasonable care not to make a misrepresentation to the insurer (section 20B); the section 21 duty of disclosure applies to contracts that are not consumer insurance contracts (section 20E). Standard 5 of the Code of Ethics asks the adviser to be satisfied the client understands the advice and its risks.

  8. 8
    The new direct debit authority

    A bank account ending and an instruction to debit arrears. Enough to identify the account and to see what the client will pay. Privacy Act guide.

  9. 9
    The adviser

    Ties the email to a named adviser bound by the Code of Ethics.

What happens in Frontier Models (ChatGPT, Claude)

  • The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
  • On consumer tiers, prompts can be retained and used to train future models.
  • The provider’s staff and systems can reach the content under the provider’s own policies.
  • Once sent, the practice no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Ermos Dominion

The document is drafted on a unit in your office, from your own templates and the client file. Every marked item stays on the unit, which keeps working with the internet switched off. Nothing in it is transmitted to an AI provider, so there is no disclosure to analyse: the confidentiality work is the same as for your file server.

Ermos Edge

Your documents, the index and your access boundaries stay on your own instance in an Australian data centre. When a staff member asks for this draft, only their question and the excerpts they are permitted to see go to a named Australian provider, who is contractually barred from keeping the content or training any model on it. Nothing is processed outside Australia.

Frontier Models (ChatGPT, Claude)Ermos EdgeErmos Dominion
Where the document is processedProvider servers, generally offshore on personal plansYour instance in an Australian data centre; answers generated in AustraliaThe unit in your office
Who can read itProvider staff and systems, under policyYour staff, within the boundaries you set. The named Australian provider processes only permitted excerpts, under contract, and keeps nothingYour staff only
Is it keptOn the provider’s termsKept on your instance; the provider is barred from retaining itStays on the unit
Can it train a modelOn consumer tiers, yesNo, by contractOnly your own unit learns from it, on your hardware

Part of AI data leakage in financial advice practices.

Common questions

Do ChatGPT and Claude use the information in a policy reinstatement email?
Yes, everything pasted or uploaded from the email is sent to the AI company's servers and processed there to produce a reply. As at October 2026, whether a conversation on a personal plan (ChatGPT Free, Plus or Pro; Claude Free, Pro or Max) can be used to train the models depends on a setting each user controls. Business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) and the developer APIs sit under commercial terms, and OpenAI and Anthropic each say they do not train on that content by default (OpenAI, Anthropic). On either product, the thumbs up and thumbs down buttons can send a whole conversation back for training. This email gives a client's date of birth, a knee surgery and blood pressure medication since the policy was issued, his income and the reason the premium debit failed.
Can we use ChatGPT or Claude for a policy reinstatement email if we remove the client's name?
Not safely, because the rest of the email still describes one man. The Office of the Australian Information Commissioner (OAIC) recommends in its guidance on commercially available AI products that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks. A self-employed electrician with a knee arthroscopy in August, a named GP and a lapsed income protection policy is easy to identify, and a date of birth with a policy number is what an insurer uses to verify a caller. Removing names rarely makes a document anonymous. Information stays personal information while the person is reasonably identifiable, and the OAIC warns that information can be at risk of re-identification even when it has been de-identified or anonymised.
What if staff use their own ChatGPT or Claude account for a policy reinstatement email?
The business cannot see or manage what was sent from a personal account. On a personal plan the user cannot choose where conversations are stored or processed. Some business plans let an organisation choose to store data at rest in Australia (OpenAI), which still leaves the content with the AI company. Both companies can also review content that is flagged for safety or policy reasons. For this email, a client's health history, income and bank account ending could leave the practice without anyone there knowing it had gone.
How can an advice practice use AI for a policy reinstatement email without sending it to ChatGPT or Claude?
Ermos is built so the document stays under your control. On the Dominion AI unit it is drafted inside your office and none of it is sent to an AI provider. On Ermos Edge your documents and index stay on your own instance in an Australian data centre, and only the question and the excerpts the user is permitted to see go to a named Australian provider that is contractually barred from keeping them or training any model on them. The email is drafted from the client file and the practice's own reinstatement template. The adviser decides what the client has to disclose, checks every date and detail against the insurer's letter and signs it.
What duty to the insurer applies when a lapsed policy is reinstated?
Section 11(9)(c) of the Insurance Contracts Act 1984 says a reference to entering into a contract includes the reinstatement of a previous contract. For a consumer insurance contract, section 20B then requires the insured to take reasonable care not to make a misrepresentation to the insurer before the contract is entered into, and the section 21 duty to disclose matters relevant to the insurer's decision applies to contracts that are not consumer insurance contracts (section 20E). Either way, an adviser treats a reinstatement request like a new application.
What does Standard 5 require when an adviser asks to reinstate cover?
Standard 5 of the Code of Ethics requires advice to be in the client's best interests and appropriate to the client's circumstances, and requires the adviser to be satisfied that the client understands the advice and the benefits, costs and risks of the product. A reinstatement may or may not be the best option compared with new cover, and the client must understand the difference.
What does the Privacy Act say about protecting client information?
Australian Privacy Principle 11 requires an entity covered by the Act to take reasonable steps to protect personal information it holds from misuse, interference and loss, and from unauthorised access, modification or disclosure. A reinstatement email carries health, income and bank detail together, which is the kind of content that principle is aimed at.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo
Keep reading
AI data leakage in financial advice practices AI for financial advisers The Privacy Act, the APPs and AI All professions