Complaint responses and AI confidentiality: what an NDIS complaint letter gives away in ChatGPT or Claude.

A complaint from a family needs a careful reply, and a manager who is also running the roster will often draft it in ChatGPT or Claude. The Complaints Management and Resolution Rules expect complaints to be acknowledged, assessed and resolved in a fair, efficient and timely manner. The letter that results restates the whole matter: a missed shift, a disputed charge, a late phone call and a confidence the participant asked the service to keep. This page marks every item in a response to a participant’s mother that the Complaints Rules, the Code of Conduct and the Privacy Act bear on, and shows how the same letter is drafted on Ermos inside the service.

The response to a complaint

Sent by the service manager to the complainant after the complaint has been assessed. The Complaints Rules expect the complainant to be kept informed of progress, the reasons for decisions and options for review, and the participant affected to be kept appropriately informed and involved.

Brushbox Community Supports

Mrs Sharon Kerrigan¹
By email · 2 November 2026

Re: Your complaint of 26 October 2026 about supports for your son, Daniel¹

Dear Mrs Kerrigan,

Thank you for your complaint and for meeting me on 28 October. I have looked at each matter and set out what I found.

1. The missed shift on 14 October. No worker was allocated to Daniel on Wednesday 14 October because Aisha was on approved leave and the roster showed her cover as unfilled. You were not told until you rang at 10.20am. That was our failure and I apologise. A rostering check now flags any unfilled shift the day before.²

2. The charge for 16 October. Daniel was unwell and you cancelled by phone at 8.15am on Friday. We charged six hours as a short notice cancellation. After reading our agreement I have decided the charge should not stand, and we have withdrawn it and will adjust the claim.³

3. The shopping centre on 19 October. Daniel became distressed in a crowded food court and hit his temple three times. There was no injury. Aisha left you a voicemail at 3.20pm but did not say what had happened and did not follow up. You first heard from Daniel on 21 October. We should have phoned you the same day, and our team leader now does this for any distress episode.⁴

4. What Daniel tells his workers. You asked why you were not told everything Daniel said that day. Daniel is an adult and he decides what we share. He has asked us to keep some things private, and we respect that. We have encouraged him to talk to you, and we will help him if he wants us to.⁵

What we have changed. Unfilled shifts are flagged the day before. Any distress episode gets a same-day phone call to you. Daniel and his support coordinator, Jess Mallory, will review his plan with Beth on 9 November.⁶

If you are not satisfied with this response, please tell me and I will review it, or you can contact the NDIS Quality and Safeguards Commission, which can look at your complaint independently. You are welcome to bring an advocate, and we will help you contact the Commission if you want.⁷

Meena Ramanathan⁸
Service Manager⁸

An invented letter. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the service

The complainant and the participant

A named mother and her adult son, and the fact of a complaint. Personal information. Information in a complaint is to be kept confidential and disclosed only if required by law or if disclosure is otherwise appropriate. Privacy Act guide.

Frontier Models (ChatGPT, Claude)	A mother, her son and the fact of a complaint, generally offshore on personal plans
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

A missed shift and an admission

That nobody attended on a given day, why, and that the family was not told. The service’s own account of a failure in its supports and its roster.

Frontier Models (ChatGPT, Claude)	An admitted failure in the roster transmitted; on consumer tiers it can train future models
Ermos Edge	Whether to admit a failure is the manager’s decision whichever tool drafts the letter
Ermos Dominion	Whether to admit a failure is the manager’s decision whichever tool drafts the letter

A disputed charge

What the service charged, why it has reversed the charge and that it will adjust a claim. Commercial information, and a decision on a payment dispute that belongs to the service.

Frontier Models (ChatGPT, Claude)	A payment dispute and a reversal transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

A distress episode and a late call

What happened to a named man in a public place, that he hit himself, and that his mother was not properly told. Health information, and a second admission. Patient data guide.

Frontier Models (ChatGPT, Claude)	A health episode and an admission transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

What a participant asked to keep private

That the participant has told his workers things he does not want shared with his mother. The Code of Conduct requires respect for privacy and for his right to self-determination and decision-making, and the Rules expect an affected person with disability to be kept informed and involved. Privacy Act guide.

Frontier Models (ChatGPT, Claude)	A confidence he asked to keep from his mother transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

The changes the service has made

New checks, a same-day call rule and a review meeting with a named coordinator on a named date. The service’s corrective actions, which will be read against what happens next.

Frontier Models (ChatGPT, Claude)	The service’s corrective actions transmitted
Ermos Edge	Stays on your instance in Australia; leaves only inside a permitted excerpt, per question, to the named provider
Ermos Dominion	Stays on the unit in your office

7
Review and the Commission
How to ask for review and how to contact the Commission. The Complaints Rules require reasonable steps to ensure the complainant and each affected person with disability are advised how the complaint can be raised with the Commissioner, and appropriate support in contacting the Commissioner. Wording used in every response.

Frontier Models (ChatGPT, Claude)	Standard review and Commission wording; nothing in it identifies anyone
Ermos Edge	Nothing to protect either way
Ermos Dominion	Nothing to protect either way

The manager

Ties the findings and the admissions to the responsible person, and to the complaints record the service must keep for 7 years from the day it is made.

Frontier Models (ChatGPT, Claude)	Transmitted, and the leak is traceable to you
Ermos Edge	Signing and owning the response stays with the manager
Ermos Dominion	Signing and owning the response stays with the manager

What happens in Frontier Models (ChatGPT, Claude)

The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
On consumer tiers, prompts can be retained and used to train future models.
The provider’s staff and systems can reach the content under the provider’s own policies.
Once sent, the service no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Ermos Dominion

The document is drafted on a unit in your office, from your own templates and the participant file. Every marked item stays on the unit, which keeps working with the internet switched off. Nothing in it is transmitted to an AI provider, so there is no disclosure to analyse: the confidentiality work is the same as for your file server.

Ermos Edge

Your documents, the index and your access boundaries stay on your own instance in an Australian data centre. When a staff member asks for this draft, only their question and the excerpts they are permitted to see go to a named Australian provider, who is contractually barred from keeping the content or training any model on it. Nothing is processed outside Australia.

	Frontier Models (ChatGPT, Claude)	Ermos Edge	Ermos Dominion
Where the document is processed	Provider servers, generally offshore on personal plans	Your instance in an Australian data centre; answers generated in Australia	The unit in your office
Who can read it	Provider staff and systems, under policy	Your staff, within the boundaries you set. The named Australian provider processes only permitted excerpts, under contract, and keeps nothing	Your staff only
Is it kept	On the provider’s terms	Kept on your instance; the provider is barred from retaining it	Stays on the unit
Can it train a model	On consumer tiers, yes	No, by contract	Only your own unit learns from it, on your hardware

Part of AI data leakage in NDIS services.

Common questions

Do ChatGPT and Claude use the information in a complaint response?

Yes. A draft letter pasted into either tool is sent to the AI company's servers and processed there to produce the reply. As at October 2026, whether a conversation on a personal plan (ChatGPT Free, Plus or Pro; Claude Free, Pro or Max) can be used to train the models depends on a setting each user controls. Business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) and the developer APIs sit under commercial terms, and OpenAI and Anthropic each say they do not train on that content by default (OpenAI, Anthropic). On either product, the thumbs up and thumbs down buttons can send a whole conversation back for training. The letter to Mrs Kerrigan restates the missed shift on 14 October, the reversed charge, Daniel's distress episode and the confidence he asked the service to hold private.

Is it safe to paste a complaint response into ChatGPT or Claude?

No, because the letter restates the whole complaint in one place. The Office of the Australian Information Commissioner (OAIC) recommends in its guidance on commercially available AI products that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks. The Complaints Rules require reasonable steps to keep information in a complaint confidential, disclosing it only if required by law or otherwise appropriate in the circumstances, and this letter holds a health episode, admissions about the roster and a confidence from an adult participant.

Is it safe to use an AI note-taker or meeting recorder for a complaint response?

Not without asking the same questions. Recording and transcription tools send the audio or transcript to the tool's vendor, so the service needs to know where it is stored, whether it trains a model and who can review it. The OAIC's guidance also tells organisations to review carefully the terms and settings that will apply to their use of any AI product. This letter follows a meeting with Mrs Kerrigan on 28 October, and a recording of that meeting would carry the complaint whose details the letter restates.

How can an NDIS provider use AI for a complaint response without sending it to ChatGPT or Claude?

Ermos is built so the document stays under your control. On the Dominion AI unit it is drafted inside your office and none of it is sent to an AI provider. On Ermos Edge your documents and index stay on your own instance in an Australian data centre, and only the question and the excerpts the user is permitted to see go to a named Australian provider that is contractually barred from keeping them or training any model on them. The response is drafted from the complaint record and the participant file in the service's own letter format. The service manager decides the findings and any admission, checks every fact and signs it.

What must an NDIS provider's complaints system do?

Under the Complaints Management and Resolution Rules, a registered NDIS provider's system must let anyone complain, including anonymously, and must require complaints to be acknowledged, assessed and resolved in a fair, efficient and timely manner. The Rules do not set a fixed number of days. The system must also require procedural fairness, and that complainants are advised how to raise the matter with the Commissioner.

How long are complaint records kept, and who sees what is in them?

Records of complaints, action taken and outcomes must be kept for 7 years from the day each record is made. The Rules also require reasonable steps to ensure that information provided in a complaint is kept confidential and disclosed only if required by law or if disclosure is otherwise appropriate in the circumstances.

A parent complained. Does the participant have a say?

Yes. The Rules say a person with disability affected by an issue raised in a complaint is to be kept appropriately informed of its progress, including action taken, reasons for decisions and options for review, and kept appropriately involved in resolving it. An adult participant who has asked that something be kept private has made a decision the response should respect.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo

Keep reading

AI data leakage in NDIS services Resources The Privacy Act, the APPs and AI All professions