OBSCURA for clinics and healthcare teams
Clinics send patient information more often than anyone would like: a referral letter, a photograph for a second opinion, an export for an audit. These tools redact and check those files in the browser, so the record is never uploaded to a service to be cleaned. They do not make a clinic compliant with anything; they remove one place the data could go.
The applications for clinical work
The single tools further down each do one job on one file. These three are applications, for work that goes on for weeks: an audit, a set of letters, the logins a clinician carries. Each is paid for, on its own or with the rest of Pro, and each keeps its work in the browser on the computer it runs on.
OBSCURA Research
For a clinical audit or a service evaluation. SPSS .sav, CSV and Excel files opened on the practice computer; t-tests, ANOVA, correlation, regression and the non-parametric tests, with APA tables; and interview transcripts or the free-text answers of a patient survey coded by selecting the text. Its anonymiser replaces each name in the transcripts with the same pseudonym everywhere and gives you the key file to keep apart.
Pseudonymised is not anonymous: the key file re-identifies everyone, and a rare detail in a transcript can on its own. There is no transcription of audio; SCRIBE does that.
OBSCURA PDF Studio
Referral letters and scanned results made searchable, then NHS numbers, National Insurance numbers, dates, postcodes, telephone numbers, email addresses and your own list of words found across one file or a batch. Each match is ticked or left, and the words, pictures and fields under it are taken out of the file, not covered.
A pattern misses a number written in an unusual way or split across two lines, and it never finds a name it was not given. Read the list of matches, and the result, before it goes.
OBSCURA Keep
A clinician’s own logins and two-step codes, and their registration, indemnity and training certificates with every renewal date on one timeline, encrypted on their own device with Argon2id and AES-256-GCM.
Keep belongs to one person. It is not a place for patient records, and there is no shared vault for a practice.
Where patient information leaks from files
Names in capitals are single tools: free to open and to check a file with, and Pro to save the result. A name marked Pro is a service inside the Sovereign Suite, which is Pro as a whole.
A letter or note shared without the patient
A colleague, a supervisor or a researcher needs the clinical content, not the name, the address or the record number.
- MEDISCRUB: masks names, addresses, postcodes, phone numbers, emails, NHS, Medicare and insurance numbers and record numbers in pasted text, and keeps the diagnosis, findings and medication readable; dates are your choice
- OPTIC: reads the text out of a scanned letter or a photograph, on the device, so it can be masked
- SEAL: redacts a PDF so the text under the boxes is gone, not hidden
- SCRIBE: transcribes a dictation or a recorded conversation on the device, so the text can be masked before anyone else reads it; the speech model downloads once, then works offline
Read first: whether it is safe to send a medical letter.
Clinical photographs
A phone photograph carries where and when it was taken, and the frame can hold a face, a tattoo or a wristband.
- CLOAK: strips the location, time and camera details, and blacks out anything in the frame
- VEIL: pixelates a face or a mark at full resolution, so the detail is gone from the file you send
- SCREENSHIELD: black boxes painted into a screenshot from the records system, exported as a new image
Exports for audit and research
Taking the names out does not make a dataset anonymous. A date of birth, a postcode and a sex identify most people between them.
- DATASCAN: finds the columns in a CSV or JSON file that hold identifiers with a shape; diagnoses and free-text notes are not found
- CLEANSHEET: removes hidden sheets, pivot caches, formulas and comments from an .xlsx
- ANON: consistent codes from a keyed hash, the same code for the same patient in every file
- CROWD: works out k-anonymity: who is unique, and what blurring each column would buy
- SAMPLE: a seeded random sample of records for a clinical audit, which anybody can reproduce
Read first: k-anonymity before you publish.
Sending to a patient, a colleague or an insurer
Email passes through several systems on the way, and each can read an ordinary attachment.
- Send a file securelyPro: files sealed into one page that opens with a passphrase sent another way
- CAPSULE: the encrypted, self-opening HTML file behind it; the recipient needs nothing installed
- PADLOCK: an AES-256 password on a PDF
Records and when something goes wrong
The registers a practice is asked for, kept where the practice can find them.
Why it matters that the file stays on the machine
Uploading a patient’s letter to an online redaction or conversion service is a disclosure to that service, whatever its terms say it does next. With these tools the file is read from the clinic’s own computer and worked on in the browser tab, and nothing is uploaded. No health information reaches us, so there is none for us to hold, lose or disclose.
The rules on who may hold patient information on a clinic’s behalf attach to whoever holds it. In the United States, a company that receives, keeps or transmits it for a covered entity is usually a business associate and needs an agreement; in the UK, a service that processes it for a practice is a processor and needs a contract. None of these tools or applications sends a file to OBSCURA, Research and PDF Studio included, so OBSCURA is not given patient information to hold. Whether that means no agreement is needed for a particular use is for the clinic’s privacy officer or data protection officer to decide. What OBSCURA does process for a paying organisation, which is seat records and never patient data, is set out in the data processing agreement, and how to check the rest yourself is on the verification page.
That is a fact about how the software is built, not a certification. OBSCURA does not claim compliance with HIPAA, the UK GDPR or any health data standard, and it is not a medical device. A clinic using it still has to meet its own obligations: who may see a record, on what basis it is shared, how the computers it sits on are secured, and how long it is kept.
Masking is not anonymising. MEDISCRUB finds identifiers that have a shape. It does not find a name in a sentence no list contains, a relative, or an employer, and a rare condition in a small place can identify a person on its own. Read the masked version through before it goes.
A worked example: a case sent for advice
A GP wants a specialist’s view on a case without sending the patient’s identity. On the practice computer:
- The referral letter is a scanned PDF. OPTIC reads its text on the computer.
- MEDISCRUB masks the name, address, NHS number and hospital number. Dates are kept, because the interval between onset and presentation is the point of the question.
- The GP reads the result through and removes, by hand, the one detail no pattern could know about: the patient’s employer.
- The photograph of the lesion goes through CLOAK, which strips the location and time, and VEIL covers a tattoo at the edge of the frame.
- Both go to the specialist through Send a file securely, with the passphrase given by phone.
What it costs a clinic
Every tool above is free to open and to check a file with. Saving the redacted PDF, the cleaned photograph or the checked export is Pro.
- Free, for everyone
- The Workspace: Docs, Sheets, Slides, Notes, Calendar, Tasks, Contacts, Plan, Drive and the PDF editor, at work as well as at home. And every single tool on this page, to open a file and see what it finds, with no account.
- One application, for one person
- US$4 a month or US$35 a year, with 7 days free: Research, PDF Studio or Keep on its own, whichever the clinic works in.
- Pro, for one person
- US$9 a month or US$79 a year, with 7 days free. Every application, and saving the result in every tool outside the Workspace.
- More than one person
- For now each person needs a plan of their own: a key is for one person, on every browser they use. Plans for a team or a business are not offered at the moment. A clinic that already has one keeps it, and whoever holds its key goes on adding people and taking them off at /seats.
- Not included
- No admin console, single sign-on, audit log or shared team storage: each person’s work stays on their own machine. The page for teams lists the rest, with the answers a security reviewer will ask for.
Checkout is Stripe’s: the card is asked for at the start and not charged until the seven days are over, and if you cancel before then nothing is paid.
Questions
Is OBSCURA HIPAA compliant?
We make no such claim, and no software on its own makes an organisation compliant. What can be said precisely is that the tools run in the browser and no patient file is sent to us or to anyone else. The clinic’s own obligations are unchanged.
Is a masked record anonymous?
No. It is de-identified: the direct identifiers are gone, and what is left can still identify somebody in combination. MEDISCRUB says so on its own page, and it is not a safe-harbour determination or a legal opinion.
Where does the data sit while a tool works?
In the memory of the browser tab, on the computer in front of you. Anything saved goes to a folder you choose. A few tools keep their own records in that browser’s storage, which clearing site data removes.
Does it need anything installed on practice computers?
No. It is a web page over HTTPS in a current browser. The page for teams has the answers your IT provider will ask for, including how to confirm nothing is uploaded.
Can it read handwritten notes?
OPTIC is built for printed text in photographs, screenshots and scans, and marks every word it is not sure of. Do not rely on it for handwriting.
Guides for this work
Questions this work runs into, each answered in full and ending at the tool that does the job.
- Is it safe to send a medical letter or test result?: Everything written about this is aimed at clinics, and none of it binds you as the patient.
- Check a dataset before you publish it: Postcode, date of birth and sex identify most of a population on their own. What k-anonymity measures, what generalising costs, and why a comfortable k can still give the whole answer away.
- How to anonymise names in a spreadsheet, and keep the same person the same: Find and Replace is not consistent across a second file and a lookup table is the re-identification key written down.
- Transcribe a recording without uploading it: Speech recognition in the tab: what a small model gets right, where it invents, and why an interview or a consultation should never be handed over.
- The triage sieve and START, and where they disagree: They agree on almost every casualty and not on all of them. Plus the bookkeeping that actually fails at a multiple-casualty scene.
- Checking a rota: rest, runs and the rolling week: A late then an early is nine hours and looks fine in a grid. Why a calendar week hides the worst fortnight in most rotas ever written.
The same tools, for other work
This page describes what the tools do. It is not clinical, legal or compliance advice, and nothing on it says that using them meets any health data requirement.