The discharge letter reaches the model. The patient does not.

what the model receives

5 hospital documents in 5 languages, masked by the engine

Each document is invented, written in its country's own language and layout, and masked exactly as the gateway masks it for a hospital: the Healthcare preset on and the catalogue narrowed to the document's country. The right-hand side is not a mock-up — it is the engine's output, regenerated with every release and checked against the engine by a test, so this page cannot show a mask the product no longer makes.

Klinikum Musterstadt — Klinik für Kardiologie, Station 3B
Entlassbrief
Patient: Thomas Becker, geb. 01.02.1960
Anschrift: Musterstraße 12, 10115 Berlin
Versichertennummer: A123456789
Fallnummer: 2026004512
Aufnahme: 12.03.2026, Entlassung: 18.03.2026
Diagnose: I21.4 Nicht-ST-Hebungsinfarkt
Medikation: Metoprolol 47,5 mg 1-0-1
Allergien: Penicillin

Sehr geehrte Kolleginnen und Kollegen,
der Patient stellte sich mit seit zwei Tagen bestehenden Thoraxschmerzen vor. Die Koronarangiographie zeigte eine hochgradige Stenose, die mit einem Stent versorgt wurde. Die Entlassung erfolgte beschwerdefrei; Wiedervorstellung in 2 Wochen.

Dr. Erika Musterfrau, LANR 123456701

Klinikum Musterstadt — Klinik für Kardiologie, Station 3B
Entlassbrief
Patient: [Person 1], geb. [DOB 1]
Anschrift: [Address 1]
Versichertennummer: [Health 1]
Fallnummer: [Health 2]
Aufnahme: [Date 1], Entlassung: [Date 2]
Diagnose: [Health 3]
Medikation: [Health 4]
Allergien: [Health 5]

Sehr geehrte Kolleginnen und Kollegen,
der Patient stellte sich mit seit zwei Tagen bestehenden Thoraxschmerzen vor. Die Koronarangiographie zeigte eine hochgradige Stenose, die mit einem Stent versorgt wurde. Die Entlassung erfolgte beschwerdefrei; Wiedervorstellung in 2 Wochen.

[Person 2], LANR [Health 6]

Huisartsenpraktijk Voorbeeld — Verwijsbrief
Aan: polikliniek Cardiologie
Patiënt: Jan Jansen, geboren 15-07-1985
BSN: 274819363
Adres: Voorbeeldstraat 12, 1234 AB Amsterdam
Telefoon: 06 12345678

Geachte collega,
Graag verwijs ik de heer Jansen naar u voor beoordeling van hartkloppingen bij inspanning, zonder syncope. Het ECG in rust was normaal. De heer Jansen gebruikt geen medicatie.

Met collegiale groet,
dr. Anna de Vries, huisarts, AGB-code 01234567

Huisartsenpraktijk Voorbeeld — Verwijsbrief
Aan: polikliniek Cardiologie
Patiënt: [Person 1], geboren [DOB 1]
BSN: [ID 1]
Adres: [Address 1]
Telefoon: [Phone 1]

Geachte collega,
Graag verwijs ik de heer [Person 1] naar u voor beoordeling van hartkloppingen bij inspanning, zonder syncope. Het ECG in rust was normaal. De heer [Person 1] gebruikt geen medicatie.

Met collegiale groet,
dr. [Person 2], huisarts, AGB-code [Health 1]

Hospital Universitario de Ejemplo — Laboratorio de Bioquímica
INFORME DE RESULTADOS
Paciente: Lucía Fernández Ruiz
DNI: 87654321X
NHC: 1234567
Fecha de la muestra: 10/03/2026
Médico solicitante: Dr. Juan Pérez García, nº colegiado 282812345

Hemoglobina      13,2 g/dL     (12,0 - 15,5)
Leucocitos       7,4 x10^3/µL  (4,0 - 10,5)
Glucosa          98 mg/dL      (70 - 110)
HbA1c            38 mmol/mol   (< 39)
Creatinina       0,8 mg/dL     (0,5 - 1,1)

Todos los valores dentro del intervalo de referencia.

Hospital Universitario de Ejemplo — Laboratorio de Bioquímica
INFORME DE RESULTADOS
Paciente: [Person 1]
DNI: [ID 1]
NHC: [Health 1]
Fecha de la muestra: [Date 1]
Médico solicitante: [Person 2], nº colegiado [Health 2]

Hemoglobina      13,2 g/dL     (12,0 - 15,5)
Leucocitos       7,4 x10^3/µL  (4,0 - 10,5)
Glucosa          98 mg/dL      (70 - 110)
HbA1c            38 mmol/mol   (< 39)
Creatinina       0,8 mg/dL     (0,5 - 1,1)

Todos los valores dentro del intervalo de referencia.

SERVIZIO SANITARIO NAZIONALE — Ricetta elettronica
NRE: 1234A1234567890
Assistito: Mario Rossi
Codice fiscale: RSSMRA85T10A562S
Indirizzo: Via Esempio 10, 00100 Roma
Codice esenzione: 048
Terapia: Bisoprololo 5 mg, 28 compresse, una compressa al mattino
Medico prescrittore: Giulia Bianchi
Data: 12/03/2026

SERVIZIO SANITARIO NAZIONALE — Ricetta elettronica
NRE: [Health 1]
Assistito: [Person 1]
Codice fiscale: [ID 1]
Indirizzo: [Address 1]
Codice esenzione: [Health 2]
Terapia: [Health 3]
Medico prescrittore: [Person 2]
Data: [Date 1]

Cardiology Outpatient Clinic — Example Hospital
Patient: John Smith
NHS number: 943 476 5919
Hospital number: 1234567
Date of birth: 04/05/1958
Address: 12 Example Road, London SW1A 1AA

Dear Dr Patel,
I reviewed your patient in clinic today. His breathlessness has improved since his bisoprolol was increased, and the echocardiogram shows a preserved ejection fraction. He would like to return to cycling, which I have encouraged.
Diagnosis: Heart failure with preserved ejection fraction
Plan: review in clinic in three months.

Dr Sarah Jones, GMC 7654321

Cardiology Outpatient Clinic — Example Hospital
Patient: [Person 1]
[Health 1]
Hospital number: [Health 2]
Date of birth: [DOB 1]
Address: [Address 1]

Dear [Person 2],
I reviewed your patient in clinic today. His breathlessness has improved since his bisoprolol was increased, and the echocardiogram shows a preserved ejection fraction. He would like to return to cycling, which I have encouraged.
Diagnosis: [Health 3]
Plan: review in clinic in three months.

[Person 3], GMC [Health 4]

Tokens are shown as label and number. A real token also carries a namespace that changes with every request, so two requests never share one; the mapping that turns them back into names travels with your request and stays with you. These outputs are the rule layer alone — in production the name model runs beside it and can only add masks, never remove one.

what is masked

On by default, in every plan

your country's numbers

The numbers a hospital prints, jurisdiction by jurisdiction

Each family is measured under the label its own country's forms print, in each of that country's languages, with the catalogue narrowed to that one country — so a number is never protected by accident by another country's rule. A single value left in clear fails the build.

• Patient record52 jurisdictions
• Stay or admission52 jurisdictions
• Health insurance46 jurisdictions
• Clinician licence52 jurisdictions
• Prescription52 jurisdictions
• Referral49 jurisdictions
• Sick note42 jurisdictions

one click in your account panel

The Healthcare preset

Choose Healthcare in the account panel and it ticks these groups at once: health data behind its label — diagnosis, medication, allergies, sick leave, dates and times and case and file references, decision numbers. Nothing downstream is special — the preset only ticks groups you can see and change.

files and scans

The referral is often a scan

Switch file masking on and a docx, xlsx, pptx, csv or txt comes back masked and still opens. On plans with the OCR add-on (Pro and Enterprise), a scanned referral or a photographed page is read and returned as its masked text. See it on real files.

what stays readable, and why

The model gets the medicine, not the patient

Masking everything would leave the model nothing to work on. What is left in clear is chosen, and every choice can be changed in the account panel.

how a hospital connects it

Where your documents already go to a model

honest limits

What it does not do, said before you find out

• The name model matters for names in prose. The examples and the measured counts on this page are the rule layer. A name in running text that no rule recognises is the name model's job; it runs in production, and its own figures are not part of these counts.
• Diagnoses in running text stay readable unless you choose otherwise. With disease and medicine names switched on, a word is masked in every sense it has — the list cannot tell a stroke from a stroke of luck.
• A year on its own stays readable. Dates tied to the patient are masked by the preset; a bare year in a history is left on purpose.
• Scans are only as good as the reading. A value the OCR reads exactly is masked; a value read with damage — a digit lost, two letters swapped — may no longer match any rule and can go out in clear. It happens on low-resolution scans and phone photographs, so scan at a good resolution.
• A surname after a courtesy title can get a token of its own. It is masked, but today a later mention written with a title — Herr, Mr — may not share the full name's token, so the model can read two people where the letter means one.
• The coverage table is a statement about the labels we measured. A form label we did not list may not be recognised; tell us yours and it is measured before it is promised.