Mask private details before you paste

No. PHI Mask is Zero Data Retention: your files, filenames, text, detected values, and stand-in map are never sent to us, so we hold nothing to retain. See the Data Usage Policy.

Your files and text are processed in your browser, in whatever country you are working in. They are never sent to us and never stored by us.

No. Masking uses no LLM and no generative AI. Detection and masking run in your browser, and your text and files are not sent to a model provider by PHI Mask.

No, and we claim neither. Those reports attest to a vendor's handling of your data in the vendor's systems, and your files and text never enter ours. What our systems do hold is listed on the compliance page.

No. Handwriting is not read in your browser, so anything handwritten was not masked, even when the printed fields around it masked normally. Treat every handwritten entry as unmasked, and select it yourself to mask it.

Yes. The masked content is reversible and is mapped back to your real values in your browser.

PHI Mask is HIPAA-compatible. Your file is masked in your browser and never sent to us, so there is no BAA to sign, and without a signed BAA we cannot claim HIPAA compliance.

A business associate agreement (BAA) covers a vendor that creates, receives, maintains, or transmits protected health information for you. Your file never leaves your browser, so we hold none of it and there is nothing to sign.

Not by itself. Safe Harbor de-identification requires every one of the eighteen identifier types to be gone, and expert determination is a separate formal route. PHI Mask finds what it can and shows you the result. Your review is the gate, not the detection. Handwriting is never read in your browser, so check those fields yourself.

Sending a masked copy is still a disclosure to whoever receives it. Anything the mask missed travels with the file. Check the terms of the tool you paste into and whether your organization needs its own agreement with that vendor. That is a separate question from PHI Mask.

Treat it as a disclosure that already happened. Whether it has to be reported is a decision your privacy officer or your organization's process makes, not one a tool can make for you. Write down what was shared and when, delete the conversation if your account allows it, and check whether an agreement with that vendor covers the plan you were signed in to.

Personal use is free. Any professional, clinical, or client use (for patients, clients, a firm, or a practice) requires a commercial license. To start a pilot, request access.

No. PHI Mask is commercial software: personal use is free and commercial use requires a license. We plan to publish source you can read for personal use once enterprise licensing makes that sustainable.

Choose monthly billing or pay annually upfront. Both are priced per user. Your Stripe invoice confirms payment but is not the seat assignment by itself, so keep the invoice number in case you need billing help.

Use the request form for activation, seat, cancellation, refund, or invoice questions. Include the Stripe invoice number if you have one. Never send card details, PHI, or original files. use the request form.