Choose the right
PHI Mask plan

No. PHI Mask does not receive, store, or log the documents and text you mask. Detection and masking run locally in your browser. See the Data Usage Policy.

Your files and text are processed in your browser, in whatever country you are working in. They are never sent to us and never stored by us. Your known contacts stay in this browser until you delete them.

No. Masking uses no LLM and no generative AI. Detection and masking run in your browser, and your text and files are not sent to a model provider by PHI Mask.

Only on a best-effort basis, and it misses a lot. Some handwritten entries are masked and others pass through untouched, even when the printed fields around them masked normally. Treat every handwritten entry as unmasked until you have checked it, and select anything still showing to mask it.

Yes. The masked content is reversible and is mapped back to your real values in your browser.

PHI Mask is HIPAA-compatible. Your file is masked in your browser and never sent to us, so there is no BAA to sign, and without a signed BAA we cannot claim HIPAA compliance.

A business associate agreement (BAA) covers a vendor that creates, receives, maintains, or transmits protected health information for you. Your file never leaves your browser, so we hold none of it and there is nothing to sign.

Not by itself. Safe Harbor de-identification requires every one of the eighteen identifier types to be gone, and expert determination is a separate formal route. PHI Mask finds what it can and shows you the result. Your review is still needed. Handwriting is read only on a best-effort basis, so check those fields yourself.

Sending a masked copy is still a disclosure to whoever receives it. Anything the mask missed travels with the file. Check the terms of the tool you paste into and whether your organization needs its own agreement with that vendor. That is a separate question from PHI Mask.

Treat it as a disclosure that already happened. Whether it has to be reported is a decision your privacy officer or your organization's process makes, not one a tool can make for you. Write down what was shared and when, delete the conversation if your account allows it, and check whether an agreement with that vendor covers the plan you were signed in to.

PHI Mask is GDPR-compatible. Your file is masked in your browser and never sent to us, so there is no data processing agreement to sign, and without a signed data processing agreement we cannot claim GDPR compliance.

A data processing agreement covers a processor that processes personal data on a controller's instructions. Your file never leaves your browser, so we process none of it and there is nothing to sign. PHIMask.com is a controller for the website and support data described in the Privacy Policy.

It depends on your Output setting. Mask leaves a placeholder you can map back to the real value, so that copy is still personal data. Redact removes the value from the exported copy for good, so there is nothing to map back. Neither setting makes the whole copy anonymous. That bar is whether anyone who might reasonably try can still get back to the person, and it turns on what else the copy shows.

PHI Mask is PIPEDA-compatible. Your file is masked in your browser and never sent to us, so there is no contract to sign, and without a signed contract we cannot claim PIPEDA compliance.

No. PIPEDA asks for a contract when you hand personal information to a third party to process. Your file is masked in your browser and never sent to us, so you hand us none of it and there is no contract to sign. Accountability for that information stays with your organization.

PHI Mask is PHIPA-compatible, HIA-compatible, and Law 25-compatible. Your file is masked in your browser and never sent to us, so there is no agent agreement to sign, and without a signed agent agreement we cannot claim PHIPA or HIA compliance. Nothing of yours is transferred outside Quebec, so there is nothing for Law 25 to assess and no Law 25 compliance to claim.

PHI Mask is SOC 2-compatible and ISO 27001-compatible. Your file is masked in your browser and never sent to us, so there is no system of ours for an auditor to examine, and without an audit we cannot claim SOC 2 or ISO 27001 compliance. PHI Mask holds no SOC 2 report and no ISO/IEC 27001 certificate.

Yes. Free supports personal and professional work, with no account required. The extension starts with a 14-day unlimited trial, then includes 10 masks per week. Professional includes unlimited masks.

Yes. Free supports personal, professional, clinical and client work. Professional includes unlimited masks. For a team pilot, request access.

No. PHI Mask is commercial software. Free supports personal and professional use; Professional includes unlimited masks. We plan to publish source you can read for personal use once enterprise licensing makes that sustainable.

Choose monthly billing or pay annually upfront. Both are priced per user. Your Stripe invoice confirms payment but is not the seat assignment by itself, so keep the invoice number in case you need billing help.

Use the request form for activation, seat, cancellation, refund, or invoice questions. Include the Stripe invoice number if you have one. Never send card details, PHI, or original files. use the request form.