De-identification in the browser
Your clients' names never reach the AI.
Names, NHS numbers, dates, postcodes, phone numbers, and email addresses are detected and replaced with placeholders in your browser before any content is sent for processing, so the drafting AI and its sub-processors never receive identifiable details, and the mapping back to the real names is stored encrypted at rest on UK servers so it works across your devices, with the draft coming back from the model having the real names put back in by your browser for display.
Real names never reach the AI.
Eight categories of identifying content are detected and replaced with placeholders in your browser, and you confirm the swap, before anything is sent for drafting, so the AI model and the sub-processors only ever see de-identified text. The placeholder mapping that turns the placeholders back into real names is stored encrypted at rest under a managed key on UK infrastructure, with access controlled and logged.
Putting your client's name into someone else's tool is not a decision you can responsibly make.
Most consumer AI tools are happy to take whatever you paste, and their terms of service rarely make hard commitments about what happens next, which leaves the question of where a client's name ends up, whether in a training set, a debugging log, or a vendor's analytics, silently transferred from the AI company to the clinician with the registration to protect. Cogent Clinic was built so that the question never needs to be answered in the first place, because the identifying details are removed from anything the AI is ever shown.
The five steps that move your writing from your screen to the model and back, with the names taken out before the model ever sees them.
Your browser does the detection the cloud should not, removing the names before the text reaches the drafting AI, so the drafting model and its sub-processors only ever work with placeholders. Live session audio is the one exception, since it has to be transcribed before it can be masked.
- 01
You write or transcribe in the browser.
You can type your shorthand, paste a longer note, or run live in-session transcription, and at this stage everything is still sitting on your device with nothing having moved.
- 02
Cogent spots identifiers and highlights them for you.
Names, NHS numbers, postcodes, UK phone formats, email addresses, and dates are detected by a tokeniser running in your browser, never on a server, and you confirm what has been identified before anything is sent anywhere.
- 03
Identifiers are replaced with placeholders before anything reaches the AI.
Sara becomes [PERSON_1], the NHS number becomes [NHS_1], Lucy becomes [PERSON_2], and the mapping between the placeholders and the real names is stored encrypted at rest on Cogent's UK servers rather than locked to one machine, so it follows you across your devices and a forgotten password is just an ordinary email reset rather than something that loses you the names.
- 04
Only the placeholder version reaches the AI.
The UK-hosted AI service drafts the document from the placeholder version, so the AI and our sub-processors never receive the real names, and your content is contractually excluded from training any external model.
- 05
Real names are put back in your browser for you to read.
The draft returns with the placeholders still in place, and your browser uses the mapping to put the real names back in for display, while your records sit encrypted in transit and at rest inside the UK with access tightly controlled and logged, leaving you to sign off as the author of record.
You stay the controller, and Cogent operates as a processor that keeps the names away from the AI.
In data-protection terms your clients are your data subjects and you are their controller, while Cogent operates as your processor, and although your records are stored on Cogent's UK servers the drafting AI and its sub-processors only ever receive the placeholder version, so the real names never reach the drafting model. Live session audio is the one exception, since it must be transcribed before it can be masked.
- 01
The drafting AI never receives your clients' names.
The names are taken out in your browser before the text is sent for drafting, so the drafting model and its sub-processors only ever work with the placeholder version. The one exception is live session audio, which is streamed to our EU transcription provider before any masking is possible, so the raw audio may contain identifiable speech; only the returned text is then de-identified.
- 02
Your records are stored encrypted at rest in the UK, with access tightly controlled and logged.
The mapping and your drafts are held under an encryption key on UK infrastructure, access is least-privilege and recorded, and the names that connect to the placeholders are never exposed to the AI.
- 03
The AI provider is contractually prohibited from using your content to train any external model.
The placeholder version is processed for the drafting and nothing about a session is used to train the model or sold to anyone.
- 04
Hosting, storage, and AI processing all run inside the United Kingdom.
The one exception is live session transcription: the raw audio is streamed to our EU transcription provider in Dublin before any masking is possible, so it may contain identifiable speech, under the UK Addendum to the EU SCCs. The full Data Processing Agreement sets out the controller-processor relationship and this transcription path in detail.
Try it on this week's work.
The free tier covers ten generations a month with no card to start and no time limit on the trial, so you only upgrade when Cogent has earned at least the cost of a session in time saved.
Start free