This runs the full Health Vault pipeline in your browser on a synthetic patient. The cryptography is real: AES-256-GCM for the Identity Vault, HMAC-based TOTP for the second factor, SHA-256 for the audit chain. Nothing is sent anywhere, because there is nowhere for it to be sent. That is rather the point.
A discharge record for a synthetic patient. Every identifier here is invented. Edit the note if you like; the anonymisation engine in Stage 3 will process whatever you type.
Before anything is processed, a byte-exact copy is written to object storage under a WORM lock and hashed. This is a legal record that a particular payload arrived at a particular time. It is never queried, never joined, and never read by an analyst.
Direct identifiers are extracted out of the clinical record and encrypted into a separate database on a separate host with separate credentials. What remains on the clinical side is a random integer. This is the move that everything else depends on.
subject_id is random and not a hash of the MRN.
Hashing feels safe, but a hash is only one-way over an unpredictable input. Hospital MRNs are short, structured and sequential:
APL/2024/08812 tells you the format. An attacker hashes every plausible MRN in the issuing range in
seconds and builds a complete reverse lookup. A random integer from a look-up table has no relationship to the input at all.Three transformations run here: dates are shifted, the clinical narrative is de-identified, and indirect identifiers are generalised.
One random offset per patient, applied to every date in their record. Drag it, and watch the intervals below stay exactly where they are.
Detection is a hybrid of dictionary lookup, regular expressions and context heuristics. What you put back is the interesting decision, try all four.
| Attribute | Before | After | Why |
|---|
This is the record every analyst, dashboard and local model sees. No privacy review is required to query it, because there is nothing here to review.
Here is a mock external dataset, the kind of thing an attacker actually has: an electoral roll extract for the district. Attempt to join it against the gold record above and find our patient.
| Name | Age | Sex | District | Ward |
|---|
A lab result has to reach a real person. Here is the only path back, and every condition is required.
The guarantee is not a promise in a contract. It is the absence of a route and the absence of a credential.
Attempt to POST the clinical corpus to a hosted LLM API.
The same task, computed inside the boundary.
Synthetic data throughout. No real patient record is present, and nothing you type leaves your browser. Companion to The Yajur Health Vault: Anonymisation by Architecture.
Method drawn from MIMIC-IV (MIT-LCP) and the SAIL Databank (Swansea University).
Built by Manish Sharma, Yajur.ai, September 2026. Part of Yajur Labs. The cryptography here is genuine (AES-256-GCM, HMAC-based TOTP, SHA-256 hash chaining) and operates only on invented data that never leaves this page.