Import & automated redaction
Paste or upload a donated chat transcript. The engine detects direct and contextual identifiers, replaces them with semantic tags such as [name-1] [relative's name-1] [friend's name-1] [date-1], and flags quasi-identifiers for your review. Raw text is held in memory only until you purge originals.
Source transcript
Participant submissions encrypted packages from the participant edition
Submissions inbox pull donations from the study endpoint
Another kind of endpoint (advanced)
Redaction preview nothing is saved until you confirm
Tag vocabulary
Human review
Automated redaction is assistive, never sufficient. Confirm or reject each machine decision, resolve flagged quasi-identifiers, and add anything the engine missed. A transcript enters analysis exports as verified only after it is marked reviewed.
De-identified transcript select text to redact it manually or save it as a quote
Detected identifiers one row per person or item; spellings of the same name are grouped under one tag
Manual redaction
Repository
The de-identified corpus. Everything below reflects redacted text only; originals, where retained, live in memory and local browser storage on this device until purged.
Participant withdrawal remove every transcript donated under one token
Participants
The study's master file, kept in the Supabase database: one locker per participant, opened when they sign the online consent form, with their token, consent answers, token emails (followed to delivery), donations, compensation, withdrawals (recorded here or by the participant on the consent form), and the linking entry that is destroyed 30 days after their last donation. Names and email addresses appear only for the principal investigator and the student lead.
Dashboard
Automated descriptive analysis of the de-identified corpus: what was redacted, what the donated chats cover, and where residual risk sits.
Redaction types and frequency
Life-domain coverage dominant domain per transcript
Theme intensity by domain hits per 1,000 words
Redaction density per transcript re-identification pressure proxy
Conversation structure
Residual risk levels
Human-AI impact lens
Each transcript is scored against four analytic domains drawn from the human-AI interaction literature, which organizes user-level impacts of conversational AI as cognitive, behavioural, and attitudinal, moderated by individual vulnerability: epistemic effects (cognition), behavioural influence, user perceptions of AI (attitudes), and vulnerability factors. Indices are lexicon hits per 1,000 user words; treat them as screening signals to steer close reading, not as validated measures.
Corpus profile across the four domains
Epistemic autonomy map verification vs reliance, per transcript
Per-transcript indices
Strongest evidence excerpts per domain
Quote bank
Automatically extracted, de-identified excerpts with theme and speaker attribution, plus anything you saved during review. Export as a coding matrix for NVivo or Excel.
Hypothesis lab
Exploratory tests on transcript-level metrics. With a small corpus these are hypothesis-generating only; nonparametric alternatives are reported alongside parametric tests.
Result
Visual
Risk register
Every privacy or welfare risk the pipeline identifies, with how it was addressed. Statuses are editable; the register exports for REB reporting.
Exports
Quantitative files are CSV (UTF-8, Excel- and R-ready). Qualitative files carry de-identified text only. Every export is written to the audit log.
Quantitative
Qualitative
More formats
Participant edition kit two-edition deployment
The Studio ships in two builds from one codebase. The participant edition offers import (single or bulk with donation labels), automated de-identification, mandatory review of their own transcripts, and an encrypted submission package; it has no dashboard, no corpus views, and no protocol editing. The research edition is this one. Submissions are encrypted in the participant's browser to the study's public key, so whatever hosts the drop only ever holds ciphertext of already de-identified text; original strings never leave the donor's device at all. Three transports are supported, set in PARTICIPANT_CONFIG at deployment. Direct upload: the website itself stores submissions; the participant edition POSTs the encrypted package to a receiving endpoint and shows the donor a receipt code, with an automatic download fallback if the endpoint is unreachable. Recommended endpoints, in order: an institutional endpoint on SFU infrastructure, or a managed backend pinned to a Canadian region, for example a Supabase project created in AWS Canada Central (ca-central-1), where a public insert-only key lets anyone deposit and no one read, and reading requires a team member's sign-in, which happens only in this research edition. File-drop link: the donor downloads the package and uploads it at a page you host, such as an upload folder on institutional storage. None: download only. In every mode the endpoint holds ciphertext of already de-identified text; any HTTPS target works because the payload is protected before transport.
Website settings config.js, read by the participant portal and the consent form (v3.6)
Build the participant edition the two editions are one codebase; this writes the donor-facing file with your configuration inside
Participant tokens issued by the consent form
Since v3.6, a token is created when a participant signs the online consent form, and emailed to their SFU address with the link to the De-ID Studio. Tokens, consent answers, names, and addresses live in the study database; Participants shows them to the team, and the repository marks any transcript whose token the database does not know. The Token Registry file and tokens.json of v3.5 are no longer needed: anyone who received a v3.5 token can be added under Participants, Add someone who consented another way, keeping their token.
Older token bank (v3.5), used only when Participants has not been loaded
Hosting on your own website static files
The deployment guide (README-DEPLOY in the deployment kit) gives the exact steps. In short: the website folder holds the participant portal (index.html), the consent form (consent/index.html), config.js, and a small settings file for the host, on Netlify, the lab's site, or any static host that serves HTTPS. The consent lockers, the token emails, and the encrypted packages live in a Supabase project in Canada (Central). Publish only the participant edition and the consent form. Keep this research edition off the public web: run it from a file on a team computer, because it is where the private key and the decrypted transcripts live. What the pages need from their host: HTTPS, and outbound access only to the study's Supabase project and the few public sources the portal may load (a spreadsheet reader when a donor imports an Excel file, and the entity model only if the contextual layer is switched on), which the kit's settings file allows and nothing else. Donors need a current browser (Chrome, Edge, Firefox, or Safari from 2023 onward); Word import uses the browser's built-in decompression.
Workspace
Methods note for REB / manuscript
Package & submit
Your transcripts are packaged exactly as you see them in Review: de-identified text, tags, your donation labels, and a redaction log without any original wording. Original text never leaves this device. The package is then encrypted so only the research team can open it.
Submission checklist
Your receipts
After submitting
Nothing you imported is sent anywhere automatically. When your upload is done, you can remove everything from this browser.
Protocol & audit
Configure the de-identification protocol, manage stored data, and inspect the audit trail.
Contextual detection layer transformer NER, runs locally
A neural named-entity model that reads context, catching names, places, and organizations the rule layer does not know. The model (a one-time download of roughly 100 MB from a public model CDN) is cached by your browser; all inference runs on this device and transcript text is never uploaded. Detections at or above the confidence threshold are auto-redacted for direct-identifier categories; everything else is flagged for your decision. Scans are cached per transcript so downstream reprocessing stays reproducible, and the model and scan time are logged in the audit trail.
Re-identification drivers & regulatory alignment FIPPA, PIPEDA, HIPAA
What commonly re-identifies people is rarely a stray name: it is combinations of ordinary details. An age with a program and a campus; a workplace with a neighbourhood; a date tied to an event; a rare attribute in a small population; a story specific enough that exactly one person fits it; a handle that bridges to a public profile. Auxiliary knowledge the reader already holds does the rest. That is why this tool treats quasi-identifiers as first-class citizens: they are flagged rather than ignored, their co-occurrence raises the mosaic condition, and the corpus surface counts how many transcripts share each visible value.
FIPPA, which governs SFU as a BC public body, writes the same insight into law: personal information includes anything that identifies a person through association or inference. The Act expects reasonable security (s. 30), permits research disclosure only under the five conditions of s. 35, and since the 2021 amendments requires privacy management programs (s. 36.2) and breach notification when significant harm is reasonably expected (s. 36.3). This tool's local-only processing, purge, encrypted workspace, and audit trail are that story in working form. PIPEDA, the federal private-sector statute, does not govern university research here but sets the national benchmark with its ten fair information principles; its safeguards principle scales protection with sensitivity, and health content is expressly sensitive.
To be on the safe side, the engine is additionally mapped against HIPAA's Safe Harbor list of 18 identifiers, the most widely used engineering checklist for de-identification even though HIPAA does not apply in Canada. Where the checklist and this design differ, the design is stricter: all ages are treated, not only those over 89, and full postal codes are always removed.
| # | HIPAA Safe Harbor identifier | Mechanism here | Status |
|---|---|---|---|
| 1 | Names | Lexicons, intro/honorific/initial patterns, contextual NER, propagation | Automated + review |
| 2 | Geography below province/state | Addresses, full postal codes, city lexicon, contextual NER; nothing below province retained by default | Automated + review |
| 3 | Dates tied to a person; ages over 89 | All calendar dates redacted; stated birth years redacted; ALL ages flagged or redacted (stricter than HIPAA's 89 threshold) | Automated, stricter |
| 4 | Telephone numbers | Phone pattern (any separator style) | Automated |
| 5 | Fax numbers | Same numeric pattern as phone | Automated |
| 6 | Email addresses | Standard and spelled-out ("at ... dot ...") patterns | Automated |
| 7 | Social Security numbers | US SSN pattern; Canadian SIN pattern | Automated |
| 8 | Medical record numbers | MRN / chart / patient-number contextual triggers | Automated |
| 9 | Health plan beneficiary numbers | PHN / care card / MSP / beneficiary / policy triggers; bare BC PHN pattern | Automated |
| 10 | Account numbers | Account / membership contextual triggers; long digit runs | Automated |
| 11 | Certificate / licence numbers | Licence / permit / certificate / registration triggers | Automated |
| 12 | Vehicle identifiers, plates | Plate context trigger; 17-character VIN pattern | Automated |
| 13 | Device identifiers, serials | Serial / IMEI / device-id triggers | Automated |
| 14 | Web URLs | Link pattern | Automated |
| 15 | IP addresses | IPv4 pattern | Automated |
| 16 | Biometric identifiers | Not detectable in donated text; textual mentions fall to the residual audit and reviewer | Human review |
| 17 | Full-face photographs and comparable images | Intake is text-only; participants are instructed not to donate images | Out of scope by intake |
| 18 | Any other unique identifying number, characteristic, or code | Generic number patterns, residual token audit, corpus surface, mandatory human review | Automated + review |