De-identification in the browser
Your clients' names never reach the AI.
Names, NHS numbers, dates, postcodes, phone numbers, and email addresses are swapped for placeholders in your browser before anything is sent, and your browser puts the real names back when the draft returns. The AI only ever sees the placeholders.
Eight categories of identifying detail, swapped for placeholders.
You confirm each swap before anything is sent for drafting.
Where the mapping back to real names lives, and who can read it. How de-identification works →
Putting your client's name into someone else's tool is not a decision you can responsibly make.
Most consumer AI tools take whatever you paste, and their terms rarely make hard commitments about what happens next. The question of where a client's name ends up is passed silently to the clinician with the registration to protect. Cogent was built so the question never needs answering: the names are removed from anything the AI is shown.
Five steps from your screen to the model and back.
Your browser does the detection the cloud should not, removing the names before the text reaches the drafting AI, so the drafting model and its sub-processors only ever work with placeholders. Live session audio is the one exception, since it has to be transcribed before it can be masked.
- 01
You write or transcribe in the browser.
You can type your shorthand, paste a longer note, or run live in-session transcription, and at this stage everything is still sitting on your device with nothing having moved.
- 02
Cogent spots identifiers and highlights them for you.
Names, NHS numbers, postcodes, UK phone formats, email addresses, and dates are detected by a tokeniser running in your browser, never on a server, and you confirm what has been identified before anything is sent anywhere.
- 03
Identifiers are replaced with placeholders before anything reaches the AI.
Sara becomes [PERSON_1], Lucy becomes [PERSON_2]. The mapping back to the real names is stored encrypted on Cogent's UK servers rather than locked to one machine, so it follows you across devices and a forgotten password is an ordinary email reset.
- 04
Only the placeholder version reaches the AI.
The UK-hosted AI service drafts the document from the placeholder version, so the AI and our sub-processors never receive the real names, and your content is contractually excluded from training any external model.
- 05
Real names are put back in your browser for you to read.
The draft returns with placeholders still in place, and your browser puts the real names back for display. You sign off as the author of record.
You stay the controller, and Cogent operates as a processor that keeps the names away from the AI.
Your clients are your data subjects and you are their controller; Cogent operates as your processor. The drafting AI, and every outside service behind it, only ever receives the placeholder version.
- 01
The drafting AI never receives your clients' names.
The names are taken out in your browser before the text is sent for drafting, so the drafting model and its sub-processors only ever work with the placeholder version. The one exception is live session audio, which is streamed to our EU transcription provider before any masking is possible, so the raw audio may contain identifiable speech; only the returned text is then de-identified.
- 02
Your records are stored encrypted at rest in the UK, with access tightly controlled and logged.
The mapping and your drafts are held under an encryption key on UK infrastructure, access is least-privilege and recorded, and the names that connect to the placeholders are never exposed to the AI.
- 03
The AI provider is contractually prohibited from using your content to train any external model.
The placeholder version is processed for the drafting and nothing about a session is used to train the model or sold to anyone.
- 04
Hosting, storage, and AI processing all run inside the United Kingdom.
The one exception is live session transcription: the raw audio is streamed to our EU transcription provider in Dublin before any masking is possible, so it may contain identifiable speech, under the UK Addendum to the EU SCCs. The full Data Processing Agreement sets out the controller-processor relationship and this transcription path in detail.
Try it on this week's work.
Ten generations a month free, with no card and no time limit. Upgrade once Cogent has earned the cost of a session in time saved.
Start free