Privacy & de-identification

Structured student fields (name, grade, date of birth, district ID) are deliberate, consented data behind row-level security. The real exposure is unstructured text: IEP documents, handwriting captures, session transcripts and generated notes routinely carry names, dates of birth, addresses, sibling names and staff names. De-identify mode targets exactly that text.

• De-identify mode is a workspace-level setting, enabled by an owner or admin. An individual clinician cannot disable it.
• It is on by default for new district workspaces; owners can turn it off.
• Enabling it does not rewrite text that was captured before it was switched on.

Before free text is stored or sent for generation, each identifier is replaced with a stable token drawn from a per-student token map held in a restricted table. The same child is always [STUDENT], the same parent always [GUARDIAN_1], across every document and session, so the text stays clinically coherent without carrying the identity.

• Typical tokens: [STUDENT], [GUARDIAN_1], [DOB], [PHONE], [EMAIL], [ADDRESS], [ID], [STAFF].
• Tokenization is applied to imported IEP text, handwriting transcription results, session transcripts and generated SOAP, progress and family text.
• Clinicians reading the app see real names: the token map is used to re-insert them at display time, never stored back into the text.
• The parent portal restores the child's first name only. No other identifier is rehydrated for families.
• Copy and PDF export ask, per copy, whether the named or de-identified version is wanted, there is no sticky preference.
• Audio recordings are not altered; they remain governed by the recording consent controls. Their transcripts are tokenized before being saved.

Detection is not silent. Whenever text is ingested, LumaLayer scans it and pauses for a human confirmation before anything is saved or sent.

• Known-entity matching first: the student's own name, date of birth, district ID, and guardian names and emails already on the record. This is the high-confidence pass.
• Pattern matching second: dates, phone numbers, email addresses, street addresses and ID-shaped numbers.
• Name-shaped candidates third: capitalized patterns that are not in the clinical allowlist.
• A review panel lists every detected value with its replacement token, and lets the clinician keep a clinical term, redact something the scan missed, or add a value by hand.
• Processing continues only after the clinician confirms.

Each de-identification event is recorded: what kind of text was ingested, how many identifiers were replaced, and which categories they fell into. The audit record never contains the identifiers themselves.

• Owners and admins review it in the workspace privacy audit, filtered by date range.
• Summary counts, a category breakdown and recent activity are shown; the CSV export is identifier-free and suitable for a district or compliance request.
• Exports, disclosures, approvals and AI-output reviews continue to be written to the separate append-only audit log.

A separate workspace mode for onboarding, demos and support reproduction. The workspace runs on a generated sample roster; real student records cannot be created, session recording is unavailable, a persistent training banner is shown, and every generated PDF is stamped SAMPLE — NOT A CLINICAL RECORD.

• Automated detection is a strong assist, not a guarantee. The review panel is the control; the clinician is the last check.
• De-identification reduces what is exposed to AI processing and storage. It is not a claim of HIPAA Safe Harbor de-identification for the workspace as a whole, because the underlying student record remains identified by design.

Related: Security and Privacy policy.