Open the document
A clinical report, a letter, a result. PDF, DOCX, Excel, email, TXT, Markdown, CSV or image. Nothing leaves your machine.
For healthcare
The patient never leaves your machine.
A clinical report pasted into ChatGPT leaves the practice. Whether the model trains on it comes second. Anoni pseudonymizes it locally, so your patients never appear in an online AI.
Medical confidentiality
The duty is older than the AI.
These aren't our rules. They're the profession's.
- Medical confidentialityArticle L. 1110-4 of the French public health code: the duty covers all information concerning the person, and binds every professional in the health system. A name or an address counts as much as a diagnosis.
- HAS: October 2025France's health authority names ChatGPT, Copilot and Mistral, and asks professionals not to share confidential information.
- HAS and CNIL: February 2026Their draft guidance on AI in care flags a risk to medical confidentiality in prompts sent to online conversational agents. And notes that a patient's medical history alone can identify them, in the case of a rare disease.
Sources: article 4 of the French medical code of conduct · HAS (October 2025) · draft HAS-CNIL guidance (February 2026), a working draft dated 16 February 2026, open for public consultation until 16 April 2026. These sources are in French.
Going further: what the CNIL means by pseudonymization and anonymization.
How it works
Your documents, never your patients.
One click to pseudonymize, one click to decode. It all stays on the machine.
Anoni pseudonymizes
Name, date of birth, national ID, address, file number: each value becomes a believable stand-in. “Jean Dupont” becomes “Marc Leroy”, offline.
The AI works
A summary, a letter, a rewrite: you paste the text into ChatGPT, Claude or Copilot. Never your patients' identities.
You decode
The reply goes back through Anoni: the real data returns, from the encrypted vault on your machine.
In practice
And for the rest of the file.
Built for real files, not for demos.
- Patient identifiersThe NIR social-security number, a date of birth in digits or spelled out, an address, a town. Plus the hospital patient id or file number, recognized by its label, never from a bare number.
- Re-identification riskAfter redaction, Anoni flags what can still single someone out: date of birth, age, role, precise location, health data. A plain-language assessment, never a percentage.
- Scanned documentsLocal OCR reads a scanned PDF or a photo. When there is no text at all, you draw the black zones by hand: a signature, a stamp, a photo.
Questions
Let’s be plain.
The three we get asked first.
Wouldn't an AI hosted in France be simpler?
Hosting health data with a third party requires that third party to be a certified health-data host (HDS) and to store the data inside the European Economic Area (article L. 1111-8 of the French public health code). Anoni hosts nothing: the document stays on your machine. Anoni is not a certified host, and it does not make any other tool compliant on your behalf.
I removed the name. Is the report anonymous?
No. A date of birth, a town, a rare condition can still single a person out, and the draft HAS-CNIL guidance says exactly that about a patient's medical history. So Anoni shows a re-identification risk after redaction, in plain words and with no percentage. Read it over before you send.
I have an AI write up my reports. Same problem?
Yes, and it is the most common use of all. Anoni does not transcribe: it works on the text. Pseudonymize the report before you hand it to the AI, decode the reply afterwards. The patient never appears.
Run your next report through Anoni.
Free, no subscription. Just an email.
Download
No card · no tracker · 100% local