Protection recall counts an identifier as protected only when every character of it is covered. Precision counts a redaction as correct when it overlaps a labelled identifier.
All test notes are synthetic and generated from templates. The held-out set was written by a separate author who did not see the detection code. Real notes will be messier; the numbers above are an upper bound until a clinic pilot measures them on real text.
Redaction runs in your browser through Pyodide. Only the redacted note crosses the perimeter. The demo endpoint re-checks for identifiers and refuses text that still contains them, caches answers, and stops after a small daily number of model calls.