Protection recall counts an identifier as protected only when every character of it is covered. Precision counts a redaction as correct when it overlaps a labelled identifier.
All test notes are synthetic. Each test set was written by a separate author who never saw the detection code. Blind set 2 is the honest measure for the current rules; set 1 was used to improve them after its first, blind run. Real notes will be messier, so treat these numbers as an upper bound until a clinic pilot measures leaks on real, consented text.
Redaction runs in your browser through Pyodide. Only the redacted note crosses the perimeter. The demo endpoint re-checks for identifiers and refuses text that still contains them, caches answers, and stops after a small daily number of model calls.