What leaves, and who could be found in it.
Both sides ask this first. Move across a record to see it as it stays on the owner's systems, and as it leaves them.
NAME, POLICY, PHONE, CARD, PAN, ADDRESS are replaced before export.
REMOVED, PSEUDO-ID, SHIFTED, REMOVED are replaced before export.
Examples with invented values. Tags show what replaced each detail.
Six commitments
- 01
Runs at the source. The pipeline runs inside the owner's environment, as a container or an on-prem agent. Raw audio, DICOM and reports never reach Quarry or the lab. Where a lab brings its own at-source tooling, Quarry verifies its output instead.
- 02
Audio and transcripts. Speech is transcribed locally. Names, phone numbers, addresses, card and account numbers, Aadhaar, PAN, policy and claim numbers are detected and replaced: tone or silence in audio, tags in text.
- 03
Imaging. DICOM headers are cleaned to the PS3.15 confidentiality profile; burned-in text is detected and masked in pixel data; reports are redacted; dates are shifted consistently per patient; pseudonymous IDs keep studies linked.
- 04
Verified before release. A sample of every batch is reviewed by people and by automated scans. The owner signs off before anything is exported.
- 05
Residual risk tested. Re-identification risk is assessed per dataset. US health data uses HIPAA Safe Harbor or Expert Determination.
- 06
Licensed use only. Licences ban re-identification attempts and linkage to other data to identify people.
Three passes before anything leaves
Every batch goes through all three, on the owner's systems. Point at a sieve to lift it clear.
- 01
Audio and transcript redaction
Speech is transcribed on the owner's systems; names, numbers, Aadhaar, PAN, policy and claim numbers are found and replaced with a tone or a tag.
- 02
Headers, pixels and reports
DICOM headers cleaned to the PS3.15 profile, burned-in text masked, reports redacted, dates shifted per patient, IDs made pseudonymous.
- 03
QA and owner sign-off
People and automated scans review a sample of every batch. The owner signs it off before anything is exported.
- →
The pan. Only what passed all three is exported, with a hash log of every file.
What stays, and what crosses
Everything on the left stays with the owner. Only the right-hand column ever reaches a lab.
- Raw call audioAudio with spoken details toned out
- Raw transcriptsTranscripts with details tagged
- DICOM as acquiredDICOM to the PS3.15 profile, pixels cleaned
- Reports with namesReports redacted, dates shifted
- The key from pseudonyms to peoplenothing crosses
- The agent's working filesnothing crosses
- Hash of every exported fileHash log, for checking delivery