Strips PHI on-device before any AI sees it. Generates a cryptographic audit record per session. Built for the Privacy Act.
Clinicians paste names, MRNs and Medicare numbers into AI tools every day — not from negligence, from invisibility. The data leaves the device the moment "send" is clicked. There is no artefact to show what was sent.
Held-out synthetic Australian clinical text — geriatric, RACF, primary-care vocabulary. Every release ships the numbers.
Australia's privacy regime is principles-based. APP 11's "reasonable steps" test is what your compliance team has to defend. CleanRoom is the technical artefact that defends it. — click any to expand —
Healthcare AI built for Australia answers to Australian law and to Australian clinicians. Both are non-negotiable. CleanRoom is built for both.
Most healthcare privacy tools are built by engineers who have never written a discharge summary, a CGA, or a referral letter at 9 PM after a long ward round. CleanRoom started in geriatric practice. Every entity type, every false-negative case, every workflow assumption was shaped by clinical reality.
Sub-tertiary healthcare — GP clinics, RACFs, allied health, specialist practices — will never deploy private LLMs. They need the layer that makes commodity AI safe to use under Australian law. The taxonomy below is what shows up in the notes Australian clinicians actually write.
On the device. CleanRoom's processing layer runs locally — in the browser, in the application, or in a sidecar process inside your environment. Identifying patient information is not transmitted to any external service for de-identification. That is the architectural guarantee.
Standard application logs are mutable, contextual, and not designed as evidentiary artefacts. The Sentinel Record is a per-session, hash-chained audit trail using SHA-256: it records entity counts, timestamps, model destinations, and session integrity in a form that can be verified after the fact. It is built to satisfy the "reasonable steps" evidentiary standard, not to satisfy a developer debugging a bug.
No. CleanRoom is the layer between your clinician and your AI vendor — whichever vendor that is. Heidi, GPT, Gemini, Claude, ambient scribes, structured data extractors. CleanRoom does not compete with them. It makes them defensible under the Privacy Act.
Recall is the metric we optimise hardest, because false negatives are the compliance risk. The current evaluation corpus shows 92.5% recall across all 28 entity types and 100% on structured Australian identifiers. Known gaps — primarily non-Anglo names in unstructured prose — are tracked publicly in the evaluation summary and prioritised in every release. We will not market a number we cannot reproduce on request.
Honestly: this is the hardest unsolved problem in clinical de-identification, and we treat it as one. Direct identifiers (name, MRN, Medicare, address) are not the whole story. Combinations of attributes — age, language, postcode, condition, facility — can still uniquely identify an individual in small populations. A 67-year-old Vietnamese-speaking woman with severe COPD in a 60-bed RACF in regional Victoria is identifiable from those attributes alone, even without her name.
CleanRoom approaches this through a Bayesian risk framework rather than a fixed k-anonymity threshold. A prior on re-identification probability is derived from population context — large urban hospital is low-prior, small rural RACF is high-prior. Each observed quasi-identifier (age band, sex, language, postcode, condition class, facility class) updates the posterior. When the posterior crosses a configurable threshold, CleanRoom flags the session for additional generalisation: postcodes collapse to LGAs, ages to bands, languages to language families, conditions to ICD chapters.
This is intentionally a probabilistic risk system, not a guarantee. In a 60-bed RACF, perfect de-identification is a research-grade problem and we are working with Australian academic collaborators on it. What CleanRoom does is shift the risk surface from "all PHI in the cloud" to "residual probabilistic risk on stripped output" — the difference between a structural compliance failure and a manageable, auditable clinical-statistical decision.
Public hospital tertiary networks running fully internal large-language-model deployments behind IRAP-certified infrastructure. If you have your own private LLM hosted in your own data centre, you have already solved the disclosure problem at the network layer. CleanRoom is built for the long tail — GP clinics, RACFs, specialist practices, allied health, regional services — that will use commodity AI and need the layer that makes commodity AI safe.
The OAIC does not certify products. It issues guidance and enforces principles. CleanRoom's strategy is to make architectural de-identification the recognised reasonable-steps standard for clinical AI — through OAIC consultation submissions, the APP Code mechanism, and engagement with indemnity insurers. The goal is not certification. It is becoming the architecture compliance is written around.
If you're responsible for clinical AI risk in an Australian healthcare organisation, an indemnity insurer, or a digital health vendor — book the call.