Clinical trial disclosure redaction that hides every identifier the same way on every page — and shows you where it didn't
Clinical documents posted on time with no patient left identifiable.
See one case, screen by screen ↓Preparing clinical documents for publication by removing what identifies patients, investigators and staff, and what is commercially confidential, with a justification for each redaction. Clinical Trial Disclosure & Redaction has five agents read every page, propose each redaction with the authority's rule, keep each identifier hidden the same way across documents and score re-identification risk; the disclosure lead accepts each one.
How to choose AI solutions for life sciences →
Updated
Regulators now publish what a sponsor submits. EMA Policy 0070 publishes the clinical study reports behind a new medicine, the EU Clinical Trials Regulation publishes trial documents in CTIS, and Health Canada's Public Release of Clinical Information does the same. Before any of it goes public the disclosure team must remove every patient identifier and every investigator's personal details, redact only what is genuinely commercially confidential, and justify each redaction. A Phase 3 package — the CSR body, Appendix 16.1 and the Appendix 16.2 patient data listings — runs to thousands of pages, marked today page by page in a PDF tool, in-house or by a vendor.
The failure is rarely the page in front of you. It is the other two thousand: a subject number hidden on page 412 but left readable in a listing footnote on page 1,806, because it broke across a line, sat split across table cells or was written another way. One readable ID ties a row of real visit dates back to a person. Since the revised CTIS transparency rules removed deferral for applications from 18 June 2024, redaction is the only way to protect personal data and commercially confidential information — and each confidential redaction must be justified.
Estimated split for one Phase 3 clinical study report and its appendices, by hand and with the solution.
Five specialist agents find, rule, link and score every redaction; a disclosure lead accepts each one.
Veltara Therapeutics owes EMA its Policy 0070 redaction proposal for Study VLT-418-301 — neravimab in moderate-to-severe ulcerative colitis, Phase 3, 2,140 pages — by 25 October 2026. It is 13 October. Here is what happens next, screen by screen, in the working solution.
Six disclosure packages are on her board. VLT-418-301 and the VLT-418-302 extension CSR are due to EMA on 25 October; the VLT-207-201 protocol amendment and informed consent form are due in CTIS on 21 October; the same VLT-418-301 report goes to Health Canada on 9 December. Each row shows its stage — Read, Proposed, Reviewed, Justified, Risk scored, Submitted — and its owner.
VLT-418-301 · Health Canada PRCI: “Read · reuses the EMA decisions.”
The personal-data finder reads text, tables and 312 scanned pages, and marks 4,380 spans about subjects and 1,212 about investigators and staff. The confidential-information finder marks 622 redactions in 124 passages and drafts a justification for each. The rule applier matches all 6,214 proposals to 9 rules: 412 subject numbers recoded, dates offset to study day, ages in 10-year bands, 11 small sites pooled to country.
“Waiting for Ines Marchetti · nothing is accepted without a person.”
The consistency checker links 1,946 identifiers to every place they appear. Fourteen were hidden on one page and readable on another: four broken across a line, three split across table cells, three written another way — VX418/23/0457, 10040222, 3307 0091 — two on scanned signature pages and two in page headers. By 08:52 Ines has accepted 13 fixes. One is still open: 1004-0217 on page 1,806.
“A page-by-page tool searches for the text it was told about.”
CSR §10.2, Important protocol deviations, opens at reading size with every proposed redaction as a coloured bar: blue for patient identifiers, violet for investigators and staff, amber for confidential information. A rail down the left shows redaction density across all 2,140 pages. 5,876 of 6,214 are accepted; 214 are below the 0.90 confidence bar and 124 confidential redactions wait for a signed reason. Package risk reads 0.21.
She clicks the redaction over subject 1004-0217: rule P-01, Subject identifier, EU CTR Art. 81(4)(a), recoded as Subject 112, proposed by the personal-data finder at 0.99 confidence. The consistency lens lights 38 places across three documents — 6 in the CSR body, 3 in Appendix 16.1, 29 in Appendix 16.2. Thirty-seven are hidden. One is not.
“Readable on page 1,806. 37 of 38 are hidden; in Listing 16.2.6.1 footnote b the ID breaks across a line, ‘1004-’ / ‘0217’, so it was read as two numbers.”
Listing 16.2.6.1, Mayo score by visit at Week 52, footnote b. The subject is hidden in the listing row above, but the footnote that explains it carries the ID in two halves. Left as it is, it links that row — female, 67, Site 1004, a site with 6 subjects — back to the subject. Risk for this subject: 0.21 now, 0.06 once hidden.
She redacts it with P-01, recoded as Subject 112, as on the other 37 pages. The lens turns green — hidden the same way in all 38 places — and the last of the 14 inconsistencies is closed. The pattern goes to the personal-data finder for the next package only after a person approves it.
“Redacted with P-01 · recoded as Subject 112 · 38 of 38 hidden · package risk 0.06.”
One switch shows the page as the public will see it: subject numbers as Subject 104 to Subject 121, ages as bands such as 60–69, visit dates as study days. The Mayo scores — stool, bleeding, endoscopy, PGA and total — stay readable, because results, design and methods of analysis are never redacted.
Rule K-01: results, design and methods of analysis — “Never redacted” (EU CTR Recital 68).
Re-identification risk is computed only from accepted decisions, as prosecutor risk against the 0.09 threshold. With page 1,806 hidden, Belgium — 6 sites, 34 subjects — falls from 0.21 to 0.06, and every subject in every site group is at 0.06 or below. The report draft lists how each identifier is handled, from recoded subject numbers to pooled small sites.
“An agent may not change a decision to lower the score.”
Six of 124 passages wait for legal: the cell line and fed-batch titre, purification steps and yield, the formulation buffer, a 400 mg autoinjector for an unannounced indication, the VTX-AM-117 assay reagents and the potency bioassay cell line. Rafael confirms each is commercially confidential and signs by e-signature — 124 of 124. Next, Mei Fujita, data protection officer, approves the anonymisation report; then Ines submits.
“Submitting needs every redaction decided, every justification signed and the risk at or under 0.09.”
The same study report, seen by the five people who carry it to publication — what their package looked like, and what it looks like now.
Five specialist agents find, rule, link and score every redaction; a disclosure lead accepts each one.
Finds subject numbers, dates, ages, sites, batch numbers and the names, signatures and contacts of investigators and staff — including IDs broken across lines or cells and text in scanned pages.
Finds passages that may be commercially confidential — manufacturing process, formulation, unpublished analytical methods, unannounced plans — and drafts the justification for each.
Matches every proposal to the authority's rule and the method — redact, recode, band, offset — and produces the published form, with the study's stable subject code list.
Links every occurrence of every identifier across all documents in a package, in any form, and flags any place it is readable or handled differently, with the reason it was missed.
Computes prosecutor re-identification risk from the accepted decisions, reports the highest value against 0.09 with the page that causes it, and drafts the anonymisation report and the justification table.
Accepts each redaction; legal signs justifications. The agents propose; a named person decides.
Ask about any page, identifier or rule — or say what to change. Every answer points to the page, the check or the table it came from.
Where else does subject 1004-0217 appear?
In 38 places across three documents: 6 in the CSR body, 3 in Appendix 16.1 and 29 in Appendix 16.2. 37 are hidden and recoded as Subject 112. One is readable: page 1,806, Listing 16.2.6.1, footnote b, where the ID breaks across a line.
Why is the package risk above 0.09?
Because of one subject. 1004-0217 is at Site 1004 in Ghent, which has only 6 subjects; with the ID readable on page 1,806 the risk for that subject is 0.21. Every other subject is at 0.06 or below. Hiding that one occurrence brings the package to 0.06.
Which confidential passages still need a signature?
Six of 124, all drafted overnight: four in CSR §9.4.2 — cell line, purification yield, formulation, and an unannounced autoinjector — plus assay VTX-AM-117 on page 412 and the potency bioassay in Appendix 16.1.9. Rafael Brandt signs them.
Reuse these decisions for the Health Canada package
The 6,214 decisions on VLT-418-301 can be copied to the Health Canada package as proposals, with the same recoding, so the two publications match. Health Canada has its own rules, so the 622 confidential redactions go back to Rafael Brandt for a fresh look. Nothing is applied until you accept it.
13 screens from the working solution, on its sample data. Pick one to see it large.
How proposals are made, who decides and what leaves the building are settings — and the rule sets per authority are changed by people, never by an agent.
| Setting | Default | Choose from |
|---|---|---|
| Confidence bar | 0.90 | Below it, proposals go to a person one by one; above it they can be accepted a page at a time |
| Accept without a person | Off — locked | No redaction is ever applied without a person accepting it |
| Subject numbers | Subject 1 … 412 | Recoded the same way in every document and every package for this study |
| Dates and ages | Study day · 10-year bands | Dates offset from randomisation; 90 and over pooled |
| Small sites | Under 11 subjects | Pooled to country |
| Risk threshold | 0.09 | Highest prosecutor risk allowed for any subject |
| Who decides | Disclosure lead · legal counsel · DPO | Accepts redactions · signs justifications · approves the report |
| What leaves the building | 4 outputs | Redacted PDFs, proposal PDF with annotations, justification table, anonymisation report — never the original |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample study data · “target” = the design goal, measured in the live solution; 11 days is an illustrative sponsor baseline · “estimated” = our estimate · “typical” = published figure (Branson et al., Trials 2020 — the 0.09 re-identification risk threshold used by EMA and Health Canada). Context: Regulation (EU) 536/2014 Art. 81(4) and Recital 68 · EMA revised CTIS transparency rules (2024) · EMA Policy 0070. People, companies, studies, products and sites named on this page are fictional — characters and sample data in the working solution.
Preparing clinical documents for publication by removing what identifies patients, investigators and staff, and what is commercially confidential, with a justification for each redaction. Clinical Trial Disclosure & Redaction has five agents read every page, propose each redaction with the authority's rule, keep each identifier hidden the same way across documents and score re-identification risk; the disclosure lead accepts each one.
It works with rule sets for EMA Policy 0070, the EU Clinical Trials Regulation in CTIS and Health Canada's Public Release of Clinical Information. Each rule names what is hidden, how it is published and the reference, and decisions made for one package can be copied to another as proposals.
The consistency checker links every occurrence of each identifier across all documents in a package — including IDs broken across a line, split across table cells, written another way or in scanned pages and headers. Selecting a redaction shows every other place the same thing appears and flags any that is still readable, so one decision covers all of them.
Yes. The anonymisation report writer computes prosecutor risk per subject from the accepted decisions and reports the highest value against the 0.09 threshold, by site group, with the page that causes any subject to exceed it. It drafts the report sections; the data protection officer approves the method and the report.
No. Results, study design and methods of analysis are never redacted, and the confidential-information finder never proposes them. Confidential redactions cover passages such as manufacturing process, unpublished analytical methods and development plans not yet public, each with a justification legal counsel signs.
Yes. No redaction is applied without a person accepting it — that setting is locked. The disclosure lead accepts redactions and submits, legal counsel signs every confidentiality justification, the data protection officer approves the anonymisation report, and the unredacted original never leaves the locked store.
Yes. The confidence bar, subject recoding, date offset, age bands, small-site pooling, risk threshold, approvers and outputs are settings, and the rule sets per authority are changed by people, never by an agent.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your disclosure SOPs, your confidential-information list and a sample of past study report packages — and it goes live once every quality gate has passed. We will walk you through it on your own documents first.
A checked first-draft protocol in days, in your approved language.
1-min demoeTMF Quality CheckAn inspection-ready trial master file every day, each site scored on what is due today.
1-min demoClinical Study Report AuthoringResults drafted within days of database lock, linked to tables.
1-min demoWe'll run Clinical Trial Disclosure & Redaction on a sample of your own past disclosure packages.