Every plan includes unlimited documents, with no per-document or per-page fees. A commercial license covers using PHI Mask on real client and patient work.
Personal use
For personal use or evaluation.
$0 USD/ month
Client and patient work
For client and patient work, solo or with a team.
$12 USD/ user / month, billed annually
$30 when billed monthly
Organization-wide use
For organizations with procurement or deployment requirements.
Use ChatGPT, Claude, or another website you choose.
Names, dates, and identifiers become placeholders before the site receives them.
See each detail PHI Mask changed before you send.
In ChatGPT and Claude, PHI Mask puts your details back into the reply on your screen.
| Capability | Personal | Professional | Enterprise |
|---|---|---|---|
| Masking | |||
| Works offline in your browser · nothing uploaded | Included | Included | Included |
| Chrome extension · mask as you paste or upload | Included | Included | Included |
| Unlimited documents · no per-document or per-page fees | Included | Included | Included |
| Text, screenshots, PDFs, and files | Included | Included | Included |
| Files up to 20 MB and 100 pages | Included | Included | Included |
| Names, dates, addresses, and identifiers | Included | Included | Included |
| Reversible restore in your browser | Included | Included | Included |
| Licensing and support | |||
| Personal use and trial evaluation | Included | Included | Included |
| Client, patient, and professional work | Not included | Included | Included |
| Set what your team masks · and what they cannot skip | Not included | Not included | Included |
| Records showing masking was on, for your reviews | Not included | Not included | On request |
| Detector-rule updates | As released | While subscribed | Term of agreement |
| Named contact for support and feedback | Not included | Included | Included |
| SDK for embedding masking in your own product | Not included | Not included | On request |
| Compliance | |||
| HIPAA-compatible workflow | Included | Included | Included |
| Zero Data Retention · we never receive your files or text | Included | Included | Included |
| Data residency · your files and text stay in your browser | Included | Included | Included |
| Residency, air-gapped, and retention review with your compliance team | Not included | Not included | Included |
No. PHI Mask is Zero Data Retention: your files, filenames, text, detected values, and placeholder map are never sent to us, so we hold nothing to retain. See the Data Usage Policy.
Your files and text are processed in your browser, in whatever country you are working in. They are never sent to us and never stored by us.
No. Masking uses no LLM and no generative AI. Detection and masking run in your browser, and your text and files are not sent to a model provider by PHI Mask.
No, and we claim neither. Those reports attest to a vendor's handling of your data in the vendor's systems, and your files and text never enter ours. What our systems do hold is listed on the compliance page.
No. Handwriting is not read in your browser, so anything handwritten was not masked, even when the printed fields around it masked normally. Treat every handwritten entry as unmasked, and select it yourself to mask it.
Yes. The masked content is reversible and is mapped back to your real values in your browser.
PHI Mask is HIPAA-compatible. Your file is masked in your browser and never sent to us, so there is no BAA to sign, and without a signed BAA we cannot claim HIPAA compliance.
A business associate agreement (BAA) covers a vendor that creates, receives, maintains, or transmits protected health information for you. Your file never leaves your browser, so we hold none of it and there is nothing to sign.
Not by itself. Safe Harbor de-identification requires every one of the eighteen identifier types to be gone, and expert determination is a separate formal route. PHI Mask finds what it can and shows you the result. Your review is the gate, not the detection. Handwriting is never read in your browser, so check those fields yourself.
Sending a masked copy is still a disclosure to whoever receives it. Anything the mask missed travels with the file. Check the terms of the tool you paste into and whether your organization needs its own agreement with that vendor. That is a separate question from PHI Mask.
Treat it as a disclosure that already happened. Whether it has to be reported is a decision your privacy officer or your organization's process makes, not one a tool can make for you. Write down what was shared and when, delete the conversation if your account allows it, and check whether an agreement with that vendor covers the plan you were signed in to.
Personal use is free. Any professional, clinical, or client use (for patients, clients, a firm, or a practice) requires a commercial license. To start a pilot, request access.
No. PHI Mask is commercial software: personal use is free and commercial use requires a license. We plan to publish source you can read for personal use once enterprise licensing makes that sustainable.
Choose monthly billing or pay annually upfront. Both are priced per user. Your Stripe invoice confirms payment but is not the seat assignment by itself, so keep the invoice number in case you need billing help.
Use the request form for activation, seat, cancellation, refund, or invoice questions. Include the Stripe invoice number if you have one. Never send card details, PHI, or original files. use the request form.