Demo environment. Do not enter real Protected Health Information (PHI). Use synthetic data only until production BAA infrastructure is wired.

Project Nightingale
Sign inGet access
Demo only · synthetic data
No persistence
PHI redacted server-side

Live demo

Charting for bedside & remote care-management nurses, the EMR Bridge for IT, and a care-plan delta workflow — all on synthetic data. Nothing leaves the redactor.

PHI never reaches the model

Names, MRNs, dates, addresses, and phones are tokenized before any AI call.

Real AI, real pipeline

Lovable AI Gateway with google/gemini-3-flash-preview. Same path production will use.

Synthetic only

Every patient, ID, and date below is fabricated. Outputs are not medical records.

Charting Care plan delta EMR Bridge (for IT) Code Mode (simulator)

EMR Bridge: pseudonymize PHI before it ever leaves your network.

EMR Bridge — synthetic data only
Zero server-side persistence. Demonstrates the pseudonymization contract; real PHI must wait for the BAA stack.

A · EMR-like input

Free-text note
Sample anchored to Henry Park, ICU day 2 (synthetic).

B · Twin output

What our servers would see
Run the bridge to see the pseudonymized output. Identifiers shown amber (tap to reveal). Clinical metrics shown blue (untouched).
0 hashed names in local map
Run the EMR bridge to populate the trail.

Demo integrity chain — each event carries a SHA-256 of the previous event for tamper-evidence in the browser. Not a signed attestation. In production this stream is the same JSON the on-prem container writes to your SIEM; today it lives only in this tab and is wiped on Clear, Reset sample, or tab close. In production, the per-patient date offset itself never leaves the hospital network — only the fact that one was applied.

C · Shift 2 threads automatically — same patient, same twin.

Re-run for the next shift; surrogate name, surrogate MRN, and date offset all match shift 1.

Technical detail: the per-patient date offset is HMAC(patient_key, k1) → constant for every shift on the same patient, so trends and intervals thread cleanly while calendar linkage to the real world stays broken.

Run shift 1 first.

What the EMR Bridge proves — and what it does not

  • Identifiers are replaced with deterministic surrogates so the same real patient yields the same twin across shifts.
  • One per-patient date offset is applied to every date — intervals between events survive exactly.
  • Clinical metrics (vitals, labs, doses, scores) are never touched.
  • This is GDPR Art. 4(5) pseudonymization, not HIPAA Safe Harbor de-identification. Treated as PHI under HIPAA until the BAA stack is live.
  • fpe.ts is demo-grade format-preserving substitution — production must use a vetted FF3-1 library.