The patients stay private. The medicine moves.
Synthetic clinical cohorts, made inside the hospital under formal differential privacy. Each one certified for what it can do, and what it can’t.
A mathematical ceiling on what any output reveals about one personFormal privacy bound
Raw patient records leaving the hospital, by designRaw records leave
Measured utility and contraindications on every releaseOn every release
Patent-pending synthesis architecture, published and filed internationallyFiled internationally
The medicine of the next twenty years will be learned from data that, today, cannot legally move.
Records stay behind walls.
Clinical data sits inside hospitals, regions and national borders. Every research question begins with months of agreements before a single analysis runs.
De-identification is a hope, not a proof.
Removing names and dates leaves people re-identifiable by what remains. It offers no bound on what an output reveals about any one patient.
Synthetic data ships without a label.
Generation alone is not privacy. Models can memorise rare records, and most synthetic data is released without saying what it is safe to use for.
Medicine became trustworthy when it was made to a standard. Health data has to follow.
The prescription put a standard between the compound and the patient. Made to spec, labelled honestly, traceable end to end. Sx is that standard for health data.
Manufactured to a standard.
Every cohort is generated under formal ε-differential privacy, a mathematical ceiling on what the output can reveal about any one person. It is stated as a number, not a promise.
Labelled honestly.
Each dataset carries a Clinical Privacy Index certificate with its privacy budget, measured utility, and printed contraindications, the uses it is not fit for.
Traceable end to end.
Every operation is written to a hash-chained audit trail that an auditor holding the log can recompute. Trust is verified, not asserted.
Every dataset carries its own proof.
The Clinical Privacy Index is a clear verdict for a decision-maker and a full specification for an auditor. It says how private a dataset is, how faithful it is, and what it must not be used for.
A certificate that only lists strengths is marketing. Ours prints contraindications, the way a medicine prints side effects.
A 5,000-person cohort synthesised across five linked OMOP CDM v5.3-format tables under person-level (ε = 1.0, δ = 10⁻⁵) differential privacy, seeded from the public CMS DE-SynPUF benchmark. It ships with its certificate, fidelity snapshot and linkage report. Shared with institutional addresses after review; no live patient records are involved.
From records that cannot move to certified data that can.
The engine runs where the data lives. Raw records stay inside the source institution; only certified synthetic cohorts cross the boundary.
Inside the source institution · raw records never leave
Ingest
Source data arrives as FHIR R4, HL7, CSV or a direct EHR export. Schemas are validated and mapped to standard clinical models inside the institution's own environment.
Synthesise
The privacy engine generates new records on a single local GPU inside the hospital, under a formal differential-privacy guarantee tuned to a stated privacy–utility target. Clinical signal is preserved within a measured utility bound; individual disclosure is capped by (ε, δ).
Certify
Each output is measured and issued a Clinical Privacy Index certificate. It states privacy strength, clinical utility, regulatory readiness per jurisdiction and contraindications.
Deploy
Certified cohorts export to research and machine-learning pipelines through a standard API. Every release is recorded in the audit trail, so the full history can be checked later.
Our impact and our revenue are the same unit.
Every certified cohort unblocks research that would otherwise wait months for a data agreement. We will report every release and its measured impact annually.
Unlock cohorts that cannot move.
Research that waits months for a data agreement can start from a certified cohort instead.
SDG 3.bBring absent populations into research.
Institutions and regions missing from global datasets can contribute without their records ever leaving.
SDG 9.5Make patient privacy a mathematical bound, not a policy promise.
Protection stated as a bound with a method behind it, not a promise in a data-sharing agreement.
SDG 16.10Synthetic health data, taken seriously.
We publish on formal privacy, European regulation and evaluation, including where synthetic data fails.
Referential integrity under person-level differential privacy
Auditing orphan rates and cross-table structure in multi-table OMOP synthesis.
Formal privacy costs the smallest groups most
Measured on our own public release across 24 subgroups, with a random sample as control, and what a certificate must therefore say.
Membership-inference audits against stated bounds
Testing empirical leakage against the claimed (ε, δ) on public claims data.
A small team, setting the standard.
Founded in Stockholm by Gaurav Raj Chattarki, sole inventor on the published application. We are assembling a founding team of researchers and engineers who want their work to be provable and used in medicine.
Privacy research scientist
Differential privacyStockholmMachine learning researcher, generative models
Structured clinical dataStockholmClinical data engineer
FHIR · OMOPStockholmFounding commercial lead
Life sciences · NordicsStockholmWork with us.
Tell us about your data, your constraints, or the question you are trying to answer.