Redact medical records without uploading them.
A medical record carries some of the most sensitive data a person has, so it is the last thing you want sitting on a stranger's server. KeptPDF finds the identifiers and permanently destroys the text, all in your browser. No protected health information is transmitted anywhere. Review the result before you share it.
A box over a name is not the same as removing the name.
Most PDF redaction is a colored overlay. The patient name, the record number, the date of birth all stay in the file underneath, and a different viewer or a copy-paste brings them back. For protected health information, that gap is the whole risk.
Real redaction destroys the identifier in the PDF, so a covered name or record number cannot be recovered.
KeptPDF flattens each redacted page so nothing survives under the box. Because the work happens in your browser, no protected health information is uploaded, which means there is no third-party processor touching it and no server-side copy to breach. You can verify it yourself in the network tab.
A filled rectangle just sits on top of the text. Move it, switch viewers, or copy the page, and the hidden content is back.
The page is flattened to an image, so the text underneath is destroyed. There is nothing left to uncover.
Built around the HIPAA Safe Harbor identifiers
Auto-detect targets the kinds of identifiers the HIPAA Safe Harbor method calls out, so de-identifying a record is a review, not a scavenger hunt.
Names, dates, and contact details
Patient and relative names, dates tied to a person (birth, admission, discharge), addresses, phone numbers, and email are all flagged for your review.
Record, account, and insurance numbers
Medical record numbers, account numbers, and health-plan or member IDs are surfaced as the structured identifiers they are.
Scanned charts and faxes
Records are often scans. KeptPDF runs OCR before redacting, so it can find and remove identifiers printed inside an image.
You stay in control of every match
Nothing is removed until you confirm it. You keep the clinical detail you need and remove only what identifies the patient.
How to redact a medical record
Three steps, entirely on your device. Permanent, verifiable, no upload.
Open your record
Drop your file onto the page or pick it from your device. It loads into your browser, and nothing is sent anywhere.
Mark what to redact
Auto-detect finds names, dates, Social Security numbers, account numbers, and more. Draw boxes over anything else you want gone.
Download the clean copy
Save it. The marked content is permanently gone: the page is flattened to an image, not hidden behind a box. Give the result a quick review before you share it.
Permanent removal, nothing uploaded.
True text destruction
Each redacted page is flattened to an image, so the text layer is gone, not just covered with a shape. Content under a redaction box cannot be copied, selected, or recovered. Review the result before you share it.
Auto-detect the obvious stuff
One pass finds names, dates, phone numbers, Social Security numbers, addresses, and emails across the whole record, so you are not hunting for each one by hand.
Never uploaded
There is no upload step. The record is processed entirely in your browser, so the original is never part of a network request and never sits on anyone else's server.
Redaction certificate (Pro)
Pro adds a signed PDF and JSON audit record listing every redacted span, category, and page, which is handy for productions and compliance files. Anyone you send it to can re-check the fingerprint in their own browser, with nothing uploaded.
For the teams that handle records under a duty of care
Clinics and billing staff, release-of-information desks, and attorneys handling medical records in a case.