# MIKA navigation de-identification policy

Status: draft for clinical, privacy, and legal review.

## Governing principle

Remove direct identifiers and minimize indirect identifiers while retaining only the clinical information needed for MIKA navigation. A cleaned document remains sensitive medical information. An identified account can relink a cleaned document to a person.

## Default actions

### Always remove

- Patient, relative, representative, and other person names
- Initials when they identify a person
- Date of birth
- Passport and identity-document details
- SNILS and INN
- OMS/DMS policy numbers
- Phone numbers and email addresses
- Full postal addresses
- Medical-record, case, referral, sample, accession, and order identifiers
- Account names and login identifiers
- Patient signatures and photographs
- QR codes, Data Matrix, PDF417, Code 128, and other machine-readable codes
- Original filename and original document/image metadata

### Retain by default for medical navigation

- Diagnosis and disease site
- Histology and pathology conclusion
- Stage and TNM when present
- Biomarkers and molecular findings
- Procedures and treatment regimens
- Drug names, dose, schedule, and response
- Laboratory result, unit, and reference interval
- Dates of analyses, specimen collection, imaging, operations, hospitalization, treatment, and other clinically relevant events
- Clinically relevant complications and contraindications

### Human decision required

- Non-clinical exact dates that can link the document to an external event or record
- Exact age when extremely high age or rare context increases uniqueness
- Small settlement or rare institution
- Physician name
- Institution and department
- Rare occupation or employer
- Rare disease narrative
- Free text describing a unique event
- Clinical-trial identifiers

## Transformation guidance

| Source | Navigation-preserving transformation |
|---|---|
| Date of birth | Age or age band entered separately after review |
| Full address | Region or federal district when needed |
| Exact procedure date | Retain by default for the clinical timeline; reduce to month/year or a relative interval only after an explicit human decision for a separate disclosure context |
| Patient ID | Fresh random case label, never a hash of identity data |
| Institution | Region or type of center when exact identity is unnecessary |

## Strict mode

A future strict mode may additionally remove all person names, organizations, exact dates, exact geography, device identifiers, and rare descriptors. It must be presented as a more destructive mode with lower clinical utility.

## Prohibited claims

- "100% anonymous"
- "All personal data guaranteed removed"
- "152-FZ no longer applies"
- "Safe to publish publicly"
- "Equivalent to the signed original"
- "Approved for real patient documents" before the release gates pass
