Log de-identification is the removal of personal detail from the answers a symptom checker records. Those entries are health data under UK GDPR Art. 9(1). Software with a medical purpose, such as diagnosis or triage, can itself be a medical device under the Medical Devices Regulations 2002 (SI 2002/618), which the MHRA enforces. Any identifier the app stored on the handset also engages regulation 6 of PECR. anonym.plus works on a local device, so the triage flow stays usable for product work.
When this applies
A self-triage tool keeps what each user typed, plus a signup email, an IP address, and a session token. To study accuracy or safety, the identifying parts must go. If the tool claims a diagnostic purpose, the MHRA route matters as much as the privacy one.
How anonym.plus handles it
- Open the saved entries in anonym.plus on a local device.
- It finds names, emails, IP addresses, and free-text clues.
- Symptom selections and scores stay in place.
- Swap the personal parts with the re-link map turned off.
- Save the anonymous records on your machine.
What you need to provide
- The entries (CSV, JSON, or a text dump).
- Replace with the map off for true anonymity.
- Optional column map for known identifier fields.
Patient data entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | name field → [USER] |
| Contact | EMAIL_ADDRESS | signup email → [EMAIL] |
| Network | IP_ADDRESS | 203.0.113.7 → [IP] |
| Free text | LOCATION | “clinic in Norwich” → [PLACE] |
| Dates | DATE_TIME | session time → [TIME] |
| Identifiers | ID | session token → [ID] |
Compliance achieved
- Strips the health answers UK GDPR Art. 9(1) treats as special category data.
- True anonymity puts the result beyond the Regulation by UK GDPR Recital 26.
- Assessed against ICO anonymisation guidance and its motivated-intruder test.
- Relevant where triage software is a medical device under the Medical Devices Regulations 2002 (SI 2002/618).
- Session tokens stored on the handset engage regulation 6 of PECR, so they are flagged as identifiers.
Anonymise symptom checker logs offline — see plans & start free →
Limitations & cautions
IP addresses and session tokens are strong clues and must go for true anonymity. A rare free-text answer plus a place can still narrow identity. Drop the re-link key and weigh the residual risk before you call the file anonymous.
Frequently asked questions
Why treat an IP address as personal data?
Under UK GDPR an IP address can single out a user, especially with a timestamp beside it, so it is personal data. The tool flags it and swaps it like a name. A session token behaves the same way across a run of entries.
Does a symptom checker count as a medical device?
It can. The Medical Devices Regulations 2002 turn on the purpose the maker claims: software intended for diagnosis, prevention, monitoring, or treatment generally falls in scope and needs UKCA marking. A tool that only signposts general information usually does not. The MHRA publishes guidance on where the line sits, and that assessment is the manufacturer's to make.
Anonymous or pseudonymous — which do I get?
If you keep a re-link key the output is pseudonymous and stays in scope under UK GDPR Art. 4(5). Drop the key, remove the tokens, and the result can be anonymous under Recital 26.