TrichoMap — De-Identification Standard Operating Procedure

---

1. Purpose and scope

This SOP defines how TrichoMap transforms identifiable clinical data into De-Identified Data meeting the HIPAA Safe Harbor standard (45 C.F.R. § 164.514(b)(2)). It applies to all data elements TrichoMap intends to use for product improvement, research, publication, or licensing:

• Dermoscopy (trichoscopy) images
• Structured trichoscopy annotations
• Clinical scale assessments (LPPAI, FFASS, FFASI, Olsen, CCCA photographic, C-CAT) and their item-level responses
• Associated structured clinical context retained on the research copy (diagnosis codes, medication classes, procedure types) — de-identified per this SOP

This SOP does not apply to the live clinical (tenant) data, which remains fully identifiable PHI within the multi-tenant system and is governed by the BAA and the platform's security controls.

2. Core principle: two separate data copies

TrichoMap maintains a strict separation between:

1. The clinical copy (PHI). The live, identifiable, tenant-scoped data used to deliver the service to the practice and patient. Full dates, patient identifiers, linkage intact. Never used for licensed purposes.
2. The research copy (De-Identified Data). A separate, derived dataset produced by the transformation in Section 3. No direct identifiers, dates reduced, metadata stripped, linkage severed. This is the only data used for product training, research, publication, or licensing.

De-identification is the one-way transformation that produces the research copy from the clinical copy. The research copy contains no key or path back to the clinical copy.

3. The Safe Harbor transformation

When data is promoted to the research copy, the following transformations are applied and logged. All eighteen Safe Harbor identifiers are removed or reduced; the elements below are the ones that materially apply to TrichoMap's data.

3.1 Names, contact info, identifiers

• Patient name, MRN, address, phone, email, and any account or portal identifiers are not carried to the research copy.
• The patient is represented on the research copy by a research-only pseudonymous token that has no mathematical or lookup relationship to the clinical patient ID (i.e., not a hash of it — a separately generated random ID with no stored mapping available to the research dataset).

3.2 Image metadata (EXIF) — critical step

• Every image is stripped of all metadata before entering the research copy: EXIF, GPS/geolocation, device make/model/serial, embedded capture timestamps, and any thumbnail-embedded metadata.
• Stripping is verified programmatically (the pipeline re-reads the output file and asserts no metadata fields remain) and the verification result is logged.
• The visible image content (magnified follicle/scalp) is retained unaltered — it is inherently non-identifying.

3.3 Dates — reduced to year + interval

• No date element more specific than year is carried to the research copy.
• Visit timing is expressed as: (a) visit_year, and (b) day_offset_from_baseline (integer days from the patient's first visit; the baseline itself is day 0). This preserves longitudinal structure for research while removing calendar dates.
• Patient age is carried as age in years; any age 90+ is aggregated to a single "90+" category per Safe Harbor.

3.4 Linkage severance

• The research copy carries no tenant ID, practice name, practice address, or geographic identifier below the level permitted by Safe Harbor (the first three digits of ZIP may be retained only per the Safe Harbor population rule; TrichoMap's default is to carry no geographic identifier).
• Clinical context retained on the research copy (diagnosis, medication, procedure, scale scores) is retained as standardized codes/classes, not free text, because free-text notes can contain inadvertent identifiers. Free-text fields are excluded from the research copy by default.

3.5 Free text handling

• Provider notes, custom medication/procedure names, and any other free-text fields are not carried to the research copy at this time, because they are the most likely vector for inadvertent identifiers. (A future version may apply vetted free-text de-identification/NLP scrubbing; until then, free text is excluded.)

4. Logging and auditability

Each promotion of data to the research copy produces an immutable log entry recording: the transformation version applied, the metadata-strip verification result, the date-reduction confirmation, and a timestamp. These logs substantiate the de-identification claim if audited. (Mirrors the platform's existing append-only audit/billing-event pattern.)

5. No re-identification

TrichoMap does not attempt to re-identify De-Identified Data and does not retain a key that would allow the research copy to be re-linked to the clinical copy. TrichoMap has no actual knowledge that the De-Identified Data could be used alone or in combination with other reasonably available information to identify an individual.

6. Standard version and review

• Current standard: HIPAA Safe Harbor (§ 164.514(b)(2)).
• Future upgrade: Expert Determination (§ 164.514(b)(1)) via a qualified statistician, recommended before large-scale third-party licensing.
• This SOP is versioned. Material changes require counsel review. The de-identification transformation code references the SOP version it implements.

7. Current scope

At present, no research copy is licensed or disclosed to third parties. This SOP is implemented and the pipeline built before any data is used for the licensed purposes described in the BAA Data Use Addendum. The existence of this SOP, and the commitment to follow it, is what makes the de-identified-use representations truthful from day one.

---