Hermes Translator Privacy Information
Hermes Translator is operated by Hermes Società Cooperativa, which acts as data controller under the GDPR. The service processes account data such as name and email, usage and billing data, and the texts and documents submitted for translation, explanation, or human review. Health-related content may qualify as special category data, and users should avoid including directly identifiable patient data whenever possible.
Data is processed to provide and improve the service, handle payments, maintain security, and comply with legal obligations. The principal legal bases are performance of a contract, legitimate interests such as platform security and abuse prevention, legal obligations such as tax and accounting compliance, and, where health-related content is voluntarily uploaded, explicit consent.
Technical and organisational measures are used to protect data, including encryption, access control, and logging. Data is shared only with trusted processors under data processing agreements, including hosting and database providers such as Supabase, Replit, and Vercel; AI providers such as OpenAI and Anthropic; and payment providers such as Stripe.
Data subjects may exercise their rights of access, rectification, erasure, restriction, portability, and objection, and may withdraw consent where applicable. Privacy requests or questions about data handling may be sent to bruno@hlstranslators.com.
Privacy masking in Hermes Translator
Hermes Translator includes a privacy-oriented preprocessing layer for AI-assisted workflows, especially Translation and related text-processing tools. This layer uses pseudonymisation rather than full anonymisation: direct identifiers are masked before downstream AI processing while relevant content is preserved as much as possible.
The implemented approach is conservative by design. It focuses on masking direct identifiers and obvious identity or contact fields while avoiding blanket removal of drug names, diagnoses, symptoms, dosages, units, and other personal identifiable information by default.
How masking works
The system uses stable placeholders to replace detected direct identifiers before text is sent to AI services. Typical placeholders include [PATIENT_NAME_1], [EMAIL_1], [PHONE_1], and [DOB_1], allowing the text to remain understandable while reducing direct exposure of personal data to external AI providers.
This model is designed to support two outcomes at once: external AI providers process masked text instead of raw identifiers, and the application can restore the original values locally after the final processing step where appropriate for the final user-visible output.
Repeated occurrences of the same detected value are handled consistently within the same request. If the same personal name or email appears more than once in one input, the same placeholder is reused to preserve coherence in translated or processed text.
Identifier categories checked
The current masking layer is designed to detect and mask at least the following categories of direct identifiers:
- Full personal names where reasonably detectable.
- Email addresses.
- Phone numbers.
- Dates of birth when clearly identifiable as DOB or birth-date information.
- Patient IDs, medical record numbers, and similar account-like identifiers.
- Personal addresses when clearly identifiable as mailing or street addresses.
- URLs and IP addresses when present in uploaded or pasted text.
This mechanism is intended as a safeguard against direct identifier exposure. It is not a guarantee of complete anonymisation in all possible narrative text scenarios.
Where masking is applied
In Translation, the masking step is intended to run after text extraction or OCR and before glossary injection, routing logic, and any downstream request to AI providers such as OpenAI or Anthropic models.
For uploaded PDF, Word, Excel, and image files, the intended order is extraction first, masking second, and AI processing third. This helps ensure document uploads receive the same privacy handling as directly typed or pasted text.
Review and transparency
Hermes Translator is designed to provide a compact user-facing notice when masking is applied before AI processing, together with a small review control so that the user can understand what was masked in that request.
Recent live interface behavior shows this compact review pattern in the Translation result area, including the Italian notice "Mascherati prima dell'elaborazione AI" and the toggle "Verifica i dati mascherati" for successful masking cases.
The review layer is intended to remain compact, collapsed by default, and focused on privacy-relevant categories or values for the current request rather than exposing a large mapping table by default.
Limits of the safeguard
The masking layer is intentionally conservative. It does not blindly remove every date or every proper noun because that could damage medically relevant meaning, chronology, and translation quality.
For example, dates should only be masked when they are clearly being used as a personal identifier such as a date of birth, rather than as treatment dates, visit dates, or other clinically relevant timeline information. For this reason, users should continue to avoid including directly identifiable patient data whenever possible, even though privacy masking is available as a protective layer. Technical safeguards reduce risk but do not eliminate it entirely in every free-text scenario.