De-identification exports

Prepare a separate copy of dataset tables with explicit identifier and annotation choices.

ClonoLoom 0.9.0. Use the matching host and matching clients (API 2, catalog 4, policy 1).

Prepare and review first

Check your dataset's subject annotations, definition and QC. In Reports → De-identification export, choose AIRR rearrangements and clonotypes, or clonotypes only. Choose text tables or typed Parquet. Free-text and HLA removal start selected; choose both explicitly. Select Prepare and review pseudonyms and inspect the complete subject correspondence, counts, removal settings and inventory before downloading.

The correspondence shown locally is private. Download reviewed export saves only the table ZIP. Download PRIVATE identity map separately saves the identifying correspondence and source fingerprints; keep it under your study's access controls and never distribute it with the ZIP. Preparing again creates fresh pseudonyms. A preparation expires after 15 minutes, replacement or host restart.

De-identification review for six observations of two simulated vaccination subjects, with explicit removal settings and separate export and private identity-map buttons — A seeded artificial vaccination study demonstrates subject correspondence and preserved sample membership. This is an export validation example, not a biological finding.

Preserve the scientific evidence

The ZIP holds native clonotype CSV, optional AIRR TSV, a sample table, a fresh transformation inventory and a provider notice. With Parquet selected, typed files replace the text tables and add a schema; every footer uses sanitized public provenance. Native count limits apply, and the private map remains separate. Subject and sample identifiers receive fresh pseudonyms; cell and sequence identifiers are scoped by sample. Missing subjects remain missing. Retained native scientific field values, stable clonotype IDs, counts, missingness, units, QC and definition rules are preserved. Original files, project and saved results remain unchanged.

Removing free text omits time point, tissue, reference, subset, condition and batch. HLA has a separate removal choice. Removing these fields can prevent reconstructing study design; keep the private map and original project for that context. Unsupported nested IMGT or germline-database provenance refuses AIRR export instead of silently deleting evidence.

Pseudonymization has limits

Sequences, gene calls, stable clonotype IDs, rare measurements and retained annotations remain linkable. This workflow does not establish anonymity, estimate privacy risk or certify legal compliance. Required provider terms and citations remain authoritative. Private-use acknowledgment never permits redistribution.

Existing project archives, reports, certificates, figures, recipes and arbitrary nested evidence are outside this export contract. They retain their original identifiers and are never bundled here. The transformation fingerprint checks recorded bytes; it does not certify biological validity or exact replay of a transformed artifact.

Reviewed automation, MCP, Python and R share the same permission and separate-download contract. Read the complete format, bounds, scientific limits and validation guide. The rationale draws on NIST SP 800-188 and the AIRR standard.