De-identification procedure

Runs locally before upload

neuro-sync reads the selected scanner export without changing the source folder. Only series confirmed as functional echo-planar imaging by standard DICOM metadata and repeated temporal structure can enter the de-identification process. Structural scans, localizers, diffusion, field maps, secondary captures, and ambiguous series stay on the workstation.

Rewrites each selected DICOM

The client creates a new DICOM object for every selected EPI instance. It walks nested sequences recursively and uses a default-deny allowlist, retaining only the elements required to decode and interpret the functional acquisition. Unknown standard fields and unreviewed private fields are removed.

Removes identifying metadata

• Patient names, identifiers, demographics, accession values, and clinical identifiers
• Dates, times, ages, addresses, telephone numbers, and free text
• Institution, department, station, device serial, operator, and physician information
• Study, series, protocol, image, and comment descriptions
• Source paths, filenames, media identifiers, overlays, and graphics
• Private creators and blocks that are not explicitly reconstructed from validated fields

Replaces identities and references

Patient identity and the UIDs that connect patients, studies, series, instances, frames of reference, and referenced instances are replaced with deterministic, site-scoped pseudonyms. This preserves the relationships needed to interpret a series without retaining the source identifiers.

Preserves functional image data

Pixel Data is preserved in its original transfer syntax. neuro-sync does not convert, resample, crop, mask, or preprocess the images. The functional EPI-only boundary keeps high-resolution structural and localizer images out of the archive.

Fails closed

A series stays local when neuro-sync encounters declared burned-in annotation, overlays or graphics, unsupported image objects, malformed Pixel Data, inconsistent series identity, or unsupported enhanced or packed-image geometry.

Audits the result

Every rewritten object is reopened and checked against the same recursive allowlist before it can enter an archive. Each accepted series is packaged as a deterministic dicom.tar.zst archive with a canonical manifest and SHA-256 hashes, then uploaded through short-lived, object-scoped transfer URLs.

Review before upload

neuro-sync prepare can write the deidentified instances as normal .dcm files in a separate local folder without uploading anything. Researchers may inspect or edit those copies with their usual DICOM tools. A later neuro-sync upload uses the files as they then exist, reruns functional EPI selection and this local procedure, and creates fresh archives for transfer.

Inspect the implementation

The complete client and service code are open source. The functional EPI selection logic and DICOM rewrite and audit can be reviewed directly on GitHub alongside the de-identification policy.

Labs should also review the data contribution and CC0 policy before syncing data.