← no human in the loop

luptacan this patient data be shared? — a yes-or-no with reasons

Every day, medical data that could help people sits unused because one question is too hard to answer: can we share this — yes or no — and why? Lupta is software that answers it. This page tells the story in six short scenes, no jargon required.

Scene 1 — the drawer

Dr. Meera ran a three-year heart study. 800 patients trusted her with their records. Now a colleague asks: “Can I use your data to train a model that flags at-risk patients early?” It could genuinely help people. She wants to say yes.

But two questions stand between her and “yes.” Did her patients agree to this? They signed up for a heart study — nobody mentioned a model. And could anyone be recognized in the data? The names are gone, but is that enough?

800 patient records the drawer did they agree to this? could anyone be recognized? answering properly takes a lawyer + a statistician. she has neither. the data stays in the drawer.
fig. 1 — the safe answer is “no,” so the study that could have run never runs
Scene 2 — why “we removed the names” isn’t enough

The second question hides a trap. Here are the 800 patients with every name deleted. Anonymous? Watch what four harmless facts do to one of them.

800 records, names removed (each dot ≈ 10 people) “anonymous”, minus four facts: no names  ·  800 people age 89  ·  12 people woman  ·  4 people pincode 175-xxx  ·  2 people rare heart condition  ·  1 person she has a name.
fig. 2 — each fact is harmless alone; together they point at one person

Privacy researchers call this k-anonymity — plainly: how many people in the data look exactly like you. If the answer is one, you’re findable, name or no name. In Dr. Meera’s data the answer is one for every single patient. Most real datasets are like this, and nobody can see it by looking.

Scene 3 — the gap

Tools for this exist. Each answers half the question. Consent systems remember what patients signed — but do no math. Anonymization engines do the math — but have no idea what was promised. The sharing decision needs both, checked against each other. That gap is where the data gets stuck — and where Lupta sits.

consent systems no math anonymization engines blind to consent lupta the decision the two worlds never talk. the decision needs both.
fig. 3 — half-answers on either side; the decision lives in between
Scene 4 — what lupta does

You hand it three things. It hands back one decision.

the consent form what patients agreed to the dataset what the data reveals the request what they want to do with it lupta one decision memo yes / yes, with changes / no every reason written down
fig. 4 — which sentence of the consent it strains, which law applies, which numbers prove it
Scene 5 — watch it say no

Dr. Meera’s case is the hard one, so that’s the demo. Her consent form never mentions re-use — it’s simply silent. Software that guesses would round silence up to a yes. Lupta reads it the way the law does:

decision memo · synthetic demo case · India DPDP Act

verdict: deny

The consent is silent on re-use — and silence is not permission.§6(1)
Research gets an exception — but not when the result targets specific individuals. Flagging patients does.§17(2)(b)
Measured, not guessed: every one of 800 patients is unique in the data.k = 1
Tried to rescue it — blur ages, shorten pincodes. ~96% of the records would have to be deleted.96%

A defensible “no” is the product. Not a shrug — a no with reasons, law, and numbers attached, the kind an ethics committee can check line by line. And when the answer is yes, it’s a yes you can stand behind the same way.

Watch this exact case unfold — a real run of the agent, replayed tool call by tool call.

Scene 6 — the one rule inside

One rule makes the memo trustworthy: the AI never does the arithmetic. Claude — the AI — reads the messy consent language, spots the risky details, reasons about who could be recognized, and cites the law. But every number in the memo comes from a small, testable calculator. Judgment and math, kept apart — so you can check both.

the AI (Claude) reads the consent spots risky details reasons · cites the law the calculator counts people · computes k scores the risk plain code, fully tested no number crosses this line without a tool call
fig. 5 — if a number is in the memo, a tool computed it — never the model
Watch & read

See it run — pick a consent document and watch a real, recorded run of the agent replay: every tool call, every number, the memo at the end.

the problem, in 35 seconds (silent film)

judgment from the model, math from the math (silent film)

Read a sample decision memo — the exact artifact Lupta emits, on synthetic data.

Status

Built this week for “Built with Claude: Life Sciences” (Anthropic, builder track) — working end to end on synthetic Indian clinical records. India’s data-protection law (the DPDP Act) becomes enforceable 13 May 2027; Lupta is tooling that gets ahead of it. Submission Mon Jul 13; the source opens with it.