Health surveys for hospital studies
Health questionnaires whose names we cannot read.
A study manager builds the questionnaire, chooses how participants are enrolled (open mode, where no identity is collected, or named mode, where identity is encrypted for the physician alone), opens the study and follows recruitment from a browser, with no developer. Participants respond from their phone. Results are published without anyone being identifiable.
Auspex 1.10 — fully functional and tested version. A new version is under development, with optimisations. Current status — internal pilot phase.
The central mechanism
In named mode, the participant's identity is encrypted on their phone, for their physician alone
Canarin never holds an identity in the clear: in open mode there is none, and in named mode the server stores only what the physician's key can open.
This mechanism applies to named mode. Name and date of birth are encrypted in the participant's browser to the physician's public key — ECDH P-256, HKDF-SHA256 derivation, AES-GCM encryption. The associated data binds the message to the study and the physician: moved to another study or altered by a single byte, it no longer opens. The physician's private key exists in the clear only within their browser session and cannot be extracted from it.
ON THE PARTICIPANT'S PHONE
Encryption happens here
In named mode, at the moment of consent, the phone encrypts the name and date of birth. What leaves for the server is already unreadable. The address must be https: otherwise the page refuses to work rather than encrypt badly.
ON THE CANARIN SERVER
Only encrypted data remains
Unreadable identities (named mode), responses filed under a random code, and professional email addresses. In open mode, no identity is stored at all. Someone who obtained full access to the server could not link a response to a person.
IN THE PHYSICIAN'S BROWSER
Decryption happens here
In named mode, the physician unlocks their key with their passphrase and sees their participants' names next to their codes. No one else, Canarin included, can make that link.
Two enrolment modes
Wide outreach or named follow-up: the study manager chooses, study by study
The mode is chosen when the study is created and locked once it opens. It determines what is collected about participants — and therefore what there is to protect.
OPEN MODE — GLOBAL SURVEYS
Take part with one scan, without giving an identity
For wide outreach, where identity serves no purpose in the study.
- Wide outreach: posters, QR codes in waiting rooms, newsletters, stands, conferences. The study manager creates global links; each physician also has a personal link.
- Instant participation, no identity: consent, a PIN, then the questionnaire. No civil-status data is requested or stored.
- Resuming with the participant code and PIN, including on another device.
- Real-time recruitment: scans, registrations and submitted questionnaires, per link. These are counters, never people.
NAMED MODE — TARGETED SURVEYS
A closed cohort, followed by its physician
For studies where the physician must be able to find each participant again.
- Enrolment by practitioners: the physician creates a single-use code per patient, shown on screen or printed as a sheet of QR stickers (no patient data on the sheet).
- End-to-end encrypted identity: name and date of birth are encrypted in the participant's browser to the physician's key.
- Enrolment confirmed automatically; the physician can un-confirm or reject it. Each code works once and expires after 30 days.
- Closed cohort, secure follow-up: only people holding a code can register, and the physician finds their own.
GDPR and medical confidentiality. Open mode applies data minimisation: no identity is collected, so there is nothing to encrypt. Named mode applies asymmetric encryption (ECDH P-256, AES-GCM, described above): only the physician's key opens the identity. In both modes the study manager oversees recruitment without ever seeing an identity, and can erase the study at any time after it opens: personal data is then irreversibly deleted, while published results and the audit log are kept. In both modes, participants can stop at any time.
Trust model
Who sees what, exactly
This table answers the question that ethics committees (CPP in France) ask. Each row is enforced by the database itself, not only by the interface.
| Role | Participant name (named mode) | Individual responses | Participant code | Recruitment by centre | Pseudonymised export |
|---|---|---|---|---|---|
| Investigator physician | Yes their own participants, in named mode only | Yes their own participants only | Yes complete for their own, masked for others | No | No |
| Study manager | No no route allows it | No no access to participant rows | No | Yes headcounts, physicians' last login | Yes data of their own sponsor |
| Statistician | No | No no participant row is returned to them | No | No | Yes granted studies, revocable at any time |
| Canarin, the vendor | No encrypted in named mode; no identity exists in open mode | Technically yes, but under a random code, not linkable to a person | Technically yes | No | No |
| Public | No | No | No | No | No |
The public sees only the results page: aggregated tables, in which small counts are masked. Nothing individual appears there, ever.
Course of a study
Six steps, from the empty questionnaire to published results
Order matters: each step unlocks the next. A study cannot open without a questionnaire, and in named mode a physician cannot create patient codes until their keys exist.
Create the study and build the questionnaire
Eight question types, display conditions (a given question appears only if a given answer was provided) and six languages, in an editor with a participant-side preview. The study starts as a draft. The study manager also chooses the enrolment mode, open or named, which locks when the study opens.
Invite the physicians, open the study
Physicians are added by email address. The activation link is single-use and expires. The study cannot open without a questionnaire; once open, any change creates a new version.
Activate their account, get their link or keys
Password of at least twelve characters, plus an authentication app. In open mode, the physician gets a personal link and a printable QR card. In named mode, they also generate their encryption keys, required to create patient codes; a printable recovery key lets them change their passphrase, and Canarin cannot replace it.
Scan a QR code or enter a code, consent, respond
Open mode: consent, choosing a PIN, then the questionnaire, with no name or date of birth. Named mode: the participant uses the single-use code given by their physician; name and date of birth are encrypted on the phone before sending. In both cases the participant code and PIN let them resume later, on another device. Responses are saved as they go.
Follow, confirm or reject enrolments
In named mode, the physician sees their participants' names and reads the responses; enrolment is confirmed automatically and can be un-confirmed. In open mode, they follow their participants by code, without names, and the study manager follows recruitment per link in real time. A rejection is final, justified from a fixed list, and visible to all study professionals — full code for the one who rejects, masked for the others.
Analyse, close, publish
An interim analysis runs every day without intervention. On the end date the study closes by itself, the final analysis runs and the public page switches to it. Accounts and sessions are deleted and enrolment links and codes die; responses stay readable by their physician, and in named mode so do identities. The study manager can also erase the study at any time after it opens: personal data disappears, while published results and the audit log are kept.
Publication
Why a public table does not allow tracing back to a person
Masking small counts is not enough
If a cell contains fewer than ten people, it is masked. But masking a single cell in a row protects nothing: it is enough to subtract the others from the total to recover it. Auspex therefore also masks one additional cell, chosen so that the subtraction yields nothing.
| Group | Published | Without the second suppression |
|---|---|---|
| 18–39 | 42 | 42 |
| 40–59 | masked | masked |
| 60+ | masked | 35 |
| Total | 84 | 84 |
On the right, it is immediately deduced that the 40–59 group has 7 people. On the left, it is not.
The other rules
- The overall table and the tables by centre are processed as a single table, so that they cannot be differenced against each other.
- Small centres are pooled rather than published separately.
- No minimum or maximum is published: an extreme value often points to one person.
- No free-text response is ever released — a participant may have written their name in it.
- Multiple-choice questions are examined together with their complements.
- An automatic check refuses to write the report if any of these rules is not met. There is no "forced" publication.
Verification
What is verified by tests, not merely asserted
Each promise on this page corresponds to a test that fails if the promise ceases to be true.
Keys, sealing, key substitution, replay between studies.
Rights by role, locking, audit log, closure.
Properties of the suppression, tables, real execution.
Twelve scenes, all roles, in a real browser.
- A substituted physician key is refused at enrolment: the phone compares the fingerprint carried by the link — which is never sent to the server — with the one the server announces.
- A stolen participant code is not enough: the PIN is required. Five failures lock the code for fifteen minutes, and the delay doubles each time. The same error is displayed for a wrong code and a wrong PIN.
- An enrolment link that circulates — lost card, forwarded message — allows someone to enrol as a participant of that physician, who sees the enrolment and rejects it. The rejection remains visible.
- The audit log is chained by fingerprints. A modification made by a database administrator, with safeguards disabled, is detected: this is tested.
- The export contains only submitted, non-rejected responses: no code, no identity, no free text, one-way row identifiers that are stable from one export to the next. Each download is logged, and a revocation takes effect immediately.
- The manager cannot designate themselves as statistician, and a physician cannot export.
If you are taking part in a study
What we ask of you, and what we do with it
You arrive through a QR code, a link or a code, not by browsing this site
Depending on the study, you scan a QR code (poster, waiting room, newsletter, or your physician's card) or open the link or single-use code your physician gives you. Either way it does not come from this site. You open it on your phone. What happens next:
- The study is explained to you and your consent is requested. You may decline.
- Depending on the study's mode: in named mode you are asked for your name and date of birth, encrypted on your phone before being sent, and only your physician can read them; in open mode, no identity is requested.
- You choose a PIN and receive a participant code. Keep them: they allow you to come back and finish the questionnaire later, including on another device.
- You respond. Each response is saved as you go: if you close the page, you lose nothing.
- Your individual responses are never published. What gets published are totals, where your case is lost among the others.
Canarin, which runs the platform, cannot read your name. In open mode there is none; in named mode this is not a commercial promise: encryption happens on your phone, and we do not hold the key that opens it.
Roadmap
What comes next
Auspex 1.10 is functionally complete and tested. The next version is under development; here is what it brings.
Analysis
- Cross-question suppression: today, two tables for related questions could in principle be differenced against each other.
- Statistical models beyond descriptive tables, for studies that need them.
Operations
- Key rotation for a physician, without manual intervention.
- Sending invitations by email: today the link circulates through the channel chosen by the manager.
Current status
What is done before a first hospital study
Auspex is in an internal pilot phase: no real hospital study has started yet. The security and operations points below have been addressed; the list is kept up to date with the code.
Technical (October 2026)
- Independent review of the encryption code and key handling, and a penetration test: high and medium findings fixed
- Proxy TLS configuration (HSTS) and a verification script
- Monitoring: API status, scheduler failures, audit log verification, encrypted backups
Legal and organisational
- Hosting meeting HDS requirements, on an account separate from the sensor platform
- Written retention and purge procedure, with a designated person in charge; automatic purge at the end of the period
- Incident procedure: who re-invites, who reads the log, what to do if the audit chain breaks
Custody of the data rests with the physician, and this is not a shortcoming: it is the consequence of the design choice. Decryption takes place in their browser. From the moment they unlock their key, the names and responses of their participants are readable on their workstation — and their security then depends on the physician: the workstation itself, the open session, and the recovery key they keep offline. Canarin can neither help nor stand in for them, since we do not have the key.
This practical custody does not shift legal responsibilities: the data controller remains the sponsoring hospital, the investigator physician acts under its authority, and Canarin remains a processor within the meaning of article 28. The details are in the legal framework.
This list is published because an ethics committee will ask for it anyway, and a health data platform that does not show where it stands is not credible. It is kept up to date with the code.
Legal framework
Who is responsible for what
The hospital is the sponsor
It remains the data controller. The study data are its own; the pseudonymised export belongs to it.
Canarin is the processor
Within the meaning of article 28 of the GDPR.
Formalities remain with the sponsor
Opinion of the ethics committee (CPP in France), CNIL declaration — generally under the reference methodologies MR-001 or MR-003. We provide the technical documentation for the file.
Multicentre studies
One sponsor, several centres. Private practices take part as centres of a study led by a hospital.
Frequently asked questions
For hospitals and practices
Questions about air quality sensors are handled on canarin-sensors.com.
Who can commission a study?
Hospitals, as sponsors. A private practice can take part as a centre of a study led by a hospital, which allows a single study to extend across several establishments.
Is a developer or an IT integration needed?
No. The study manager does everything from their browser: questionnaire, invitations, monitoring, analysis, closure. On the institution's side, there is nothing to install. The only technical requirement is that physicians have an authenticator app on their phone.
What is the difference between an open survey and a named survey?
An open survey is made for wide outreach (poster, newsletter, waiting room): people take part by scanning a QR code, with no name or date of birth requested, and the study manager follows recruitment in real time (scans, registrations, submitted questionnaires). A named survey is a closed cohort: the physician gives each patient a single-use code, and the identity is encrypted in the patient's browser for the physician alone.
The mode is chosen when the study is created and cannot change once it is open. Choose open mode if people's identity adds nothing to the study (data minimisation); choose named mode if the physician must be able to find their patients again.
How is the questionnaire built?
Either directly by your team in the editor, or by us from your documents — protocol, paper questionnaire, guidelines. In both cases the expert reviews and validates before it goes live, and the validated version is frozen: any change after opening creates a new, traced version.
Can one verify how the results were calculated?
Yes. The analysis runs in Python and its code is made available, with the formula behind each indicator. The rules for masking small counts are also public and tested.
What if a physician loses their passphrase?
They use their recovery key, printed at activation, to set a new one. Without this key, the identities of their participants are permanently unreadable: Canarin cannot recover them. This is the direct counterpart of the fact that we do not hold the key. The recovery key must be kept offline.
Can a study be repeated?
Yes. A new wave or a new centre reuses the same validated questionnaire; only the enrolment links and the campaign change.
Is artificial intelligence used?
Not in the platform. Auspex 1.10 produces descriptive tables, calculated by readable code, and nothing else: no model is involved in the published results.
More advanced analysis work — exploration of risk profiles at population level, processing of free-text responses — falls under a separate study service, discussed case by case, where any result is described as exploratory. No individual risk score is produced.
Where is the data hosted?
In France, on hosting that meets HDS requirements, separate from the sensor platform.
Canarin's two activities
Canarin does two distinct things
One question links them: what we are exposed to, what does it do to our health? But they are two businesses, two sites and two separate databases.
The two names say the same thing. The canary went down the mine to warn before the men. The auspex, in Rome, observed the flight of birds to draw from it what was to come — the word "auspices" comes from him. Two ways of reading birds.
canarin-sensors.com
Canarin Capteurs
Measuring the air of a place, continuously, and making it readable. Hardware and access to the platform.
- For schools, local authorities and businesses
- Measurement data, no personal data
- Obligations under the indoor air quality decree
auspex.canarin-sensors.com
Canarin Auspex
Health questionnaires for studies run by hospitals, with results published without anyone being identifiable.
- For study managers, investigator physicians and statisticians
- Health data, under the responsibility of the sponsor
- The participant arrives through a QR code, a link or a code from their physician
You are here
Nothing flows between the two. No sensor measurement joins a study, and no participant response flows back to the sensor platform. Each activity has its own hosting, database, privacy policy and legal basis. A link between them, if it were ever relevant to a study, would require its own agreement and its own review by an ethics committee.
Access
Entering Auspex
Professional area
Physicians and study managers. Access is created by named invitation, never as open access.
Resume a questionnaire
With your participant code and your PIN. A first participation always starts with a QR code, a link or a code given by your physician or the study team, never from this site.
Questionnaire editor
Build, translate and preview the questionnaire as a participant will see it. Reserved for study managers.
Set up a study
Let us start by talking about it. Tell us the subject, the number of centres envisaged and the deadline: we reply with what is feasible today and what first requires a prerequisite to be met, without embellishing anything.
And if your specification requires something else, let us discuss it: our teams can consider an adaptation of the existing features, or a bespoke development. A study does not fit a mould — questions, languages, enrolment pathway, report format. We look together at what is possible, under what conditions, and what is not: it is by discussing it that we find out.
auspex@canarin-sensors.com