PII Redaction

Redact personal and sensitive information from the text below. Return the redacted text and a report.

What to redact, replacing each with the token shown:
- Full or partial names of individuals: [PERSON_1], [PERSON_2], numbered consistently so the same person keeps the same token throughout
- Email addresses: [EMAIL_1]
- Phone numbers, in any format: [PHONE_1]
- Street addresses: [ADDRESS_1]. Keep city, state, and country unless told otherwise.
- Government identifiers (national ID, social security, passport, driver's license, tax ID): [GOV_ID_1]
- Payment data (card numbers, bank accounts, routing numbers): [PAYMENT_1]
- Account numbers, customer IDs, case numbers, order numbers: [ACCOUNT_1]
- Dates of birth: [DOB_1]. Keep other dates.
- IP addresses, device identifiers, precise geolocation: [DEVICE_1]
- Health conditions, diagnoses, treatments, and medications: [HEALTH_1]
- Usernames, handles, and profile URLs that identify a person: [HANDLE_1]
- Credentials, API keys, and tokens: [SECRET_1]

What to preserve:
- Sentence structure, formatting, and every non-identifying word. Redact the identifier, not the sentence around it.
- Organization names, job titles, and product names, unless the organization is small enough that the title identifies one person. Flag that case rather than deciding it silently.
- Relative time and sequence ("three days later"), which usually carries the meaning the text was kept for.

Rules:
- Consistency matters more than aggressiveness in one direction: the same entity must always map to the same token, and two different entities must never share one. Inconsistent tokens destroy the text's usefulness.
- Watch for indirect identifiers: a job title plus a company plus a city, a rare condition plus a location, a nickname used once. Redact them, and list them separately as inference risks.
- When you are unsure whether something is personal data, redact it and list it in the uncertain section. Over-redaction is recoverable; a leak is not.
- Never invent replacement details, and never paraphrase to avoid an identifier. Use the tokens.

Output:
1. The redacted text.
2. A table of token to category and count (not the original values).
3. **Uncertain**: what you redacted defensively and why.
4. **Residual risk**: what remains that could still identify someone in combination, even though no single item is an identifier.

Text:
"""
[PASTE]
"""