Scaling health analytics to millions without compromising privacy using deep distributed behavior models

Abstract

People are naturally sensitive to the sharing of their health data collected by various connected consumer devices (e.g., smart scales, sleep trackers) with third parties. However, sharing this data to compute aggregate statistics and comparisons is a basic building block for a range of medical studies based on large-scale consumer devices; such studies have the potential to transform how we study disease and behavior. Furthermore, informing users as to how their health measurements and activities compare with friends, demographic peers and globally has been shown to be a powerful tool for behavior change and management in individuals. While experienced organizations can safely perform aggregate user health analysis, there is a significant need for new privacy-preserving mechanisms that enable people to engage in the same way even with untrusted third parties (e.g., small/recently established organizations). In this work, we propose a new approach to this problem grounded in the use of deep distributed behavior models. These are discriminative deep learning models that can approximate the calculation of various aggregate functions. Models are bootstrapped with training data from a modestly sized cohort and then distributed directly to personal devices to estimate, for example, how the user (perhaps in terms of daily step counts) ranks/compares to various demographics ranges (like age and sex). Critically, the user's own data now never has to leave the device. We validate this method using a 1.2M-user 22-month dataset that spans body-weight, sleep hours and step counts collected by devices from Nokia Digital Health - Withings. Experiments show our framework remains accurate for a range of commonly used statistical aggregate functions. This result opens a powerful new paradigm for privacy-preserving analytics under which user data largely remains on personal devices, overcoming a variety of potential privacy risks.