Holding the Pieces Without Looking at Them

Completing the Puzzle of Personalized Health — Part 3: the architecture, the fork in the road, and the one piece technology cannot cut

In the first essay, we found the puzzle was missing roughly eight pieces out of ten. The European Health Data Space solves institutional fragmentation, but the institutions only ever held about a fifth of what makes you you in health terms. The rest (how you sleep, what you breathe, where you live, what you carry in your genome, the slow drift of a body over decades) sits in no hospital and belongs to no registry.

In the second essay, we asked who should hold those pieces, and arrived at an uncomfortable answer: nobody should hold them the way institutions hold records today. Custody has to be graduated by intimacy, and the most intimate data should move only as a gift: donated, not sold, on the model that made Spain the organ-donation capital of the world.

Which leaves the objection every honest reader is now holding.

You have just described the most complete dossier ever assembled on a human being (genome, behaviour, environment, the whole continuous thread of a life) and you want someone to hold it. A vault that intimate is not a public good. It is the dream of every surveillance state that ever existed. Build it, and you have not solved the problem. You have armed it.

This essay is the answer to that objection. It has three parts. First, the technical move that makes a custodian who cannot read what it holds: not a promise, an architecture. Second, the genuine fork in the road that move forces: state or cooperative, and why the choice is harder than it looks. Third, the single piece no amount of cryptography can cut, and the honest roadmap for the rest.

Part I — Holding is not reading

The whole argument rests on one distinction that most data debates never make.

Holding data and reading data are different acts. We collapse them because, for all of human history, they came together: to keep a letter was to be able to read it. The filing cabinet, the database, the cloud bucket: every store we ever built let whoever held it look inside. So “who holds your data” became a question about who can see you.

That assumption is now false. Three pieces of well-understood engineering pull the two acts apart.

The vault that cannot read itself. Data goes in encrypted under a key the operator does not possess. The operator stores ciphertext (noise it is mathematically unable to turn back into meaning). A breach of the server yields nothing. A subpoena to the operator yields nothing, because the operator has nothing to give. This is not aspirational; MIDATA in Switzerland has run on exactly this principle for a decade, and lets account holders encrypt even their own access key so the server cannot be the point of failure.

Computation that travels to the data. The instinct of every research system is to copy data to a central place and analyse it there. Federated computation inverts this: the question travels to the data, runs locally, and only the answer comes back. The model that learns from a million people never sees a single record. It sees the gradient, the aggregate, the parameter update, but never the row. Your data contributes to the knowledge without ever leaving the box, and without anyone, including the researcher, ever looking at it.

Keys held by a quorum, not a master. The obvious flaw in an un-readable vault is the obvious human one: what happens when you are unconscious in an emergency room, or when you lose your key? The lazy fix is a backdoor (a master key the operator keeps “for your safety,” which is to say the surveillance state by the side door). Threshold cryptography refuses the trade. The key is split into shards held by separate guardians; access requires a quorum of them to act together, every act logged and auditable. Emergency access becomes a procedure with witnesses, not a permanent capability sitting in someone’s drawer.

Put the three together and the paradox we flagged in the second essay dissolves. You can concentrate custody without concentrating sight. One vault, the entire intimate thread of a life inside it, and no one (not the operator, not the researcher, not the state) able to open it and read you. The dossier the surveillance state dreams of is precisely the dossier this architecture refuses to assemble in readable form.

That is the move. Everything else is about who runs the box, and what it cannot protect.

Part II — The fork in the road

So someone holds a blindfolded vault for an entire population. Who?

There are exactly two honest answers, and the gap between them is the most important governance decision in this whole series.

The cooperative path. Citizens own the custodian collectively. One member, one vote. The operator is a non-profit answerable to its members, not to shareholders or a ministry. This is the MIDATA model, and it is not a thought experiment: it has existed since 2015, founded by researchers at ETH Zürich and the Bern University of Applied Sciences, and it works. Its legitimacy is the strongest of any model on offer: there is no state to fear, because the citizens are the institution, and they can walk out with their data whenever they like. MIDATA also made, deliberately, the move we built the second essay around. Its founders refuse monetary incentives for data sharing on principle: payment, in their view, is exactly the wrong incentive. Donation, not a price. The gift, validated in production for ten years.

And yet.

After a decade, MIDATA still accepts only residents of Switzerland. The partner cooperatives in Germany, Belgium, the Netherlands and the UK have spent years “in formation.” The architecture scaled beautifully; the institution did not. This is not a failure of execution. It is structural, and it teaches the lesson the cooperative path cannot escape.

A health data commons is only useful when almost everyone is in it. A vault holding 3% of a population answers no public-health question and trains no clinical model worth having. The value is in the near-totality, and a voluntary cooperative cannot bootstrap to near-totality, because the people most willing to join early are systematically unrepresentative, and the people the commons most needs are the last to arrive. Worse, cooperatives cannot raise equity (their members own them, so there is nothing to sell an investor), which leaves them dependent on philanthropy and grants for exactly the patient, expensive, decade-long build that population infrastructure requires. MIDATA proves the engine runs. It also proves the engine cannot reach population scale on cooperative fuel.

The state path. Only one actor can make a vault the default for everyone, fund it across electoral cycles, and treat it as public infrastructure rather than a project: the state. The state is the only custodian that can close the gap between 3% and 97%.

It is also the custodian people fear most, and they are right to. A state that holds the intimate thread of every citizen (even blindfolded) is one mission-creep away from disaster, one emergency law away from removing the blindfold, one populist away from deciding that some quora should be easier to reach than others. The architecture binds its hands. But the architecture is software and law, and both can be rewritten by whoever holds power next.

Here is the resolution, and I want to be honest that it is a wager, not a proof.

The state path becomes tolerable (and only the state path can scale) if, and only if, the architecture binds the custodian first. The sequence matters. You do not build the vault and then promise restraint. You build the box that cannot read itself, put the keys in a quorum the state does not control, make every access a witnessed procedure, and then hand the state the role of operating it. Custody without sight, enforced by mathematics before it is promised by ministers.

I will not pretend this dissolves the fear. The load-bearing claim of this entire series is that a state can be made to keep its own hands bound, and that is a political bet dressed in technical clothing. The cryptography is real. The willingness of future governments to leave it in place is not something cryptography can guarantee. Anyone who tells you otherwise is selling you the blindfold and quietly keeping a copy of the key.

What the architecture buys is not certainty. It is expensive defection. A state that wants to read its citizens must now visibly break the box, change the law, and reach a quorum it does not own (in public, in the logs, against the architecture). That is not impossible. It is merely hard, slow, and visible, which is the most any institutional design has ever offered against the abuse of power. We accept exactly this bargain with central bank independence and judicial review. This is the same bargain, for the same reason.

Part III — The piece technology cannot cut

Everything in Part I depends on a quiet assumption: that the most intimate data can, at the intimate end, be anonymised or aggregated away, donated through a box that returns only sums, never selves.

For almost everything, that assumption holds. For one thing, it does not, and pretending otherwise is the most dangerous move we could make.

The genome breaks anonymisation permanently, for two independent reasons.

First, re-identification. A genome is not data about an identifier; it is the identifier (the most durable one a person has). “Anonymised” genomes have been re-identified again and again from a handful of markers cross-referenced against public genealogy databases. You cannot strip the name off a genome the way you strip it off an address, because the genome is the name.

Second, and worse, familial leakage. Your genome is not only yours. It is a probabilistic disclosure of your parents, your siblings, your children, and children not yet born (people who never consented and cannot opt out of your decision to share). No consent form you sign can be valid on their behalf. The most carefully designed individual consent regime in the world is, for genomic data, partially a consent over other people.

The consequence is uncomfortable and we should say it plainly: anonymisation is not a technical solution for the genome. It is a promise that cannot be kept. Every architecture that quietly relies on “we’ll anonymise it” is, for this one category, lying (to itself first).

So the genome needs its own regime, carved out from everything else. Narrower consent, purpose-bound, revocable, with familial implications stated at the point of donation rather than buried. And the protection against the real harm (genetic discrimination by insurers and employers) has to come from law, not from engineering. You cannot anonymise your way out of discrimination. You can legislate against it, the way the United States did with GINA, and you can keep tightening that law as the technology advances. Discrimination risk is addressable over time. Re-identifiability is not. Confusing the two is how good systems make promises they will be forced to break.

The interpreter

There is one more piece, and it is human.

A continuous thread of data about a body is, without interpretation, not knowledge. It is noise that produces anxiety. Hand a person every fluctuation of every marker in real time and you do not create an empowered patient; you create the worried well (endless self-testing, false alarms, healthy people convinced they are sick because a number moved). The risk we flagged earlier, of turning every person back into a patient, is most acute precisely here, at the moment of richest data.

The answer is an interpretive layer, and its natural home is primary care. The family doctor, holding a longitudinal relationship rather than a single episode, is the one who can look at the thread and say: this matters, that does not, ignore the rest, let me watch this one. Primary care is the filter that turns a firehose of signal into a small number of things worth caring about. Without it, the person-not-patient model collapses straight back into hypochondria delivered as a service.

This is also the part of the system most countries are actively dismantling. Primary care is underfunded, overloaded, and in many places collapsing, in exactly the years we would need it to absorb a new interpretive role. The architecture is only ever as good as the humans reading its outputs to the people they belong to. A perfect vault feeding an empty clinic is not personalised medicine. It is a dashboard nobody can read.

The last piece is not technical

Here is the thing the engineering cannot tell you, and it is the most important thing in the series.

Spain leads the world in organ donation: 51.9 deceased donors per million in 2025, against 28.6 in France, 11.4 in Germany, 24.2 across the European Union as a whole. It has held that lead for more than thirty years. The easy explanation is the law: Spain presumes consent, opt-out by default. But that explanation is wrong, and the way it is wrong is the lesson of this entire essay. Many countries have opt-out laws and middling rates. The law is not what makes Spain exceptional.

What makes Spain exceptional is operational and cultural: a transplant coordinator in every hospital, families approached with extraordinary care at the worst moment of their lives, and a society that has come, over decades, to understand donation as a gift one gives. And the proof that it is a gift and not a confiscation is the number we rarely cite: even in the best system on earth, roughly one family in five still says no. The default does not coerce. It invites. The refusals are not a flaw in the system; they are the evidence that the consent is real.

That is the whole architecture of personalised health in miniature. The cryptography is buildable today. The vault that cannot read itself, the computation that travels to the data, the keys held by a quorum, the genome under its own law, the doctor who reads the thread back to you: none of it is science fiction. We could begin building it this year.

But the box is not the gift. The box is what makes the gift safe to give. What turns a population into donors is the same thing that turned Spain into the organ-donation capital of the world: trust, built operationally, over decades, by an institution that earned the right to be trusted with the most intimate thing a person has.

The technology completes the puzzle. The trust is what lets us pick up the pieces.