The power of Zero Knowledge Proofs in Healthcare

Transcript

foreign [Music] works good morning everybody my name is Ali hababe I'm product manager for web3 atrosh which is a pharmaceutical company and today we want to talk about zero knowledge proofs in healthcare so actually this picture is very a lot relevant this is Alibaba because outside

of the Middle East whenever I say my name is Ali everybody asks me do you know Alibaba and I'm like no you're the first one who tells me that but actually it's relevant today because Geo knowledge proves is all about proving your inside of the cave without without saying what the magic word is so what is zero zero knowledge proves it's an encryption method where one party can prove to another that you know value X without revealing that secret value an example you can prove that you know a secret password without revealing what the password is it's as simple as that another example proving you have a secret cookie recipe without giving the

ingredients so you can just give the cookie tastes the same good that's zero knowledge proof so why do we need that why do we need zero knowledge proofs in healthcare it's a really quite simple because due diligence is really time consuming and of course the data security stuff so with all the fancy stuff around zero knowledge proofs when it comes to reality and real applications like healthcare you know not Finance no I'm joking it's all about making due diligence very efficient so please meet Pepe the patient Pepe the Frog

his age he's eternally youthful occupation full-time meme Legend and you can see all his data now imagine that this is his health passport Pepe's Health passport and now we're gonna look at use cases when it comes to zero knowledge proofs with this health passport so if Pepe goes to the hospital the first time they need to know everything now do they need to know everything not really but because of compliance they want everything so Pepe has to reveal the Whole Health passport however if Pepe wants to go to the pharmacy and get some medication he

doesn't need all this data to reveal all he needs is his name his picture on the ID should look like the person who's holding that ID which is not so hard and of course he needs to have a prescription that says what is the condition that Pepe has in this case he has chronic viability syndrome or hypermemptic disorder these are serious diseases now when it comes to pharmaceutical companies or anybody who wants to do some research technically we don't need the name we don't care who the patient is what's the gender of this of the patient most of the time all we need to know that this is a patient a verified patient that has that specific disease

and they are being treated in one of our products in the example of Roche but of course it applies to all pharmaceutical companies now some pharmaceutical companies they have what we call Patient support programs where basically the patient cannot afford our medication in that case we have these programs patient Support Program where all we need to know that this patient qualifies for that patient Support Program meaning they have a specific yearly income that doesn't is now able to cover that for that what what do we need to know we need to trust that this patient is from that yearly income range and they have that specific disease and they're being treated in one of our medication so that's why

in that case we don't need all this burden of personal data so other use cases that I'm going to go through very quickly so we give some time later for Q a if there's any in what we call outcome-based contracts mainly the healthcare scene is changing a little bit back in the time you know you you give medication then the payers meaning health insurance that will pay you for that medication however this is changing a little bit now there is new types of contracts meaning like the payers are only willing to pay if the outcome of this medication is showing Improvement of the patient's life um these are new contracts that can be

zero knowledge proof can be perfect use case for it Insurance comp companies are also very worried about fraud like healthcare fraud and they require a lot of documentation so with zero knowledge proof we can just make this much more efficient without risking revealing the data of the patient and at the same time patients in so many markets they want to know if this healthcare provider is certified and he is or she is who they say they are and again this isn't a perfect use case for healthcare so what are we doing at rosh we're building dimi now it's version two last year I talked about version one what did we add to it we added zero

knowledge proofs so without revealing the data we're also changing the chain that we were on we were working with a smaller chain and now we're going to a public blockchain that's much more used and better so basically what is dimi distributed digital identity allows the patient to own their data share it with whoever they want for whatever purpose we agree on for a specific time and they can potentially even get rewarded for that data so it's a distributed identity remember Pepe the patient you can use one identity in many places without risking that your data will get revealed this is just a quick summary about how

it works but basically you have a patient goes to the doctor they do a handshake not a literal handshake but like you know transaction handshake so basically the doctor and the patient would sign that transaction this transaction signature will go on the blockchain and the data can go to a separate storage for example ipfs or it could be stored even on the patient's device if that's if the country allows that and and then the patients are able to have their in the root folder we call it all their identity that's not revealed to anybody and then you have like subfolders where you have your identity for that specific hospital that specific clinic and whatnot and then you share only that

just like a quick demo how it looks like the solution from a patient side patients can even see their points how many tokens they they did because they can we can send them some surveys and they answer these surveys without revealing their identity and they can get some tokens that they can later cash it out as physiotherapy lessons or a discount on our medication or whatnot yeah another nice app looking so how does it work I see the animation here is messed up sorry for that so the patient creates a DME account basically they're just creating a wallet and they Grant access to healthcare data for a specific doctor or healthcare provider

and after the doctor or the healthcare provider diagnose the patient they can give them a certificate that this is the the certificate that they can use to prove themselves later on they upload the data on a separate storage system off chain this could be as I said ipfs or something else then rosh in that in that case they can query the interactions between a specific doctor that we certified we gave them the certificate so we trust them and then we get a list of wallet addresses in that case about specific interaction and then we can request consent from the patient if the patient gives us the consent then we're able to get aggregated version of the data not on a patient level more like aggregated

so we are gtpr compliant so how does the DME work in practice your request consent they Grant you zero knowledge proof then you have non-identifiable patient data and then our scientists they can do all kind of studies they want on that so why are we doing dimi first of all it's a compliant data sharing without third party we're trying to move all the burden of having personal data and at the same time not having a single point of failure of course with blockchain data integrity and data privacy because the data never leaves its location only the proof of the data

that goes there we call this support beyond the pill so after you take your medication we can still be in contact with that with you without identifying who you are which is cool and we can translate later this data into evidence that helps us in compliance and helps us to improve our products as well and of course the the most beautiful part about this is you as a patient you can own your data and this is like a new paradigm right so why do we need zero knowledge proofs for that we want to remove third parties at the same time we like to reduce costs and improve the security and the ownership of data

so here I'm going to share some of the lesson learned from my own experience this doesn't reflect rosh opinion this is just my experience first of all if you want to build any kind of healthcare solution you have to remember hospitals doctors don't have time the moment you come and say hey guys I have an Innovative idea like nah they really don't have time so whatever solution you want to build be it blockchain or not blockchain you have to always find a way to do it without like with minimum involvement from the I.T team of the hospitals and you have to think later on when they when they use it how can I reduce the patient's time and make it efficient for them

existing infrastructure is a pain so hospitals and even some of our data is really traditional systems that's very hard to integrate you really need government support in most of the countries you cannot do it bottom up you always have to do it top down and building on small ecosystems is really tough so that's why it makes sense to go to larger ecosystems that's why we change the chain that we're working finding talents to pioneering a new system is also a challenge and the final thing I would like I would like to leave you with is startups are cool but sometimes they disappear so make sure you know who you're working with thank you so much and if you have any question please let me know

otherwise we can connect and you can ask me online foreign [Applause] first of all congratulations for the presentation and the project in Brazil we try to do something similar we called My Health Data project but at the time the challenge was about gdpr because everybody when we started to talk the first thing oh the patients that are how they will release the information legal stuff blah blah blah

how did you tackle this this problem yeah thank you I mean gdpr is one of the most biggest challenges we're facing when Building decentralized Systems that's why as we said we're using zero knowledge proofs basically the data should never leave the location of it like let's say it's on the hospital side or on the patient level we never get patient level data we only get aggregated version of the data which is allowed by gdpr as long as you have enough animalization of the data it should be you should be fine as long as you cannot do deep Mining and finding out who the patient is based on the interactions on the blockchain then that's fine but it's really one of the biggest challenges that's why we're not really like now focus on Europe we're

trying to do it somewhere else until just we prove the case and then then we can see there's one more question if you have time yeah this is like as I said it's a paradigm shift we're trying to give ownership of the data from the hospitals back to the patient right so it really depends on the country that's why we're trying to do this outside of Europe and and the US for now because it's a

paradigm shift right if you own your data as a patient then you are the one to decide with whom you want to show it for what purpose and that's what gdpr is all about right so I see this is changing the ownership of the data will change one day my opinion from the hospitals back to the patient and hopefully also in the US we'll follow through after that thank you guys all right one more if we have time be little quick thanks uh so yeah we are building also a same project Health Data Book to give a solution for the gdpr compliance you have to do to make it like an avatar

and with an avatar your data is borderless and compliant to gdpr so by just having an avatar you the new gdpr compliant yeah in fact you you put data on an avatar and it make it like um not personal and you can yeah I mean you're right if you if you do the data non-identifiable data that's fine but if the Avatar is like kind of a digital twin of you and you run any kind of analysis on that data then you're not gdpr compliant right it's all about the data regardless if you have an avatar or yet you can encrypt it no problem perfect thank you so much thank you thank you [Applause]

[Music]