EP3433778A1

EP3433778A1 - Software having control logic for secure transmission of personal data via the internet from computers to the server, with secure storage of the data on servers

Info

Publication number: EP3433778A1
Application number: EP17712917.8A
Authority: EP
Inventors: Thomas Krech
Original assignee: Individual
Current assignee: Individual
Priority date: 2016-03-21
Filing date: 2017-03-21
Publication date: 2019-01-30
Also published as: CH712285B1; CH712285A1; WO2017161464A1; US20200272761A1

Abstract

The invention relates to a personal data network (1) having a server device (2) for storing personal data of a user, and having a computer unit (3) associated with a user, in particular a smart phone, Tablet PC or iPad, and desktop PC. The computer unit (3) and the server device (2) communicate via a network (1, 28) in order to exchange de-personalized data. The personal data network arises from the fact that only data which permit no direct or indirect conclusions to be drawn about the person is conducted via the network and stored in the network; this is so-called de-personalized data. According to the invention, the personal data of the user is already de-personalized on the computer unit (3) by means of an identifier (5) and is transmitted to the server device (2), where the personal data is stored in a de-personalized manner under the identifier (5). Here, the identifier (5) results from an allocation rule, which is stored only on the computer unit (3). Personalization of the de-personalized personal data (4) in the form of an allocation of the de-personalized personal data to the associated user is not possible on the basis of the de-personalized personal data (4) present on the server device (2) and the identifier (5). Furthermore, allocation during the transmission of the de-personalized data via the network is likewise not possible. In the form of an alias identity, the identity of the user can be "loaned out" in a time-restricted or permanent manner in the form of an identifier (7), for example to a supporter computer device (10) or to a trustee computer unit (12), in order that data accumulating there can be transmitted to the server unit in a de-personalized manner under the loaned-out identifier (7).

Description

TAX LOGISTICS SOFTWARE FOR SAFE PASSING OF PERSONAL DATA THROUGH THE INTERNET OF COMPUTERS TO THE SERVER WITH SAFE STORAGE OF THE DATA ON SERVER

TECHNICAL FIELD OF THE INVENTION

The present invention relates to methods by means of which the security of personal data in electronic networks and on servers can be increased. This applies in particular to the collection, de-personalization, re-personalization, processing and modification of all types of data of a user, such as medical reports, findings, vital data, data in communication with banks and state and private institutions of all kinds.

STATE OF THE ART

Electronic data of a person are usually distributed in many memory locations, starting with the personal data, at the family doctor, in hospitals, at health insurance companies, on smartphones - from fitness trackers and vital data and data from devices in the sense of Internet of Things, such as water and water Electricity meters -, insurance data to bank account balances and data from Internet service providers - such as Google and Facebook. There is an increasing interest in bringing this data together and evaluating and sharing it for the benefit of the user and the general public. A user's data is often provided to and kept in a personalized form to people or institutions without this being necessary.

Users as well as legislators are increasingly interested in de-personalizing personal information in order to avoid misuse of personal information. The importance of the de-personalization of personal data increases, if not only individual personal data is available, but a combination of all personal data of a user takes place and u. U. such summarized personal data are stored centrally.

The idea of collecting personal data to provide a patient 's mobile file is maturing, especially in the US, and is reflected in the iPhone application Health Chron (https://www.linkedin.com/pulse/why-you - should-own-your-health-data-loc-pham). A data collector platform is under development in the US under the designation "Physi-IQ" (http://www.physiq.com/markets/). This data collector platform continuously collects vital data from a user and then makes it available to doctors so that they can proactively handle it based on the vital data. The company, which is developing the data collector platform, has contacted Samsung to use a Samsung-developed SAMI data exchange platform to transfer sensor data to the cloud (see https://developer.samsungsami.com). io / sami / sami-documentation /).

In countries like Denmark or the Netherlands, nearly all patient records are already electronically managed. In contrast, the process of introducing a digitization of patient data, for example, is progressing slowly in Switzerland or Germany (http://www.healthbytes.de/eu-studie-health-durchdringung-allgemeinÄrzte-deutschland-potenzial /). The EU launched the pilot study EPSOS (http://www.epsos.eu/home/download-area/information-on-healthcare-and-ehealth.html) with the aim of providing cross-border medical care for EU citizens Supply based on electronically stored personal data. In Switzerland, an interdisciplinary working group IPAG EPD is taking care of the structuring of an electronic patient file (http://www.saez.ch/aktuelle-ausgabe/details/ipag-epd-nach- der-stappe-ist-vor.) Within eHealth-Suisse -the-etappe.html). The legal aspects are regulated in Switzerland in the federal law on the electronic patient dossier (EPDG).

The aim of EP-A-1 939 785 is to cleanse patient data of personally identifiable information so that, for example, the de-personalized data from many patients and from different sources at different times can be evaluated by research institutes. Another object of EP-A-1 939 785 is that the depersonalized patient data of a particular patient can be correlated without having to resort to the personal data. This is achieved by providing the personal data originating from a person with an anonymous, encrypted connection code by means of a program installed on the computer. In the process, the personal data that can be deduced from the person is deleted from the original patient data before it is forwarded to a database. According to EP-A-1 939 785, there is a functional relationship between the anonymous connection code and the personal data so that each data source can generate the anonymous connection code from the same, predetermined parts of the personal data. The predetermined parts of the personal data are first encrypted (each by themselves) and then input in a first hash function. The output from the first hash function is entered into a second hash function along with the anonymous connection code. The output of the second hash function is then encrypted before the data is sent to a server. The data is decrypted on the server and is then available for patient-related and other evaluations without the personal data having to be known.

WO 01/18631 (D1) in turn describes a method in which depersonalized patient data is stored on a server and made available to users (patient or doctor). In this case, the data is provided with an identifier from which a hash value is generated and which, if appropriate, can still be encrypted.

US Patent Application No. 2006/0179073 (D3) describes an information management apparatus for processing data containing personal data in which the personal data is extracted from processing object data and a unique code is generated based on this data. Thereafter, the personal data of the processing object data is replaced with the unique code to generate primary conversion data. In a transmission of the primary conversion data, they are additionally encrypted with a predetermined password. The method described preserves the value of the original data for statistical evaluations, even if the personal data has been replaced by the unique code.

OBJECT OF THE INVENTION

The invention has for its object to propose a personal data network (1, 28) and software with control logic for use in a personal data network (1, 28), which with respect to the security of personal data in terms of unauthorized access Third,

the de-personalization of personal data, a user and / or a plurality of users and / or the generation of personalized personal information from de-personalized personal information. Another object of the invention is that the personal data network can manage personal vital data of a user. Another goal is that the user is informed as early as possible about possible health problems.

SOLUTION

The object of the invention is achieved with the features of the independent claims. Further preferred embodiments according to the invention can be found in the dependent claims.

DESCRIPTION OF THE INVENTION

In a personal data network according to the invention, a server device is used. This server device may be a singular server unit or a plurality of networked server units. Personal information of a user is stored on the server device. Such personal data is, for example, a user's vital data, such as blood pressure, body temperature, activity data, such as a distance traveled or a number of completed steps or steps, and the like. Ä., These vital data, for example, of so-called wearables such as bracelets (http://www.aerzteblatt.de/nachrichten/62732), a smartphone fitness application (such as under the label "Endomondo" or as the Health Kit Apple or S Health of Samsung, distributed), may be derived from a building services or personal belongings such as an electric toothbrush, a car or mobile diagnostic devices (http://www.aerzteblatt.de/nachrichten/62729). Alternatively or cumulatively it is possible that personal data are patient data such as, for example, medical and treatment histories, doctor reports, referral reports, examination findings such as X-ray images, ECG, laboratory findings, histological findings, images and videos of patients (in particular concerning results of examination procedures). Skin changes, mucous membrane changes, wounds), data on the diagnosis and assessment of the course of healing, data taken from the sick and intensive care units, genetic data and the like. Ä. acts. Furthermore, the personal data network according to the invention has a computer unit which is assigned to a user. To indicate some non-limiting examples in this regard, the computing device associated with the user may be a computer, a tablet, a mobile phone, a smartphone, a smartwatch, a wearable, or a PDA.

In the context of the invention, the computer unit and the server device communicate via a network to enable an exchange of personal data. This can be done on the one hand to allow the user access to his personal data via the computer unit, and on the other hand to a transfer allow personal data from the computer unit to the server device for storage on the server device.

According to the invention, it is proposed that the personal data on the server device is not stored as personalized personal data. This is to prevent the possibility that third parties who access the server device (authorized or unauthorized) gain knowledge of the personalized personal data. According to the invention, it is proposed that the personal data on the server device be stored exclusively as depersonalized personal data. In this case, "de-personalized personal data" means any form of personal data for which an assignment of the personal data to the person concerning this personal data is not possible. In this regard, to mention but a few non-limiting examples, the data may not have a name, categorization, or a type of "header" that includes a name of the person or any other identifiable association with the person. Alternatively or additionally, it is possible that in the personal data itself (for example in a medical report or in another document, a picture or the like) all personal information is eliminated.

However, without further measures according to the invention an access of the user to the personal data would not be possible since a finding of the de-personalized personal data and their assignment to the user would no longer be possible, with which the de-personalized personal data would be "lost". To avoid this, a ZuOrdnungsvorschrift is present in the invention on the computer unit, which is assigned to the user. The ZuOrdnungsvorschrift is in this case made arbitrarily, as long as this assigns a user and his personal data a label that per se for third parties do not recognize which user describes this label. In order to name only a simple example, which does not limit the invention, the identification can consist of a simple number, which is assigned individually to the user. If the personal data are marked with this number, the user or the computer unit assigned to the user who knows the identification in the form of the number about the assignment rule can identify and recognize the personal data marked with the number as his.

Within the scope of the invention, the personal data is stored on the server device both with the de-personalized personal data and with the said identification. Since personalization of the de-personalized personal data in the form of assignment of the de-personalized personal data to the associated user on the basis of existing on the server device de-personalized personal information and labeling is not possible, is still the confidentiality needs of personal information and protection against abuse. The invention proposes that the computer unit which is assigned to the user has control logic, in particular software, by means of which a request to the server device that a transmission of the de-personalized personal data of this user should take place is generated. This request includes the tag associated with the user. When the server device receives such a request with the tag, the server device may select from a variety of de-personalized personal data the de-personalized personal data associated with the tag and transmit it to the requesting computer unit, ultimately providing the user with the information associated with that user de-personalized personal data are transmitted, so that they can be provided to the user for inspection. In order to enable the transmission and storage of a plurality of de-personalized personal data with the identification, but at the same time without the possibility of inference to the assigned person, the invention further proposes that personalized personal data on the user's computer unit using the To be converted into de-personalized personal data. With the control logic of the computer unit then the de-personalized personal data are transmitted with the associated label from the computer unit via the network to the server device, where this then without the possibility of inference to the Users can be saved. Thus, according to the invention, the personal data are in personalized form only on the computer unit, but not on other parts of the personal data network. It is possible to delete this personal data after transmission on the computer unit. It is possible that an additional authentication of the user and / or the computer unit is required before a communication and a transfer of de-personalized personal data via the personal data network takes place. Here, the

Authentication also be assigned to the de-personalized personal data associated with the user, so that a transfer of the de-personalized personal data from the server device to the computer unit only takes place when a cumulative request is made with the de-personalized personal data associated label and the authentication specific to this de-personalized personal data is present. To increase security, it may also be necessary to authenticate the key of another person. This is the case, for example, even if one

Third party access to the data or parts of the data of the user should receive.

Another aspect of the invention addresses the problem that not only the label, a file name, an I leader u. Ä. Allow conclusions about the assigned user. Rather, usually the data of the aforementioned kind themselves are equipped with personal information. Thus, for example, these may include the name and / or given name of the user, dates, locations, zip codes, names of visited hospitals, names of visited care facilities, accident locations, telephone numbers, signatures and the like. Ä. Other person-specific information. In a further embodiment of the invention, it is proposed that the computer unit assigned to the user has control logic by means of which personal information and information relating to the person can be removed or converted into information unit data encompassed by the personalized basic data. It is possible that the "personalized personal data" is a comprehensive health record, while the information unit data relates to individual "sheets" or parts of this personal data file. To name just a few non-limiting examples, the information unit data may be an image (which is also a video-like image sequence), a text, an audio file (eg, a dictated medical report, an echo Cardiogram, etc.) u. act. It is possible here that the personal information is manually removed by the user. Alternatively or cumulatively, it is possible that the removal of the personal information takes place automatically. It is also possible that, instead of removing the personal information, a conversion of the personal information takes place in such a way that partial information is still included, which then makes it impossible to draw any conclusions about the user or only to a reduced extent. For the automatic identification of the personal information for the purpose of removing or converting it, there are many possibilities. For a proposal of the invention, the computer unit of the user has control logic which includes a recognition logic. With the recognition logic, personal information and information that can be inferred to the person can be automatically recognized in the information unit data. For example, the recognition logic may include an OCR recognition that converts a graphic contained in the information unit data into a text. This text can then be used with logical conditions and known educational laws for personal information and those that indicate the person, for example, searching for dates in a given date format,

- with the search for text components, which correspond to names, whereby with regard to names to be taken into account a related database can also be used u. Ä., Are searched. If the recognition logic leads to detected personal information, the detected personal information can be removed directly from the information unit data. In the case that the recognition is based on an OCR recognition, for this purpose, the partial area of the image, which correlates with the text component according to the OCR recognition, must be permanently removed. It is also possible that prior to removing the personal information from the information unit data, a query is made to the user, who must give confirmation before removal.

For a personal data network according to the invention, the computer unit of the user has control logic which converts at least a portion of the recognized personal information in the information unit data into generalized personal information and information that can be inferred to the person. As a non-limiting example in this regard, personal information in a date may include day, month, and year. In this case, the date can become a

generalized personal information is converted, which only the year includes. It would also be possible, for example, for the personal information to include a place of residence or a federal state, while a conversion into a generalized personal information takes place in the form of a federal state or a country or larger territorial area. The generalized personal information ensures that

Secrecy needs regarding personal data. On the other hand, for example.

Analyzes of personal data such as the investigation of disease development over many years, despite elimination of the day and month in the context of the conversion possible or statistical studies on disease incidence taking into account regional specifics based on the generalized personal information in the form of the state, country or territorial area. Another possibility would be that a control logic converts the intervals of events marked by dates into time intervals. So for example "onset of illness on

in the same time in the year so many and hospitalization on the second night in the so-called "converted to" hospitalization 10 days after onset of illness ".

For a further inventive proposal, the recognition logic includes text, image or audio recognition logic. The control logic identified by matching recognized words, images or audio components with predetermined words, images, audio components or educational laws personal information and those that infer the person, including appropriate databases can be used with possible personal information. The control logic then removes the personal information thus identified from the information unit data or converts it (eg, as previously mentioned) into generalized personal information.

If the user is to be involved in the conversion or removal of personal information, this can be done for a further proposal of the invention in that the control logic of the computer unit of the user information unit data on an output of the computer unit, in particular a screen or a speaker outputs. The control logic then enables the user to remove personal information identified in the information unit data from the user based on the output, and to disclose personal information that may be inferred to the person. As a mere non-limiting example, the user may mark on a screen a portion of the output information which is then converted or removed. This can be done by the user based on the visual inspection of the output. It is also possible that on the basis of a automated procedure, the user successively different identified personal information and those that indicate the person can be displayed with the request of confirmation, if and possibly to what extent personal information and those that can be inferred to the person converted or removed.

It is possible that a converted or removed information in the personal data is lost forever. If, on the other hand, it is to be made possible (especially only) for the user to reconstruct the complete personal data including the converted or removed information at a later time, the invention proposes that with the control logic the computer unit should be removed from the information unit data or converted personal information and those that are inferred to the person can be stored, which is preferably also done on the computer unit. Preferably, both the deleted or converted personal information itself and the location where the deleted or converted personal information was located in the information unit data and the personal data are stored. For at least partial reconstruction of the original personal data or information unit data, the control logic of the computer unit may then receive the de-personalized personal data received from the server device over the network in which personal information and information relating to the person can be deduced from information unit data have been removed, supplemented with the stored personal information again, whereby at least partial completion and / or recovery takes place.

It is entirely possible that in the personal data network only a plurality of respective computer units assigned to a user communicate with the server device. The larger the number of users and the assigned computer units, the less the assignment of the de-personalized personal data to the users and computer units is possible. In order in particular to enable the beginning of the filling of the server device for the transmission of the data of the first user to these users, at least initially, the server device with de-personalized personal data of fictitious users who have been created, for example, on the basis of random criteria, be filled.

It is also possible within the scope of the invention, however, that further facilities are integrated into the personal data network: For a proposal of the invention, supporter computer devices, in particular computer units or computer subnets, are integrated in the personal data network, which supporters are assigned to the users. Such supporters may be health care workers such as the doctor or a caregiver or nurse, a practice or a hospital. Other supporters, which may be integrated into the personal data network through an associated supporter computing device, are pharmacies, insurance companies, banks, or research institutions, to name but a few.

If a supporter computer device is to be enabled to receive de-personalized personal data from the central server device, this can be done in two different ways: a) It is possible that the user himself transmits the personal data to the supporter Computer device transmits over another way, eg. Via a wireless or wired network. b) It would also be possible that the user transmits the ZuOrdnungsvorschrift or labeling to the supporters computer device, which then the access of the supporter computer device to the server device with the query of the depersonalized personal data belonging to the user, here the patient of the supporter , can be done. It is also possible that the personal data network has an analysis interface. Via the analysis interface, the personal data network can communicate with an analysis computer device in which an analysis of personal data, for example for the diagnostic evaluation of a user's personal data and / or for surveys or statistical investigations of the personal data of multiple users can. The invention further proposes that the supporter computer device, the analysis computer device, the server device and / or the computer unit assigned to the user have control logic which determines findings from the de-personalized personal data of a user. The server device preferably has a data collection and control logic which makes it possible to determine findings from the depersonalized personal data of a user and to approve the user accordingly to inform. The information can be sent either directly to the mobile phone of the user or, for example, an intermediary server, the latter then forwards the information to the user.

Alternatively or cumulatively, it is possible for the control logic to generate automatic messages. To name just a few non-limiting examples, a critical circulatory condition may be determined from vital data (eg, blood pressure and pulse) determined via a smartphone or wearable. An automatic message generated may be, for example, an alert of the user or a companion of the user or a physician or other health care professional. It is also possible that as an automatic message an indication of a regular visit to the doctor (for example, about a pending vaccination after a predetermined time interval after the previous vaccination) is generated and displayed on the computer unit of the user.

The invention also proposes that the backer computer device, the analysis computer device, the server device and / or the computer device assigned to the user have / has a detection device. Personal or de-personalized personal data may be collected via the capture device. It is possible that the detection device is a manual detection device, via which the user can enter personal data. This can be a keyboard. Preferably, however, the detection device as a scanner, photo device, audio recording device u. Ä., By means of which the personalized or depersonalized personal data can preferably be detected via the computer unit assigned to the user.

It is also possible that an interface is provided as detection device on the computer unit, wherein the interface can be wired or wireless. About this interface, the transfer can, for example, of personal data from a computer of an examination facility of the doctor or the hospital or the communication with a scanner, a camera, an audio recording device u. Ä.

Alternatively or additionally, the computer unit assigned to the user can be connected via an interface to a vital data acquisition device, in particular a pulse chest belt, a wearable and the like. Ä. Have. This is under a "wearable" a computer unit understood which is attached to the user's body or clothing during use. Alternatively, data that has already been derived can be received via this interface, for example from Apple® HealthKit (trademark of Apple Inc.) or Withings.

It can be problematic in the personal data network that, although the personal data between the computer unit and the server device are de-personalized transmitted, so that even under certain circumstances, the assignment of personal data to the user is not possible. However, u. U. from the transmission path of depersonalized personal data, an IP address from which the computer unit has sent the depersonalized personal data are determined, which would ultimately be a conclusion to the user or at least a surrounding area of the user possible. If this is to be avoided, in a further refinement of the personal data network according to the invention, a transmission path separating device is interposed between the computer unit assigned to the user and the server device, which receives the de-personalized personal data transmitted by the computer unit and eliminates pointers to the IP Address from which the transmission path separator has received the de-personalized personal data, then transmits the depersonalized personal data to the server device. In this way, a deduction of the de-personalized personal data on the server device to the transmission path can be made impossible by the computer unit, which still further takes into account the privacy interests of the user and the protection against access by third parties to the personal data. An interruption of the transmission path may, for example, be made via a virtual private network by establishing a VPN connection to an intermediary server and using the IP address of the intermediary server in communication with the server device. There are services on the market, such as TunnelBear VPN ™ (tradename of Tunnel Bear Inc.), which provide programs for desktop computers, mobile phones, tablet computers, etc. that allow users to hide their own IP address. If the user is connected to the service, the actual IP address of the user will not be visible on the web pages they visit. Another embodiment of the invention is dedicated to the registration of the user. According to one proposal, the computer unit assigned to the user has control logic which transmits a telephone number of the computer unit, in particular of the smartphone. From the unit responsible for registration, in particular the server unit, to which the Telephone number has been sent by the computer unit, then receives the computer unit code that allows authentication of the computer unit. For example, the computer unit can receive this code as an SMS when forming the same as a smartphone. According to the invention takes only after receiving the code for authentication of the computer unit, the computer unit on the control logic data on the person of the user, which, for example, by name, date of birth, place of birth u. Ä. Can act. These data relating to the person of the user can then be stored in the computer unit, wherein these are not transmitted in particular via the network.

In principle, it is possible that a ZuOrdnungsvorschrift and the associated by this a user label does not change. A further increase in the security of the personal data network can be brought about under certain circumstances if a new assignment rule with a new identification is determined by the control logic of the computer unit at regular intervals or for certain events. With the new identification determined, personal data that has been personalized by the computer unit can then be transmitted to the server device via the network. Under certain circumstances, the de-personalized personal data is transmitted from the server device to the computer unit with the old identification,

the determination of the new assignment rule and the new identification by the computer unit,

deleting the de-personalized personal information with the old identifier on the server device and

the re-transmission of the de-personalized personal data with the new tag to the server device.

In the aforementioned events, for which a new ZuOrdnungsvorschrift with a new label is determined by the control logic of the computer unit, it may, for example. Each process of transfer of de-personalized personal data with the (old) identifier from the server device to the Computing unit and / or the support device act. Alternatively or additionally, it can be used as an event that a transmission of the ZuOrdnungsvorschrift has been done to a support facility. It is also conceivable that the method described, with which the user has the alien key to access his data, supplemented or replaced by alternative methods, such as change code devices, paper code or personal features such as iris recognition, video sequences of the eyelid, etc. or DNA sequences can be. The aim may be that the user has exclusive personal access to his personal data via the computer unit. But this can be problematic u. U. in case of loss of the computer unit, powerlessness or incapacitation of the user. It is possible that the ZuOrdnungsvorschrift is transmitted to the provision of such cases by means of the control logic of the computer unit to a trusted person computer unit. The trusted person is, for example, a spouse, a person authorized to make a decision in an emergency for the user, or a security person or a person with a trust function via whom access to the personal data is to be possible if the computer unit is lost. The computer unit associated with the trusted person can then be allowed at least partial access to the de-personalized personal data and its conversion into personalized personal data.

Basically, the invention also includes embodiments in which all personal information is completely de-personalized in the personal data. However, this may complicate a scientific or other stochastic evaluation with the aim of gaining important insights. For a particular embodiment of the invention, the invention proposes that the de-personalized personal data regarding the user is still the year of birth,

the gender of the user,

- the ethnicity,

belong to the state or canton of the place of residence or the country of residence. These data can then be used for further evaluation of personal data, for example by scientific analysis institutes, insurance companies and the like. Ä. be used. In addition to the personal data network, the invention also relates to a software which is equipped with control logic which is suitable for the use and the formation of a personal data network according to one of the preceding claims. For this purpose, the software has in particular control logic, as claimed in the patent claims.

The subject of the present invention is furthermore a system comprising a personal data network according to one of claims 1 to 19 and a vital data acquisition device. In this case, the vital data acquisition device may comprise one or more sensors for acquiring vital data. Possible sensors are sensors for recording the heart rate, blood pressure, blood sugar, pacemaker, fitness tracker, position sensors, acceleration sensors, etc.

Advantageous developments of the invention will become apparent from the claims, the description and the drawings. The advantages of features and of combinations of several features mentioned in the description are merely exemplary and can take effect alternatively or cumulatively, without the advantages having to be achieved by embodiments according to the invention. Without thereby altering the subject matter of the appended claims, as regards the disclosure of the original application documents and the patent, further features can be found in the drawings, in particular the illustrated geometries and the relative dimensions of several components and their relative arrangement and operative connection. The combination of features of different embodiments of the invention or of features of different claims is also possible deviating from the chosen relationships of the claims and is hereby stimulated. This also applies to those features which are shown in separate drawings or are mentioned in their description. These features can also be combined with features of different claims. Likewise, in the claims listed features for further embodiments of the invention can be omitted.

The features mentioned in the patent claims and the description are to be understood in terms of their number that exactly this number or a greater number than the said number is present, without requiring an explicit use of the adverb "at least". So, for example, when talking about an element, this is to be understood as that there is exactly one element, two elements or more elements. These features may be supplemented by other features or be the only characteristics that make up the product in question.

The reference numerals contained in the claims do not limit the scope of the objects protected by the claims. They are for the sole purpose of making the claims easier to understand.

BRIEF DESCRIPTION OF THE FIGURES

In the following the invention will be further explained and described with reference to preferred embodiments shown in the figures.

Figs. 1 to 4 show different exemplary embodiments of the de-personalized

Transmission of sensitive data over a network, usually the Internet. In addition, this network may be designed by technical means to create closed A to B connections, e.g. as a virtual private network (VPN) or through tunneling. Fig. 5 shows highly schematized method steps of a control logic for the transmission of de-personalized data, wherein the control logic relates to a method for a first-time registration of a user.

Fig. 6 shows a highly schematic process steps of a control logic for the

Transmitting de-personalized data, wherein the control logic relates to a method for transmitting de-personalized personal data to a server device.

Fig. 7 shows, in a highly schematic manner, method steps of a control logic for the transmission of de-personalized data, wherein the control logic relates to a method for the de-personalization of personal data from a server device. DESCRIPTION OF THE FIGURES

FIG. 1 shows a highly schematized data network 1 with a server device 2 and a computer unit 3 assigned to a user or patient of a plurality of further computer units communicating with the server device 2 via a network 1, 28, not shown here. On the one hand de-personalized personal data 4 with associated identification 5 are sent to the server device 2 by the computer unit 3 in order to store the de-personalized personal data 4 in a memory unit 6 of the server device 2 under the identifier 5. On the other hand, it is possible for the computer unit 3 to send a request 7 to the server device 2 with the identification 5, to send the de-personalized personal data 4 associated with the identification 5 as de-personalized personal data 4 to the computer unit 3. The de-personalization takes place by means of software A on the computer unit 3, the re-personalization by a software B on the computer unit 3.

In order to avoid that an assignment of the stored de-personalized personal data 4 is already possible in the server device 2 via a requesting IP address of the computer unit 3, a transmission path separating device 9 can be interposed between server device 2 and computer unit 3 according to FIG , The transmission path separating device 9 receives the request 7 with the identifier 5 from the IP address of the computer unit 3 and sends it with its own IP address without reference to the IP address of the computer unit 3 to the server device 2. The 5 associated , de-personalized personal data 4 stored in the memory unit 6 are then transmitted from the server device 2 to the transmission path separator 9, which in turn transmits the de-personalized personal data 4 to the only existing IP address of the computer unit 3 According to FIG. 1, corresponding communication between the computer unit 3 and the server device 2 has the data network 1 via a back-up computer device 10 which, for example, is assigned to a practice, a hospital, a bank or an insurance company. In order to allow access to the personal data there, the user transmits de-personalized personal data 31 from the computer unit 3 to the supporter computer device 10. Simultaneously or at a different time, the delivery of the code 5, which is provided with the personal data, takes place. These are inserted as a header if the identifiers match the document. If the supporter collects further personal data, the return of such personal data may be considered as de-personalized personal data 4 provided with a random number (identification 5a) to the computer unit 3, whereby then the transmission of this personal data as de-personalized personal data 4 with the associated label 5a for additional storage in the server device 2 can be done , Alternatively or in addition to the supporter computing device 10, an analysis computing device 1 may have access to the de-personalized personal data 33 of a plurality of users by communication with the server device 2. A plurality of de-personalized personal data 33 can then be analyzed in the analysis computer device 11 and the analysis result 32 of the analysis computer device 11 can be transmitted to the server device 2 or other devices. It is also entirely possible that de-personalized personal data is transmitted from the supporter-computer device 10 to an analysis computer device 11, with which an analysis device can then perform an analysis of this personal de-personalized data. The analysis computer device 1 1 communicates with an analysis interface 27 of the server device 2. The result of the analysis can then be transmitted in de-personalized form to the supporter computer device 10 or the computer unit 3 of the user for further processing.

FIG. 4 shows an embodiment in which (alternatively or additionally) a back-up computer device 10 or a trust-person computer unit 12 is integrated into the data network 1, 28. In order to enable an exchange of the personal data assigned to the user between the server device 2 and the backer computer device 10 and / or the trusted person computer unit 12, the user transmits via the computer unit 3 an assignment rule, in particular the identification 5 assigned to the user Supporter computer device 10 and / or the trusted person computer unit 12. With this assignment rule and possibly other transmitted authentications or passwords can then exchange data regarding the de-personalized data associated with the user between the supporter computing device 10 and / or the trusted person computer unit 12 on the one hand and the server device 2 on the other hand done. As an optional further option, it is shown in FIG. 4 that the computer unit 3 can also receive vital data 13 via an interface 29, which is from a wearable 14 or a vital data acquisition device 30 such as a wristband or a chest strap or an application of the computer unit 3 can originate from forming smartphones. 5 shows by way of example a method for a first-time registration of a user by the computer unit 3 assigned thereto:

After loading an application, for example, onto the computer unit 3 designed as a smartphone, the user transmits his telephone number to the device carrying out the registration, in particular the server device 2, in a method step 15. It is also conceivable, however, for another server to be connected in front of the server device 2 to strictly separate the registration data of the user from the data stored on the server device 2. In a method step 16, the identifier 5 is then determined, which is transmitted back to the smartphone in a method step 17, in particular via SMS via the previously transmitted telephone number. Only then does the user then enter the personal data in a method step 18. With this registration, the smartphone or the computer unit 3 is then able to work. In particular, the transmission of de-personalized data with the identification 5 or 5a to the server device 2 can then take place and / or the server device 2 can load the de-personalized data associated with the user with the reference to the identification 5 or 5a. Neither the personal data nor the association between the telephone number and the tag are stored on the server device 2. Accordingly, it is possible to proceed for the registration if the computer unit 3 is not designed as a smartphone, but, for example, as a desktop version to which the application can be loaded.

Optionally, in a further method step, the computer unit 3 may inquire whether a further computer unit 3 should be registered as authorized with regard to the user. In this case, the further telephone number assigned to another smartphone is then transmitted from the computer unit 3 to the server device 2, for example. The information to be input to the person in step 18 includes, for example, the name, first name, date of birth, gender, ethnicity, weight, height, street, place of residence, country, e-mail address Address, the mobile phone number, an identity card number u. ä.

Under certain circumstances, it may be examined in an additional procedural step whether the applicant is a natural person. Furthermore, a verification of the personal information can be done by accessing a corresponding database. It is also possible that during the registration a declaration of consent with the terms and conditions is required. Here, the terms and conditions may also include that the user agrees that the depersonalized data of the patient are scientifically evaluated and / or used financially. Fig. 6 shows the transmission of de-personalized personal data to the server device 2 for storage thereof:

The first-mentioned method steps are performed either by the computer unit 3, which can communicate with the server device 2 (FIG. 1), or the supervisor computer device 10 or the trusted person computer unit 12, which can communicate with the server device 2 (FIG. 4), carried out.

In a method step 19, first personal data are obtained. This can be achieved by receiving the personal data from an examination device, from the supervisor computer device 10 or by recording a medical report u. Ä. About a detection device 26. In a subsequent method step 20 then personal information and those that can be inferred to the person from information unit data, ie, for example, the doctor's report, the X-ray u. Ä. removed. Following this, in method step 21, the data packet, which contains both the depersonalized data and the associated identification, is transmitted to the server device 2. The server device 2 then stores the received de-personalized data in the memory unit 6 in the method step 22 under the label 5.

7 shows the method for loading de-personalized data from the server device 2 into the computer unit 3 (FIG. 1) or into the supporter computer device 10 or trusted person computer unit 12 (see FIG Method step 23 transmits the computer unit 3 (or the backup computer device 10 or the trusted person computer unit 12) a request 7 with the label 5 to the server device 2. The server device 2 loads in a method step 24 the de-personalized data associated with the identifier 5 from the memory unit 6. The de-personalized data are then in the method step 25 to the computer unit 3 (or the supervisor computer unit 10 or the confidant Computer unit 12) transferred, where they are re-personalized by, for example, in a header (header), the data are listed to the person.

The server device 2 can initially store the de-personalized data of many users on the memory unit 6 according to the respective identifier 5. This repository containing multiple user data is shown as 33 in the figures. Extraction of search words to enable a search function for analysis of the de-personalized data of multiple users (33) is also possible. A categorization of the de-personalized data to a user can be done, for example, according to the type of information unit data. Thus, for example, a classification between examination findings, medical reports, discharge reports done. It is also possible that the aggregation of information unit data or identification of the same takes place depending on the implementing institute of the individual examinations and medical reports. Alternatively or additionally, the categorization of the information unit data depending on the disease or affected body part or medical specialty. It is possible that information unit data of different categories are provided individually to the user or a supporter.

An application of the computer unit 3 may include a search function to facilitate easy retrieval of information.

Examples of wearables 14 which can be used in the data network 1 within the scope of the invention are, for example, on the Internet site (http://www.emdt.co.uk/daily- buzz / 5-wearables-could -transform-healthcare). examples for this are

"Google lens" for a biotoxin measurement,

"WearSens" for measuring food intake (see http://www.medicaldaily.com/ucla-engineers-develop-wearsens-food-diary-you-can- wear-around-your-neck-324508),

- Google smart pill to detect cancer (http://mobihealthnews.com/37730/google-x-developing-cancer-scanning-pill-that- transmits-to-a-wearable-sensor /),

Wearable sensors for the continuous measurement of body fluids (see http://www.emdt.co.uk/daily-buzz/higher-powered-wearable-sensors) and

- Sensors for continuous ECG measurement (see http://internetmedicine.com/irhythm/). An integrated into the data network 1 analysis device can evaluate a variety of depersonalized data of one or more patients, with additional validation and approval can be done from a medical point of view. The analysis results resulting from the analysis or the generated data extracts may in particular include the following information and data: an electronic doctor's letter (see http://www.aerzteblatt.de/archiv/167716/ Elektronischer-Arztbrief-Arztnetze-fuer-die -Erprobung-searched)

Outgoing reports, bank statements

Diagnostic lists, expense lists by categories as bank statements

Remittance reports, payment transfers, damage reports

Risk analysis,

Summaries on specific questions,

Reminders and requests for visits to the doctor, for vaccination, cancer screening, tablet intake, etc., on standing orders in bank payments

Evaluations and assessments of medical images (X-rays, blood pictures, skin changes),

Alert health care professionals to critical vital data for intensive care, ward, nursing or home care assisted living patients

Evaluations for the pharmaceutical industry, for insurance and for scientific purposes. On the computer unit 3 takes place, in particular by means of a smartphone application, the registration, the temporary storage of personal data, the procurement and reading new personal data, the de-personalization of personal data, the generation of labels for use with de-personalized Data packets and the connection to the server device 2 with the subsequent upload. On the other hand, on the server device 2, the management of the de-personalized personal data with the associated identifier and the access management for the users and analysis facilities u. ä. An application of a computer device 3 designed as a smartphone may, for example, include a menu interface which displays the menu items

Login to enable the login with a user ID and password,

"my personal information online",

- "my next appointments",

"Scan personal data",

"Import personal data",

"Processing personal data",

"Request recipe",

- "carry out laboratory examination",

Book a doctor's appointment,

"Chat"

"Settings" and / or

"Manage Favorites" and perform the assigned functions.

A transmission of de-personalized data via the data network 1, 28 takes place in particular as metadata according to the standard IHE. It is possible that for re-personalization instead of (re) inserting the patient data in the document, the label 5 is inserted as a header or header in the documents, which can be linked via the ZuOrdungsvorschrift of the user with his personal data. The download and upload of the de-personalized data takes place via an encrypted connection. Encryption of the de-personalized personal data may additionally be done according to the usual known encryption technologies. It is possible that an access management for third parties such as trusted persons or analysis facilities by a protocol marked "OAuth", as described in the relevant literature and at https://de.wikipedia.org/wiki/OAuth. On which components of the de-personalized data third parties can access, the user can individually determine based on deposited profiles and control by the application on the computer unit 3 or the server device 2. It is possible that the user when creating his profile must give the consent that a disclosure of personal data to third parties, agents or a person of trust may be released in the last instance by a fiduciary. A data access by a deputy is particularly in question when the user is unconscious, patronized, died or the computer unit 3, which contains only the ZuOrdnungsvorschrift, has been lost.

It is possible that within the scope of the invention a method described on the Internet page https://validic.com/api is used.

For the elimination of personal information, a document, such as a medical report or an X-ray image, can first be completely "blacked out" or deleted, after which the user can "reactively" reactivate individual components of this document via a type of wiping function. Conversely, the user can not blacken even "blackened" places in his document, which suggest his person, by a wiping function itself.

EXEMPLARY FUNCTIONAL PROCESS

The user uses his smartphone to retrieve his vital data from a fitness tracker, sphygmomanometer or pacemaker, e.g. via Bluetooth directly to the smartphone. It is also conceivable that the data has already been derived in another software, such as Apple Health Kit. In the latter case, the data from such a system is transferred to the smartphone. Ultimately, it is also conceivable that with the smartphone by means of a special function medical findings texts and images are scanned. In all cases, the data is depersonalized by means of automatic programs. Where this is not possible, personifying data can be removed by means of a wipe function. Importantly, the entire depersonalization process takes place on the smartphone. Only then are the data transmitted in depersonalized form to the server. Here an ongoing aggregation of the data and analysis of the data owner takes place and in case of deviations, a feedback is sent to the Smarphone of the data owner.

The invention relates to a personal data network 1 with a server device 2 for storing personal data of a user and a user assigned to a computer unit 3, in particular a smartphone, tablet PC or iPad and desktop PC. The computer unit 3 and the server device 2 communicate via a network 1, 28 to exchange de-personalized data.

The personal data network is created by only passing data over the network and storing it on the network, which does not allow any direct or indirect inference to the person; These are so-called "de-personalized" data.

According to the user's personal data are already de-personalized on the computer unit 3 with a label 5 and transmitted to the server device (2), where they are stored de-personalized under the label 5. In this case, the identification 5 results from an assignment rule which is stored exclusively on the computer unit 3. Personalization of the de-personalized personal data 4 in the form of assignment of the de-personalized personal data to the assigned user is not possible on the basis of the de-personalized personal data 4 and the identification 5 present on the server device 2. Furthermore, an assignment during the transmission of the de-personalized data via the network is also not possible. In the form of an alias identity, the identity of the user can be "borrowed" for a limited time or permanently in the form of a tag 7, for example to a supporter computer device 10 or a fiduciary computer unit 12, thereby de-personalized data under the borrowed tag 7 can be transmitted to the server unit.

LIST OF REFERENCE NUMBERS

A program for de-personalization of data in electronic or handwritten form.

B Program for re-personalization (re-identification) of the data

Restore the original document or insert a marker

(Header) with the personal master data, such as name, first name, gender,

Date of birth.

C program (s) for data analysis

1 personal closed data network, e.g. tunneled or VPN, via which sensitive data of all kinds - eg health data and bank data - can be exchanged in personalized or de-personalized form.

2 server device (user-remote and network-connected device for storing and managing data)

3 personal computer unit (user-controlled electronic device, such as smartphone, tablet PC, desktop PC, for recording, processing, management and de-personalization of data)

4 De-personalized personal data (data that can no longer be assigned to a person without a key).

5 Labeling (the de-personalized data that can only be assigned to one person with one key).

a Random identification

6 storage unit (technical facility for storing de-personalized data)

7 request (electronic request or electronic order)

8 personalized personal data in electronic or other form, e.g. on paper.

a Re-personalized personal data in the form of the original or with a header containing the personal information.

9 transmission path separator (means that makes it impossible to trace back the data for encryption).

0 Supporter computer device (computer device of a user supporting institution, such as hospital, doctor or bank or insurance).

1 analysis computer device (computer device for analyzing and evaluating data, such as vital data, banking data, health data, etc. with the primary aim of bringing the evaluations and findings to the attention of the user and the secondary objective of gaining new knowledge of general interest). Trust person computer unit (computer unit of a person with trust

Function)

Vital data (measurement data such as weight, heart rate, blood pressure, blood sugar, etc.)

Wearable (garment, patch or accessory, such as a bracelet, with built-in sensors for measuring vital signs and events, such as taking medication or registering goods while shopping)

step

Capture device Analysis interface (interface between stored de-personalized data and device for processing, storage and transfer of data)

Personal public network, Internet

interface

Collection of data from wearables, handhelds, scales, electronic equipment in vehicles, such as steering wheel and cameras, as well as in real estate, such as electricity and water meters.

personalized personal information

analysis result

De-personalized data of a variety of users

Claims

Data network (1, 28) with

a server device (2) on which personal, sensitive data of a user are stored, and

a computer unit (3) assigned to a user, wherein

the computer unit (3) and the server device (2) communicate with one another via a network (1, 28) for exchanging the personal data,

an assignment rule is present on the computer unit (3) assigned to the user, which assigns an identification (5) to the user and his de-personalized personal data,

the personal data on the server device (2) is stored exclusively as depersonalized personal data (4) with the tag, wherein personalization of the de-personalized personal data (4) takes place in the form of an association of the de-personalized personal data with the assigned user Based on the server device (2) existing de-personalized personal data (4) and the label (5) is not possible, and

the computer unit (3) assigned to the user has control logic by means of which a) a request (7) is generated to the server device (2) with respect to the transmission of the de-personalized personal data (4), wherein the request is the identification associated with the user (5), and the de-personalized personal data (4) transmitted to the request from the server device (2) via the network (28) to the computer unit (3) to which the tag (5) is assigned, and / or b) converting personalized personal data on the computer unit (3) using the assignment rule into de-personalized personal data (4) with associated identification (5) and then the depersonalized personal data (4) with the associated identifier (5) from the computer unit (3) via the network (1, 28) are transmitted to the server device (2),

characterized,

that the computer unit (3) assigned to the user has an interface (29) for a vital data acquisition device (30), and h) that the user assigned to the computer unit (3) via control logic ve

which in personal information contained in the personal information personal data and those that can be inferred to the person, a) automatically and / or

b) manually by the user

removed or converted.

2. Data network (1, 28) according to claim 1, characterized in that the user assigned to the computer unit (3) is a computer, a tablet, a mobile phone, a smartphone, a smartwatch, a wearable or a PDA.

3. data network (1, 28) according to claim 1 or 2, characterized in that the user assigned to the computer unit (3) has a control logic which includes a recognition logic, by means of which automatically personal information and those on the person can be in the information unit data recognized and removed from the information unit data can be.

4. Data network (1, 28) according to one of claims 1 to 3, characterized in that the user assigned to the computer unit (3) has a control logic, which general information and personal information that can be inferred to the person in general personal information and information that converts to the person.

5. Personal data network (1, 28) according to claim 3 or 4, characterized in that

a) the recognition logic includes text, image or audio recognition logic,

b) the control logic identifies personal information and those indicative of the person by matching recognized words, images or audio components with predetermined words, images, audio components or educational laws; and c) the control logic removes the identified personal information from the information unit data or into generalized personal information and those that make the person infer convert.

6. personal data network according to one of claims 1 to 5, characterized in that the user assigned to the computer unit (3) has a control logic, a) by means of which information unit data on an output of the computer

be issued, and

b) which allows the user to remove personal information identified in the information unit data based on the issue, and those that make the person infer, or to convert it into generalized personal information and information that may be inferred to the person.

7. personal data network (1, 28) according to one of claims 1 to 6, characterized in that the user assigned to the computer unit (3) has control logic,

a) by means of which personal information removed from the information unit data or into generalized personal information and those which allow the person to be inferred, and personal information which can be inferred from the person, and

b) which off

ba) the depersonalized personal data (4) received from the server device (2) via the network (1, 28) in which personal information and information relating to the person is deduced from information unit data or into generalized personal information and such who have been converted to the person's inferred and bb) personal information stored

undertake an at least partial reconstruction of the original information unit data with the personal information.

8. Personal data network (1, 28) according to any one of the preceding claims, characterized in that the user assigned to the computer unit (3) has control logic which

(a) the transmission of personalized personal data (31) and / or

b) a transmission of the ZuOrdungsvorschrift

to a supporter computing device (10).

9. personal data network (1, 28) according to any one of the preceding claims, characterized in that an analysis interface (27) of the personal data network (1, 28) with an analysis computer device (11) is connected.

10. Personal data network (1, 28) according to any one of the preceding claims, characterized in that the supporter computing device (12), the analysis Computer device (1 1), the server device (2) and / or the user computer unit (3) has control logic which determines findings from the de-personalized personal data (4) of a user and / or generates automatic messages.

1 1. Personal data network (1, 28) according to any one of the preceding claims, characterized in that the supporter-computing device (10), the analysis computer device (1), the server device (2) and / or the user assigned Computer unit (3) via a detection device (26), via which personalized or de-personalized personal data can be detected.

12. Personal data network (1, 28) according to any one of the preceding claims, characterized in that between the user assigned to the computer unit (3) and the server device (2) a transmission path separating device (9) interposed, which the from the computer unit (3) transmits transmitted de-personalized personal data (4) to the server device (2) and makes it impossible to draw de-personalized personal data (4) on the server device (2) onto the transmission path from the computer unit (3).

13. Personal data network (1, 28) according to any one of the preceding claims, characterized in that for a registration of the user assigned to the user computer unit (3) has control logic which

a) sends out a telephone number of the computer unit (3),

b) receives a code for authentication of the computer unit (3) and

c) only after receiving the code for authentication of the computer unit (3) receives data on the person of the user, which are then stored in the computer unit (3).

14. The personal data network (1, 28) according to any one of the preceding claims, characterized in that the user assigned to the computer unit (3) has control logic,

a) which

aa) after transferring the de-personalized personal data (4) from the server device (2) to the computer unit (3) and / or the backup computer device (10) and / or

ab) after a transmission of the ZuOrdnungsvorschrift or label (5) to a supporter computing device (10)

determines a new assignment rule with a new identifier, c) which then the de-personalized personal information (4) with

Label (5) from the computer unit (3) via the network (1, 28) to the server device (2) transmitted.

15. Data network (1, 28) according to one of the preceding claims, characterized in that the ZuOrdnungsvorschrift is transmitted to a trusted person trust person computer unit (12) and the trusted person computer unit (12) an at least partial access to the de -personalized personal data and their transformation into personalized personal data.

16. personal data network (1, 28) according to any one of the preceding claims, characterized in that the de-personalized personal data (4) in terms of the user

a) the year of birth,

b) the gender,

c) Ethnicity

d) belonging to a race and / or

e) the country of residence

include.

17. Personal data network (1, 28) according to one of the preceding claims, characterized in that the computer unit (3) is a portable computer unit and preferably a smartphone or tablet computer.

A personal data network (1, 28) according to any one of the preceding claims, characterized in that the control logic of the server means is adapted to automatically send messages from the transmitted, de-personalized data to the user or other predetermined person, eg Doctor or health care staff to produce.

19. System comprising a personal data network (1, 28) according to one of claims 1 to 18 and a vital data acquisition device (30).

20. System according to claim 19, characterized in that the vital data detection device (30) comprises one or more sensors for acquiring vital data.

21. A system according to claim 20, characterized in that the sensor comprises a plurality of sensors for detecting the heart rate, the blood pressure, the

Blood sugar, pacemakers, fitness trackers, position sensors, acceleration sensors are.