The scale of the recent Oracle Health breach should make everyone working in digital health uncomfortable. Nearly 20 million people reportedly had information compromised, potentially including medical records, addresses, Social Security numbers, diagnoses, medications and test results.
The problem with health data is that you can’t really replace it. If somebody steals your password, you change it. If your credit card gets compromised, you cancel it. You can’t cancel your DNA or request a new medical history. I’ve spent years arguing that privacy needs to be built into technology from the beginning, rather than retrofitted as a compliance feature. That’s becoming much more urgent as AI becomes more embedded in healthcare along with the proliferation of more detailed biological data.
At the same time, I don’t think the answer is to become scared of using health data. It’s arguably the opposite. We have an opportunity to use this information much more intelligently than we do today. AI can identify patterns across huge datasets that would be incredibly difficult for humans to find. Epigenetics can help us understand how our biology changes over time. Genetics gives us another layer, while wearables, biomarkers and lifestyle information can make that picture richer again.
The mistake would be building this future around the same centralized data model that has repeatedly and so clearly demonstrated its weaknesses.
There is no such thing as the average patient
Healthcare has historically depended heavily on averages. We take a population, study what generally happens and use that information to make decisions about individuals. That has obviously produced enormous medical progress, but people aren’t averages. Two people can be the same age and have completely different biological profiles. Their genetics differ. Their lifestyles differ. Their environments differ. Men and women can experience ageing and disease differently. Even two people with similar backgrounds can respond very differently to the same intervention.
This is what we’re trying to address through the wider DEPH ecosystem. We’re interested in bringing together genetics, epigenetics, biological-age research, lifestyle information and AI to build a more individual picture of health. Instead of asking what normally happens to somebody like you, we want to get much closer to understanding what is actually happening to you.
Epigenetics is particularly interesting because DNA isn’t the whole story. Your genetic code provides a foundation, but epigenetic patterns can change alongside age, lifestyle and environmental factors. That gives us a potentially more dynamic way of understanding health.
AI then becomes useful because humans aren’t particularly good at manually interpreting millions of relationships across these different signals. But I don’t want the consumer experience to become more complicated as the science gets more sophisticated.
I’ve seen this mistake before in technology. People building crypto products often expected ordinary users to understand wallets, keys, networks and protocols. Most consumers don’t care how the infrastructure works. They care whether the product works for them. Health should be the same. Nobody should need a PhD in epigenetics to understand their own body.
The goal is to take enormously complicated science and translate it into useful information that somebody can actually act on.
Better AI shouldn’t mean giving away more of yourself
This brings us back to the Oracle breach. The obvious tension in personalized health is that better personalization generally requires more information. An AI that understands your genetics, epigenetics, lifestyle and health history can potentially provide much more relevant insights than one working from population averages.
But that’s also an incredibly sensitive dataset to place in somebody else’s hands.
I don’t accept that this means we have to choose between personalization and privacy. A key part of the wider DEPH ecosystem is changing who controls the information in the first place. Health data can remain encrypted and off-chain, while individuals control who gets access, what they can use it for and when that permission ends.
That information could still contribute to scientific research and the development of better AI models, but permission should sit with the individual. This idea has shaped a lot of my work around confidential computing. There are enormous private datasets that could make AI dramatically better, particularly in healthcare. We shouldn’t need to expose all of that information simply to learn from it.
That distinction becomes increasingly important as AI becomes embedded in healthcare. We’re moving toward systems capable of combining biological information, medical histories and real-time lifestyle signals. Done properly, that could help us understand disease earlier, personalize interventions and give people a much clearer picture of how their health changes throughout their lives.
Done badly, we create enormous centralized repositories containing some of the most intimate information humans possess.
The Oracle incident shows why this isn’t some theoretical debate about privacy. We’re already putting incredibly valuable health information into systems that can fail.
The next generation of health technology therefore needs to understand individuals much better while in tandem exposing their underlying information as little as possible. That’s ultimately what personalized health should mean. Not simply giving an algorithm more information about you, but giving you better information about yourself. In this future framework your biology becomes more useful, your health insights become more personal, all while researchers and AI systems are empowered to learn from better datasets. But the underlying information remains yours.
If we’re serious about building healthcare around the individual rather than the average patient, ownership needs to be central to that conversation.
