{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T19:04:35Z","timestamp":1782846275881,"version":"3.54.5"},"reference-count":43,"publisher":"JMIR Publications Inc.","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["JMIR Form Res"],"abstract":"<jats:sec>\n                    <jats:title>Background<\/jats:title>\n                    <jats:p>The European General Data Protection Regulation (GDPR) strictly regulates the processing of personal and health-related data, posing challenges for digital health research, especially when data are collected using participants\u2019 own devices. Although scientific data can theoretically be anonymized, standard internet communication protocols inevitably expose transmission metadata, preventing true anonymization. Existing solutions, including virtual private networks, reverse proxies, and trust centers, improve confidentiality but do not technically or legally enable fully anonymized data collection. Consequently, large-scale digital health research often requires extensive organizational measures, complex consent procedures, and high regulatory overhead.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Objective<\/jats:title>\n                    <jats:p>This study aimed to develop a GDPR-compliant concept for fully anonymized scientific data collection, ensuring that no entity has simultaneous access to identifying information and donated data. We also implemented and evaluated this concept in a real-world public-private partnership.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Methods<\/jats:title>\n                    <jats:p>We designed a data donation architecture based on a blinded deidentification proxy that decouples identifying transmission metadata from encrypted user data at the time of donation. The concept combines symmetric (Advanced Encryption Standard-128 in Cipher Block Chaining) and asymmetric (Rivest-Shamir-Adleman with Optimal Asymmetric Encryption Padding) encryption, enabling end-to-end encrypted and anonymized data transfer without persistent identifiers. The system was integrated into the HerzFit app, a mobile lifestyle coach for cardiovascular disease prevention available in German-speaking countries, and evaluated for adoption, technical feasibility, and performance. Performance overhead was assessed using round-trip time benchmarks. Duplicate donations were identified and merged to estimate unique data donors.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Results<\/jats:title>\n                    <jats:p>The solution was integrated and tested in the HerzFit app with more than 200,000 downloads between April 2022 and December 2025. Since the introduction of the data donation feature, more than 13,000 donations have been received, translating to more than 9000 individual users contributing anonymized datasets. Proxy-based transmission resulted in an average round-trip time of 143 ms, compared to 58 ms for direct transfer, representing a modest overhead while maintaining usability. The operator of the donation database did not gain access to identifying information at any stage, demonstrating full technical anonymization. The approach can be operated reliably at scale with minimal server resources due to the stateless proxy design.<\/jats:p>\n                  <\/jats:sec>\n                  <jats:sec>\n                    <jats:title>Conclusions<\/jats:title>\n                    <jats:p>This work introduces a novel system architecture enabling fully anonymized, GDPR-compliant data donation directly from participants\u2019 devices. By decoupling identifying metadata from encrypted health data, the concept minimizes regulatory effort, strengthens privacy protection, and provides a practical framework for large-scale digital health research in research partnerships, for example, between a private company and a research institution. The real-world deployment in HerzFit demonstrates the feasibility, scalability, and scientific utility of this approach. The concept is broadly transferable to other mobile health apps and has the potential to substantially expand ethically and legally compliant data acquisition.<\/jats:p>\n                  <\/jats:sec>","DOI":"10.2196\/77983","type":"journal-article","created":{"date-parts":[[2026,5,7]],"date-time":"2026-05-07T21:15:07Z","timestamp":1778188507000},"page":"e77983","source":"Crossref","is-referenced-by-count":0,"title":["Fully Anonymized Digital Health Data Acquisition in a Research Partnership Using a Blinded Deidentification Proxy in the HerzFit App: Implementation Study"],"prefix":"10.2196","volume":"10","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6546-8531","authenticated-orcid":false,"given":"Lara Marie","family":"Reimer","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-3884-0850","authenticated-orcid":false,"given":"Leon","family":"Nissen","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9850-4239","authenticated-orcid":false,"given":"Fabian","family":"Starnecker","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-2130-7954","authenticated-orcid":false,"given":"Olga","family":"Stepanova","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6902-7314","authenticated-orcid":false,"given":"Florent","family":"Dufour","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-7390-845X","authenticated-orcid":false,"given":"Ruth","family":"Ney","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4458-950X","authenticated-orcid":false,"given":"Sinann","family":"Al Najem","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6428-3001","authenticated-orcid":false,"given":"Heribert","family":"Schunkert","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3687-6165","authenticated-orcid":false,"given":"Stephan M","family":"Jonas","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1010","published-online":{"date-parts":[[2026,5,7]]},"reference":[{"key":"ref1","unstructured":"Regulation (EU) 2016\/679 of the European Parliament and of the Council, place: OJ L 119,4.5.2016EUR-Lex20162026-04-17https:\/\/eur-lex.europa.eu\/eli\/reg\/2016\/679\/oj"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1007\/s11845-019-01980-2"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1038\/s41431-020-0596-x"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.3390\/s19092164"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1038\/s41746-019-0084-2"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.31486\/toj.19.0088"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1016\/s1470-2045(06)70618-0"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1017\/s096318011100048x"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1038\/s41431-019-0386-5"},{"key":"ref10","doi-asserted-by":"crossref","first-page":"91","DOI":"10.1007\/978-3-030-49388-2_6","author":"Staunton, C","year":"2021","journal-title":"GDPR and Biobanking, Law, Governance and Technology Series"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1038\/s41431-017-0045-7"},{"key":"ref12","first-page":"631","author":"Olimid, AP","year":"2018","journal-title":"Rom J Morphol Embryol"},{"key":"ref13","unstructured":"DeeringSEHindenBInternet protocol, version 6 (IPv6) specification, request for comments RFC 8200Internet Engineering Task Force20172026-04-24https:\/\/www.rfc-editor.org\/rfc\/rfc8200.html"},{"key":"ref14","unstructured":"CooperAGontFThalerDSecurity and privacy considerations for IPv6 address generation mechanisms, request for comments RFC 7721Internet Engineering Task Force20162026-04-24https:\/\/datatracker.ietf.org\/doc\/rfc7721"},{"key":"ref15","unstructured":"GontFKrishnanSNartenTDravesRPTemporary address extensions for stateless address autoconfiguration in IPv6, request for comments RFC 8981Internet Engineering Task Force20212026-04-24https:\/\/www.rfc-editor.org\/rfc\/rfc8981.html"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2017.09.009"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1007\/s12083-021-01077-7"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.3389\/fpubh.2023.1125011"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.2196\/12300"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1016\/j.clsr.2023.105932"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1016\/j.clsr.2025.106173"},{"key":"ref22","unstructured":"Misunderstandings related to anonymisationEuropean Data Protection Supervisor20212026-04-16https:\/\/www.edps.europa.eu\/system\/files\/2021-04\/21-04-27_aepd-edps_anonymisation_en_5.pdf?utm_source=chatgpt.com"},{"key":"ref23","author":"Stummer, S","year":"2022","journal-title":"Issues of Verifying Anonymity: An Overview"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1007\/s44206-023-00043-5"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1186\/s12911-025-02958-0"},{"key":"ref26","unstructured":"EsayasSYThe role of anonymisation and pseudonymisation under the EU data privacy rules: beyond the 'all or nothing' approachEuropean Journal of Law and Technology20152026-04-17https:\/\/ejlt.org\/index.php\/ejlt\/article\/view\/378"},{"key":"ref27","unstructured":"OhmPBroken promises of privacy: responding to the surprising failure of anonymizationU of Colorado Law Legal Studies20122026-04-15https:\/\/papers.ssrn.com\/sol3\/papers.cfm?abstract_id=1450006"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/sp.2008.33"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.2506.02942"},{"key":"ref30","unstructured":"Deutsche Herzstiftung2026-04-17https:\/\/herzstiftung.de\/service-und-aktuelles\/publikationen-und-medien\/app"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1177\/20552076241249269"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.2196\/50813"},{"key":"ref33","unstructured":"Judgment of the court (third chamber) of 9 November 2023 (request for a preliminary ruling from the Landgericht K\u00f6ln - Germany) - Gesamtverband Autoteile-handel eV v Scania CV AB place: case C-319\/22EUR-Lex20232026-04-15https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX:62022CJ0319"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.17487\/rfc4862"},{"key":"ref35","unstructured":"ProxyRefactoring Guru2026-04-24https:\/\/refactoring.guru\/design-patterns\/proxy"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.17487\/rfc8017"},{"key":"ref37","doi-asserted-by":"crossref","DOI":"10.6028\/NIST.SP.800-38a","author":"Dworkin, M","year":"2001","journal-title":"Recommendation for Block Cipher Modes of Operation: Methods and Techniques, Tech Rep"},{"key":"ref38","doi-asserted-by":"crossref","first-page":"348","DOI":"10.1007\/978-3-540-25937-4_22","author":"Rogaway, P","year":"2004","journal-title":"Fast Software Encryption"},{"key":"ref39","first-page":"92","author":"Bellare, M","year":"2006","journal-title":"Advances in Cryptology-EUROCRYPT'94"},{"key":"ref40","unstructured":"Common terminology for confidential computingConfidential Computing Consortium2026-04-16https:\/\/confidentialcomputing.io\/wp-content\/uploads\/sites\/10\/2023\/03\/Common-Terminology-for-Confidential-Computing.pdf"},{"key":"ref41","unstructured":"Case c-582\/14Judgment of the court (second chamber) of 19 October 2016EUR-Lex20162026-04-15https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/?uri=CELEX:62014CA0582"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1146\/annurev-statistics-060116-054123"},{"key":"ref43","unstructured":"LauradouxCCurelariuTLodieARe-identification attacks and data protection lawAI-Regulation.com2026-04-17https:\/\/ai-regulation.com\/wp-content\/uploads\/2023\/02\/Article-Re-identification.pdf"}],"container-title":["JMIR Formative Research"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/formative.jmir.org\/2026\/1\/e77983","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T18:10:24Z","timestamp":1782843024000},"score":1,"resource":{"primary":{"URL":"https:\/\/formative.jmir.org\/2026\/1\/e77983"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,7]]},"references-count":43,"URL":"https:\/\/doi.org\/10.2196\/77983","relation":{"has-preprint":[{"id-type":"doi","id":"10.2196\/preprints.77983","asserted-by":"object"}]},"ISSN":["2561-326X"],"issn-type":[{"value":"2561-326X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,5,7]]}}}