Using PAPAYA for eHealth - Use Case Analysis and Requirements

This paper presents an eHealth use case based on a privacy-preserving machine learning platform to detect arrhythmia developed by the PAPAYA project that can run in an untrusted domain. It discusses legal privacy and user requirements that we elicited for this use case from the GDPR and via stakeholder interviews. These include requirements for secure pseudonymisation schemes, for allowing also pseudonymous users to exercise their data subjects rights, for not making diagnostic decisions fully automatically and for assurance guarantees, conformance with specified standards and informing clinicians and patients about the privacy protection. The requirements are not only relevant for our use case but also for other use cases utilising privacy-preserving data analytics to classify medical data.