Apparatus and methods for causing privacy-sensitive direction of advertising messages based on prevalence of a healthcare condition in a plurality of geographic areas

1. A computerized method having practical use in improved targeting of advertisement messages for display on consumer devices, which improved targeting utilizes non-personalized geographic healthcare condition data, the method comprising:

with a programmed computer system including at least one processor and at least one memory:

(a) for each of a plurality of geographic identifiers, each geographic identifier denoting a respective one of a plurality of geographic areas, producing targeting data by:

(i) using a combination dataset containing personal health data from a first database and personal consumer data from a second database, wherein:

(A) the personal health data from the first database and the personal consumer data from the second database have been combined by use of a set of individual keys, each key identifying one of a multitude of persons;

(B) the personal health data from the first database associates the individual keys with one of a set of healthcare condition codes, wherein each of the healthcare condition codes uniquely represents one of a plurality of healthcare conditions of interest, thereby indicating which of the persons identified by the individual keys has which of the healthcare conditions of interest, and

(C) the personal consumer data from the second database associates the individual keys with the geographic identifiers, thereby which of the persons identified by the individual keys resides in which of the geographic areas; and

(ii) linking the geographic identifier with a set of aggregate numerical values, determined using the combination dataset, wherein respective of the aggregate numerical values are based on the number of persons, in the geographic area denoted by the geographic identifier, who are associated with respective of the healthcare condition codes, whereby each of the set of aggregate numerical values represents prevalence in the geographic area of respective healthcare conditions of interest associated with the respective healthcare condition codes;

(iii) wherein the targeting data does not contain personally identifiable information (PII) from the first database or the second database; and

(b) removing from the targeting data information pertaining to those geographic areas and specific healthcare condition codes that would permit re-identification of persons in the geographic area associated with respective of the healthcare condition codes; and

(c) after part (b), using the targeting data to cause direction of an advertisement message for display on a plurality of consumer devices associated with each of a plurality of the geographic areas, based on prevalence in each of the plurality of geographic areas of one of the plurality of healthcare conditions of interest, which prevalence is based on the targeting data.

2. The method of claim 1 wherein the removed targeting data that would permit re-identification in part (a)(iii) comprises data related to any geographic area containing only one person.

3. The method of claim 1 wherein the removed targeting data that would permit re-identification in part (a)(iii) comprises data related to any geographic area in which all of the individual keys associated with the identifier for the geographic area are associated with at least one of the healthcare condition codes, thereby indicating that all of the persons identified by the individual keys in the geographic area have the healthcare condition.

4. The method of claim 1 wherein the consumer data from the second database associates the individual keys with the geographic identifiers based on IP addresses of consumer devices connected to the individual keys.

5. The method of claim 1 further comprising receiving, from a third-party entity, a certification that the process implemented by the computer system is in compliance with privacy regulations.

6. The method of claim 1 wherein the geographic areas are areas identified by nine-digit Zip+4 (Zone Improvement Program plus four digits) codes.

7. The method of claim 1 wherein the geographic areas are city blocks.

8. The method of claim 1 wherein the geographic areas are multi-unit buildings.

9. The method of claim 1 wherein the personal health data from the first database is known to contain some falsified data records, but the programmed computer system does not have access to data indicating which records of the first database are the falsified data records.

10. The method of claim 1 wherein the aggregate numerical values are percentages.

11. A computer system connected and programmed for improved targeting of advertisement messages for display on consumer devices, which improved targeting utilizes non-personalized geographic healthcare condition data, the computer system programmed to:

(a) for each of a plurality of geographic identifiers, each geographic identifier denoting a respective one of a plurality of geographic areas, produce targeting data by:

(i) using a combination dataset containing personal health data from a first database and personal consumer data from a second database, wherein:

(A) the personal health data from the first database and the personal consumer data from the second database have been combined by use of a set of individual keys, each key identifying one of a multitude of persons;

(B) the personal health data from the first database associates the individual keys with one of a set of healthcare condition codes, wherein each of the healthcare condition codes uniquely represents one of a plurality of healthcare conditions of interest, thereby indicating which of the persons identified by the individual keys has which of the healthcare conditions of interest, and

(C) the personal consumer data from the second database associates the individual keys with the geographic identifiers, thereby indicating which of the persons identified by the individual keys resides in which of the geographic areas; and

(ii) linking the geographic identifier with a set of aggregate numerical values, determined using the combination dataset, wherein respective of the aggregate numerical values are based on the number of persons, in the geographic area denoted by the geographic identifier, who are associated with respective of the healthcare condition codes, whereby each of the set of aggregate numerical values represents prevalence in the geographic area of respective healthcare conditions of interest associated with the respective healthcare condition codes;

(iii) wherein the targeting data does not contain personally identifiable information (PII) from the first database or the second database; and

(b) remove from the targeting data information pertaining to those geographic areas and specific healthcare condition codes that would permit re-identification of persons in the geographic area associated with respective of the healthcare condition codes; and

(c) after part (b), use the targeting data to cause direction of an advertisement message for display on a plurality of consumer devices associated with each of a plurality of the geographic areas, based on prevalence in each of the plurality of geographic areas of one of the plurality of healthcare conditions of interest, which prevalence is based on the targeting data.

12. The computer system of claim 11 wherein the removed targeting data that would permit re-identification in part (a)(iii) comprises data related to any geographic area containing only one person.

13. The computer system of claim 11 wherein the removed targeting data that would permit re-identification in part (a)(iii) comprises data related to any geographic area in which all of the individual keys associated with the geographic identifier for the geographic area are associated with at least one of the healthcare condition codes, thereby indicating that all of the persons identified by the individual keys in the geographic area have the healthcare condition.

14. The computer system of claim 11 wherein the consumer data from the second database associates the individual keys with the geographic identifiers based on IP addresses of consumer devices connected to the individual keys.

15. The computer system of claim 11 wherein the geographic areas are areas identified by nine-digit Zip+4 (Zone Improvement Program plus four digits) codes.

16. The computer system of claim 11 wherein the personal health data from the first database is known to contain some falsified data records, but the programmed computer system does not have access to data indicating which records of the first database are the falsified data records.