Constellation

Inspiration

Two in five Canadians will be diagnosed with cancer. The data that could help treat them better already exists (imaging, pathology, doctors' notes, genomics, long-term outcomes), but it is locked inside individual hospitals.

Hospitals are right to lock it. Healthcare has been the most expensive industry for data breaches for 14 years in a row, and in Quebec, data for 9,000 Laval patients was stolen after it was sent outside the health network.

One of us builds multimodal survival models for cancer patients at MEDomics Lab and hits this wall every day. Clinical leaders we've spoken with confirm it: the data and the funding exist, but the secure infrastructure to use them doesn't.

Constellation is that infrastructure, built security-first.

What it does

Constellation lets hospitals train cancer AI together without a single patient record leaving the building. Instead of moving the data to the AI, we move the AI to the data. This is federated learning:

The AI model visits each hospital
It learns locally, inside the hospital's walls
Only the model updates come back (numbers, never patient files) and are combined into one shared model

Each hospital $k$ trains on its own $n_k$ patients and returns updated weights $w_k$. The shared model is their weighted average:

$$ w = \sum_{k=1}^{K} \frac{n_k}{n} \, w_k, \qquad n = \sum_{k=1}^{K} n_k $$

Why it's safer: no central database to steal, no data to intercept in transit, and every hospital keeps full sovereignty over its data.

Why that's not enough: federated learning creates new attack surfaces. Constellation's security layer closes them:

Threat	What happens	Our defence
Model poisoning	A compromised hospital sends malicious updates	A security AI inspects every update and rejects anomalies before aggregation
Reconstruction attacks	An attacker rebuilds patient data from updates	Differential privacy: calibrated noise so no individual can be recovered
Server snooping	Someone inspects a single hospital's update	Secure aggregation: the server only ever sees the combined result

Every hospital counts. Smaller regional centres (Gaspésie, Abitibi) can finally contribute to, and benefit from, AI research instead of being left out of models trained only on large urban hospitals.

Business model

Customers: pharma and cancer researchers pay per secure federated study (~$200K per study, our assumption), including a security audit report hospitals can show regulators
Hospitals & biobanks: revenue share and co-authorship, without their data ever leaving
Market: real-world evidence, $4.7B (2024) → $10.8B (2030)
Revenue target: 10 studies/year → ~$2M by year 3
Go-to-market: existing Quebec cancer research networks first (e.g. consortia like Marathon of Hope – Québec), then scale through Santé Québec, then other provinces

How we built it

During the hackathon we designed the product, its threat model and security architecture, and the business case, and prepared the pitch. We grounded it in:

MEDfl, an open-source federated learning framework for medicine developed at MEDomics Lab (Université de Sherbrooke), with differential privacy and secure communication already built in. Constellation would build on it.
Quebec context: Loi 3 opening health data to research, Santé Québec, and the province-wide digital health record (DSN).
Validation from the field: conversations with clinical leaders at a Montréal cancer centre, whose longitudinal cancer registries and biobanks are exactly the kind of data survival models need.

MVP: three Quebec cancer centres train one survival model on imaging and clinical data. We simulate a compromised hospital sending poisoned updates, and Constellation detects and rejects them live.

Challenges we ran into

Federated ≠ automatically secure. We started from "federated learning keeps data safe." Digging in, we found updates can leak data and be poisoned, and that became the core of the product rather than a footnote.
Centralize vs. protect. Our first instinct was to centralize Quebec's cancer data. From a security view, that builds the biggest target in the province. We reframed it: centralize the intelligence, not the data.
Three minutes, three slides. Explaining federated learning, its threats and a business model to non-specialists forced us to cut everything non-essential.

What we learned

The bottleneck in health AI isn't algorithms or funding. It's trust.
Security and equity go together: when data never leaves, small regional hospitals can take part safely.
One conversation with a clinical leader reshaped our framing more than hours of research.

What's next

Multimodal roadmap: imaging + clinical → doctors' notes and pathology → genomics, all linked per patient in a graph model, following MEDomics Lab's research axes.
Pilots: we're looking for two partner hospitals to run the first secure federated study.