VeriHealth

Proving Health Facts Without Sharing Health Data in Midnight Network

Comment

VeriHealth

Proving health facts without sharing health data.

Inspiration

Healthcare privacy is fundamentally broken by an all-or-nothing approach to data sharing.

When someone needs to prove a simple health fact—such as being eligible for a procedure, meeting a vaccination requirement, or being cleared for physically demanding work—they are often required to share far more information than necessary. This can mean exposing an entire medical record, granting access to a healthcare portal, or sharing sensitive documents containing unrelated personal information.

We asked a simple question:

Why should proving one health fact require revealing an entire health history?

That question became the foundation of VeriHealth.

We were inspired by the principle of data minimization and by the potential of zero-knowledge cryptography to fundamentally change how sensitive information is verified. Instead of moving medical records between organizations, we wanted to create a system where users could prove that something is true without revealing the underlying private data.

Midnight's privacy-focused architecture made it a natural foundation for exploring this idea.

What it does

VeriHealth is a privacy-first health credential verification network built around zero-knowledge proofs.

Hospitals, laboratories, and other trusted institutions can issue cryptographically verifiable health credentials to a patient. The sensitive information remains private to the patient rather than being exposed to every organization that needs to verify a health-related claim.

When a verifier—such as an employer, pharmacy, insurer, or healthcare provider—needs confirmation, the patient can generate a proof.

The verifier learns only what they need to know.

For example:

  • Is this credential valid? → Yes
  • Was it issued by a trusted institution? → Yes
  • Has it expired? → No
  • Has it been revoked? → No

But they do not learn:

  • The patient's full medical history
  • The underlying diagnosis
  • Unrelated laboratory values
  • Additional sensitive personal information

The core idea is simple:

Private Health Data → Zero-Knowledge Proof → Verified Answer

Instead of sharing the record, users share mathematical proof.

How we built it

VeriHealth was designed as a full-stack privacy credential platform with a clear separation between the different actors in the system.

The architecture includes:

  • Midnight for privacy-preserving blockchain logic
  • Compact for implementing privacy-focused smart contract logic
  • Next.js and TypeScript for the application interface
  • shadcn/ui for the dashboard experience
  • Neon PostgreSQL for application data
  • Prisma for database access
  • Redis for cache and session management
  • Lace / Midnight Preview wallet integration for the user wallet experience
  • Vercel for deployment
  • GitHub Actions for CI/CD

We designed the product around three primary participants:

👤 Patient

The patient owns their health credential and controls when it is used.

They can generate a proof without directly exposing the sensitive information behind the credential.

🏥 Issuer

A trusted healthcare institution issues a cryptographically verifiable credential.

The system is designed so that institutional trust matters. A verifier should know that a credential originated from a recognized issuer rather than simply trusting a self-reported claim.

✅ Verifier

A verifier requests confirmation of a specific fact.

Instead of receiving the patient's entire medical record, they verify whether the proof satisfies the required conditions.

We also designed the architecture with future support for:

  • Credential expiry
  • Credential revocation
  • Verified issuer registries
  • Range proofs for numerical health data
  • Multi-fact composable proofs
  • Delegated access for guardians and dependents
  • Enterprise compliance workflows

Challenges we ran into

One of the biggest challenges was designing a privacy system that remained practical and understandable.

Zero-knowledge technology is extremely powerful, but the user experience cannot feel like cryptography.

A patient should not need to understand circuits, witnesses, cryptographic commitments, or proof generation to prove a simple health fact.

This forced us to constantly think about the separation between the complex technology underneath the platform and the simple action the user sees.

Another major challenge was defining the boundary between verification and disclosure.

It is easy to accidentally design a system where a verifier learns more information than necessary. We had to carefully think through what information genuinely needs to be public for verification and what should remain private.

Revocation also introduced an interesting design challenge.

A credential must be verifiable without exposing the underlying medical information, while still allowing outdated or revoked credentials to automatically fail verification. Designing this balance between privacy, trust, and up-to-date credential status is a key part of the architecture.

Finally, healthcare introduces significant regulatory complexity.

We deliberately avoided making premature claims that a prototype is automatically HIPAA or GDPR compliant. Technical privacy features and legal compliance are related but not identical. Real-world deployment requires independent legal, security, and regulatory review.

That distinction became an important design principle for the project.

Accomplishments that we're proud of

We are proud that VeriHealth is more than just a concept about healthcare and blockchain.

We developed a complete product vision around a real-world privacy problem and structured it around a practical patient → issuer → verifier workflow.

Some of the things we are particularly proud of include:

  • Designing a clear privacy-first health credential model
  • Building around the principle of data minimization
  • Creating a workflow where users prove facts rather than share records
  • Exploring institutional trust through verified issuers
  • Designing for credential expiry and revocation
  • Planning for advanced capabilities such as range proofs
  • Building the architecture around Midnight's privacy-focused capabilities
  • Creating a product experience that makes zero-knowledge technology easier to understand
  • Establishing clear boundaries between the MVP, future capabilities, and real-world regulatory deployment

Most importantly, we are proud of the core idea behind the project:

Healthcare verification should not require healthcare exposure.

What we learned

Building VeriHealth taught us that privacy is not simply about hiding data.

Real privacy engineering is about carefully deciding who needs to know what.

In many systems, the problem is not that information is insecurely stored. The problem is that too much information is collected and shared in the first place.

We also learned that zero-knowledge proofs can fundamentally change how digital trust works.

Traditionally, verification works by sharing evidence.

With zero knowledge, verification can work by sharing proof.

That distinction has enormous implications beyond healthcare.

We also learned the importance of separating:

  • Technical possibility
  • Product usability
  • Security guarantees
  • Regulatory compliance

A technically impressive privacy system is not automatically easy to use, secure in production, or legally compliant.

Building responsibly requires addressing all of these layers.

Finally, working with Midnight helped us think more deeply about privacy as an architectural property rather than something added later as a feature.

What's next for VeriHealth

The next stage for VeriHealth is to move from the current implementation toward a more complete privacy credential infrastructure.

Our roadmap includes:

🏥 Verified Issuer Registry

We plan to expand the trusted issuer model through an on-chain registry.

This will allow verifiers to confirm that credentials originate from recognized institutions.

🔄 Revocation and Expiry

Credentials should automatically become invalid when they expire or are revoked.

We plan to strengthen the architecture around real-time credential validity while preserving patient privacy.

📊 Range Proofs

One of the most exciting next steps is enabling users to prove that a value falls within a required range without revealing the actual value.

For example:

Prove that a medical measurement is within a safe threshold without revealing the measurement itself.

🧩 Composable Health Proofs

We want users to eventually combine multiple private facts into a single proof.

For example, a verifier may need confirmation that a person satisfies multiple requirements without receiving any of the underlying health data.

👨‍👩‍👧 Delegated Access

We plan to explore privacy-preserving workflows for guardians proving information on behalf of dependents.

This is important for making the platform practical for families and real healthcare environments.

🏢 Enterprise and Compliance Workflows

Future versions will explore separate reporting and compliance architectures for regulated organizations.

Our goal is to ensure that necessary institutional workflows do not automatically weaken privacy for everyday users.

⚖️ Independent Legal and Security Review

Before making any real-world regulatory or compliance claims, VeriHealth will require independent legal, security, and technical review.

Production deployment must be treated differently from a prototype.

The Vision

VeriHealth is built around a simple belief:

You should be able to prove something about your health without handing over everything about your health.

We believe zero-knowledge technology can help move healthcare verification away from unnecessary data sharing and toward a model based on privacy, trust, and cryptographic proof.

The future we are building toward is one where:

Patients control their information.

Institutions issue trusted credentials.

Organizations verify only what they need.

And sensitive health data stays private.

Privacy. Trust. Verification.

Built With

  • compact
  • midnightntwrk
  • neondb
  • nextjs
  • redis
  • tailwind
Share this project:

Updates

Submission history