The architectural separation between health data used for prevention and health data used for underwriting — ensuring that prevention cannot become surveillance.