arXiv:2605.20505v1 [cs.SE] 19 May 2026
PRISM-Coach: Privacy-by-Design Adaptive Group Assignment for Digital Lifestyle Coaching at Scale Nariman Mani
Salma Attaranasl
Engineering/R&D Department, Nutrosal Inc. Ottawa, ON, Canada [email protected]
Engineering/R&D Department, Nutrosal Inc. Ottawa, ON, Canada [email protected]
Abstract—Digital lifestyle coaching systems must simultaneously (i) adapt peer support as user behavior and engagement evolve and (ii) prevent personally identifiable information (PII) and sensitive health information from leaking into analytics and AI pipelines. These objectives create a practical tension: personalization requires longitudinal linkability, while privacy engineering requires minimization, separation, and controlled reidentification. We present PRISM-Coach (Privacy-Restricted Identity Separation and Mapping for Coaching), a stakeholder-centered architecture and adaptive peer-group assignment method that makes this tension explicit and resolves it through enforceable boundaries. PRISM-Coach separates a single user reality into four bounded views Identity, Operational, Learning, and Coaching with distinct access controls and risk profiles. On top of this boundary, we implement vault-based controlled identity restoration, a privacy-constrained contextual bandit that assigns users to eligible peer groups under coach-capacity and stability constraints, and a human-in-the-loop coaching assistant that generates de-identified summaries and draft messages without sending raw PII/PHI to external AI services. We instantiate PRISM-Coach in a commercially deployed lifestyle coaching platform and evaluate it using three years of telemetry (approximately 2,800 users) and an in-app needs assessment survey. At the population level, daily check-in adherence is 0.68 versus 0.35 in the pre-deployment baseline, and engagement is 1.35× relative to baseline. In a matched 19-week comparison window (8-week pre, 11-week post), the AI-enabled workflow achieves 0.74 adherence versus 0.48 under static grouping and yields higher average weight loss (5.2 kg versus 3.1 kg). In surveys, 82% of users report positive perceived benefit and 92% report confidence in platform privacy protections after transparency disclosures. These results position PRISM-Coach as a practical blueprint for privacy-by-design learning systems in everyday wellness. To support transparency and reproducibility, an anonymized, reproducible research artifact with de-identified datasets, analysis code, and reference implementations accompanies this paper. Index Terms—Health informatics systems, digital lifestyle coaching, privacy-by-design, governance, pseudonymization, tokenization, contextual bandits, adaptive group assignment, humanin-the-loop AI, adherence, engagement, ethics
I. I NTRODUCTION Digital lifestyle interventions often underperform in routine use because exposure to the intervention is uneven: users disengage, self-monitoring decays, and accountability weakens over time [1]. Group-based coaching can counteract this dynamic by creating social reinforcement and accountability, but production deployments expose a deeper systems problem.
You must adapt peer-group placement as user behavior and engagement drift, yet you must also protect the sensitive data created by daily logs, posts, and coach messages. Two theory-to-practice tensions make this problem hard. Tension 1: personalization needs linkability, privacy needs separation. Adaptive assignment requires longitudinal features that link behavior over time. Privacy engineering guidance pushes systems toward minimization, purpose limitation, and controlled re-identification pathways [2]–[4]. A naive “strip names” approach fails because behavioral traces and free-text still enable linkage and inference. Tension 2: learning needs exploration, coaching needs stability. Contextual bandits can improve personalization by balancing exploration and exploitation [5], [6]. Coaching operations impose hard constraints: coach capacity, groupsize limits, eligibility policies, and stability requirements that prevent disruptive churn. This paper argues that you can resolve both tensions by treating privacy and operations as first-class constraints in the learning loop, not as after-the-fact implementation details. We structure the paper around three research questions: • RQ1: Can controlled identity separation and mapping enable learning-driven personalization while preventing PII/PHI exposure to AI components and external services? • RQ2: Does adaptive peer-group assignment improve adherence and engagement relative to static grouping when you must respect capacity, stability, and eligibility constraints? • RQ3: Can human-in-the-loop AI assistance improve coaching throughput and stakeholder experience without weakening privacy guarantees? Contributions. (1) We define a multi-view privacy boundary model that separates one user reality into four bounded representations Identity, Operational, Learning, and Coaching with explicit access controls and auditable controlled restoration. (2) We formulate adaptive peer-group assignment as a privacy-constrained contextual bandit that filters actions by operational constraints before scoring. (3) We implement a bounded coaching-assistant workflow that operates only on deidentified inputs and requires coach review for all outgoing messages. (4) We evaluate the deployed system using three years of telemetry from approximately 2,800 users and an
in-app needs assessment survey, reporting instrumented adherence/engagement alongside stakeholder-reported outcomes. Reproducibility and artifacts. To support transparency and reproducibility, we release an anonymized research artifact containing de-identified derived datasets, end-to-end analysis code, and reference implementations of key system components used in this study (Section XV). Reading guide. Section II reviews prior work. Section IV derives design requirements from the tensions above and from stakeholder evidence. Sections III–VIII present the resulting system design. Section X evaluates outcomes and privacy properties and answers RQ1–RQ3. II. R ELATED W ORK
Output and Presentation Layer
User Interaction Layer
Personalized Feedback Routing
Join Groups, Interact User and Coach Dashboards
PII/PHI Filtration & Pseudonymization
Submit Logs, Meal Photos, Activity Data
Filter PII/PHI
Users
User Input Module
Social Networking Module
Filter PII/PHI
Pseudonymized Data
AI Orchestration Service
PII
Secure Database
Vault
Restore Identifiers Privacy and Data Handling Layer
User Activity Analysis Module
Generative AI Coaching Engine
Reinforcement Learning Engine
AI Processing Layer
A. Attrition and Measurement in Digital Health Attrition and inconsistent engagement are well-documented challenges in digital health interventions. Eysenbach formalized the “law of attrition,” emphasizing that dropout is an intrinsic property of many internet-based interventions and that evaluation must account for usage patterns rather than assuming uniform exposure [1]. For systems research, this implies that reported outcome improvements require explicit definitions of behavioral exposure, adherence, and engagement. B. Digital Peer Support and Group-Based Lifestyle Interventions Peer support is a recurring mechanism for sustaining behavior change in weight-management and lifestyle programs. Reviews of peer support groups report that shared community, accountability, and low-friction encouragement can support adherence and maintenance, including in online formats [7]. Recent evidence also suggests that digital peer support interventions can improve behavioral, psychosocial, and clinical outcomes, although effect sizes vary by implementation quality and engagement [8]. These findings imply two production-grade design constraints. First, group composition and activity level matter: mismatched cohorts can suppress participation and reduce perceived value. Second, group processes evolve: treating grouping as a one-time onboarding step causes drift as goals, context, and engagement trajectories change. C. Adaptive Personalization: Contextual Bandits and Reinforcement Learning Personalization in health coaching has increasingly adopted learning-based approaches. Reinforcement learning provides a general framing for sequential decision-making, while contextual bandits focus on action selection using observable context and near-term reward signals [5], [6]. In health deployments, operational feasibility (capacity, stability, and eligibility) and governance (privacy boundaries and auditability) are first-class constraints.
Fig. 1. System Architecture for Privacy-Preserving AI-Driven Social Networking and Coaching Platform.
D. Generative AI as Assistive Infrastructure Generative AI can support education, communication, and summarization tasks, yet risks such as hallucination, bias, and data leakage remain significant [9]–[12]. In PRISM-Coach, generative AI is bounded: it operates on de-identified inputs, uses structured prompts, and requires coach review before delivery. E. Privacy-by-Design and Differential Privacy Privacy requires minimization, enforceable boundaries, and auditable governance. Differential privacy provides a formal mechanism to bound disclosure risk in aggregated outputs [13]. In PRISM-Coach, identity separation reduces direct exposure risk, while optional differential privacy mechanisms can be applied to cohort-level analytics exports. Our recent work has explored related directions in privacypreserving personalized coaching, adaptive wellness platforms, and AI-driven adaptive decision-making [14]–[16]. III. PRISM-C OACH D ESIGN OVERVIEW The goal of this section is to demonstrate how the system architecture follows from requirements R1–R4 rather than to document implementation details. Figure 1 summarizes the end-to-end data flow. The key claim is structural: user interaction, privacy handling, learning/AI, and stakeholderfacing presentation must be separated so that learning can operate on de-identified representations while operations retain controlled, auditable re-identification. A. User Interaction Layer The User Interaction Layer is the primary entry point for participation and data capture. It contains a User Input Module for logging activities, meals (including optional meal photos), and other health-related signals, and a Social Networking Module that enables group participation, progress sharing, and coach interaction. This layer directly affects adherence by
reducing friction in self-monitoring and by enabling structured peer accountability. B. Privacy and Data Handling Layer The Privacy and Data Handling Layer ensures that sensitive user data (PII/PHI) is filtered and replaced with pseudonymous tokens before it reaches analytics or AI components. It contains: (i) a filtration and pseudonymization service, (ii) a secure operational database holding pseudonymous records, (iii) a protected PII vault holding raw identifiers under stricter controls, and (iv) a controlled restoration service that re-identifies only when required for authorized workflows. Further details are provided in Section V. C. AI Processing Layer The AI Processing Layer transforms pseudonymous behavioral data into derived features, risk indicators, and adaptive assignments. It includes feature engineering, activity analysis, and an adaptive assignment engine (this paper: privacyconstrained contextual bandit). It also includes a generative coaching component used in bounded, human-reviewed mode. Details are provided in Sections VI and VIII. D. Presentation and Output Layer The Presentation and Output Layer delivers outputs to stakeholders: users receive dashboards, recommendations, and reminders; coaches receive cohort oversight and AI-generated suggestions for review. This layer is designed for interpretability and accountability, ensuring that system actions remain legible to both users and coaches. IV. F ROM T HEORY TO D ESIGN R EQUIREMENTS The goal of this section is to justify why the PRISM-Coach design must look the way it does. We translate the theoretical tensions in Section I into concrete system requirements that are testable in deployment. Implication P1 (identity separation must be structural). If Learning and AI components can access raw identifiers, accidental leakage becomes a routine failure mode. Therefore, identity separation must be enforced by the data model and access controls, not by developer convention. Implication P2 (re-identification must be purpose-bound and auditable). Operations still require occasional identity restoration (e.g., message delivery, account support). Therefore, re-identification must flow through a single restoration boundary with RBAC+MFA, immutable audit logs, and rate limits. Implication O1 (constraints must precede learning). Production grouping has hard feasibility constraints (capacity, eligibility policies) and soft constraints (stability). Therefore, the policy must filter infeasible assignments before it scores alternatives. Implication O2 (stability is part of the objective). Frequent reassignment can harm trust and group cohesion. Therefore, the reward and/or scoring rule must penalize churn and enforce minimum dwell time.
TABLE I R ESEARCH QUESTIONS MAPPED TO ANALYSIS AND EVIDENCE
RQ
Sections that analyze it
Evidence swered
/
where
RQ1 RQ2
Section V Section VI
RQ3
Section VIII
Section X-J Section X-G Tables VI–VII Section X-I
an-
and
Design requirements. We derive four requirements that drive the remainder of the paper: • R1 (adaptive personalization): adapt cohort placement as behavior and engagement drift. • R2 (structured accountability with harm controls): create peer accountability while reducing mismatch and inactive cohorts. • R3 (enforceable privacy governance): prevent PII/PHI exposure to Learning and AI components by construction; make re-identification controlled and auditable. • R4 (operational feasibility): satisfy coach-capacity, group-size, eligibility, and stability constraints in every assignment decision. Table I shows where each research question is analyzed and answered. Stakeholder grounding. We validate that these requirements match stakeholder needs through an in-app needs assessment conducted during onboarding and iterative refinement. A. Needs Assessment Method We used two in-app survey instruments. Survey A (needs assessment, onboarding). During onboarding, we measured (i) barriers in prior lifestyle programs (multi-select), (ii) baseline attitudes toward motivation/accountability/privacy (Likert), and (iii) optional free-text responses. Survey B (experience and trust, post-exposure). After users had at least 4 weeks of platform exposure, we administered short Likert items on perceived benefit, peer accountability, and privacy confidence after transparency disclosures. Respondents. A total of NsurveyA = 1900 users completed at least one Survey A item. For Survey B, item-level denominators vary due to non-response; we compute percentages using the number of non-missing responses for each item (reported alongside each outcome). Computation. For multi-select barriers, a respondent may select multiple options. Percentages in Table II are computed as: nb pb = × 100, (1) nvalid where nb is the count selecting barrier b and nvalid is the number of valid responses for that item. Survey governance. Participation was voluntary. We displayed a data-use notice describing how responses inform
TABLE II N EEDS ASSESSMENT: BARRIERS IN TRADITIONAL PROGRAMS ( MULTI - SELECT IN - APP SURVEY; Nsurvey = 1900)
Barrier
%
Interpretation
Weight regain
68%
Initial success followed by loss of Low-carb; adherence; linked to accountability calorie counting; gaps and stress triggers. IF Repetitive plans reduce motivation Restrictive and increase dropout. diets Limited skill-building for sustain- Generic able habits. programs Lack of personalization for con- Broad straints and preferences. apps Feedback not tailored to individual Log-only dynamics and setbacks. tools Weak accountability and social re- Individualinforcement. only Reduced resilience during plateaus Lowand stress periods. touch Group mismatch (goals/activity) Large coprevents meaningful connection. horts Fear of misuse or exposure of sen- Most platsitive information. forms
Monotony / 34% burnout Insufficient 28% education One-size52% fits-all Limited 48% monitoring Lack of peer 64% support Isolation 35% Low group 27% engagement Privacy con- 23% cerns
Contexts
TABLE III PRISM-C OACH VIEWS AND BOUNDARIES
View
Content, boundary, primary risk
Identity
Raw identifiers and sensitive fields stored in a protected vault. Access via RBAC+MFA and audited restoration. Risk: re-identification if vault/keys compromised.
Operational
Pseudonymous IDs, logs, group membership, app events. Used by core services. Risk: linkage/inference if leaked.
Learning
Feature vectors and aggregates used by adaptive assignment. No raw identity fields. Risk: inference/model inversion (mitigated via minimization and aggregation).
Coaching
De-identified summaries and draft messages for coaches. Human review required. Risk: accidental disclosure in free-text (mitigated via redaction and structured templates).
product improvement and research reporting, and we report only aggregated results in this paper. V. PRISM-C OACH P RIVACY A RCHITECTURE AND G OVERNANCE This section specifies the privacy layer with the depth required to justify “privacy-preserving” as an architectural claim. We define a threat model, detail the pseudonymization and vault separation workflow, and describe how the system prevents data leakage to AI services while supporting learningdriven personalization. We use the term pseudonymisation to denote replacement of direct identifiers with derived or randomly generated sur-
TABLE IV T HREATS AND PRIMARY MITIGATIONS IN PRISM-C OACH
T
Attack surface
Primary mitigations
T1
Leakage of pseudonymous operational logs, group membership, and events.
Identity separation by design; minimization of identifiers; least-privilege access; monitoring of exports and unusual query patterns.
T2
Insider misuse attempting re-identification beyond approved workflows.
RBAC+MFA for restoration; purpose-bound access; immutable audit logs; periodic access reviews; rate limiting on restoration endpoints.
T3
Leakage through AI integration (prompt/response content, external services).
De-identified Coaching view; automated PII redaction; no vault access from AI components; coach review for all outgoing messages; deidentified prompt/output logging for audits.
rogates while retaining controlled linkability under approved workflows. This distinction from anonymisation is central in privacy engineering guidance and standards, which emphasize risk-based design, minimization, and governance controls for re-identification pathways [2]–[4]. A. Threat Model We consider three practical threat classes. T1 assumes exposure of the Operational view (pseudonymous logs, group membership, and app events) due to database compromise or misconfiguration. T2 assumes insider misuse in which legitimate access is abused to attempt re-identification. T3 assumes leakage through AI integration, where sensitive fields might be unintentionally transmitted to external AI services. Table IV summarizes the threat classes and the corresponding primary mitigations enforced by PRISM-Coach. B. PII/PHI Filtration and Tokenization Workflow Incoming user data may contain sensitive fields {f1 , f2 , . . . , fn }. The filtration stage detects direct identifiers and other high-risk fields and replaces them with tokens before storage in the Operational database or any downstream use by analytics/AI components. Why tokenization (not plain hashing). Many identifiers are low-entropy (e.g., emails, postal codes) and enable dictionary attacks if you rely on unsupervised hashes. We therefore implement deterministic tokenization using a keyed function whose key remains inside the KMS boundary: Ti = HMACKT (norm(fi ) ∥ ctxi ) ,
(2)
where norm(·) canonicalizes formatting (e.g., lowercasing emails), ctxi binds the token to a field type (e.g., email), and KT is stored and rotated in a key management service. The Operational database stores only tokens and pseudonymous activity data required to run workflows.
Minimization. We do not copy raw PII/PHI into the Operational, Learning, or Coaching views. When downstream components need stable linkage, they use a user token (Eq. 4) rather than raw identifiers. We use Eq. 2 for field-level tokenization and Eq. 4 for user-level stable linkage. C. Controlled Identity Mapping and Vault Separation To support user-specific delivery (e.g., sending a coach message), identity restoration is performed only through a controlled mapping boundary. The Identity vault stores encrypted PII/PHI data under stricter controls: Cu = EncKE (PIIu ),
(3)
Algorithm 1 Prompt De-identification Pipeline Require: Text m, user token Tu , redaction rules R 1: Detect candidate entities using R (emails, phone numbers, addresses, dates of birth) and an NER model 2: Replace detected entities with typed placeholders (e.g., [NAME], [EMAIL], [PHONE]) 3: Remove or generalize rare identifiers (IDs, order numbers) and geolocation finer than city-level 4: Attach only Tu and cohort metadata required by the template 5: return De-identified message mdeid
VI. A DAPTIVE P EER -G ROUP A SSIGNMENT AS A P RIVACY-C ONSTRAINED C ONTEXTUAL BANDIT
where SIDu is a randomly generated internal subject identifier minted at registration and stored only inside the Identity vault mapping. Using SIDu (rather than mutable fields such as email) ensures stable linkage even when user contact details change, while preserving the same KMS-bound key separation described above.
The goal of this section is to answer RQ2 by formalizing group assignment as a constrained contextual bandit whose action set is filtered by operational feasibility before any learning-based scoring. We report absolute adherence/engagement for interpretability; the bandit reward uses within-user deltas computed against the pre-assignment baseline window. Static grouping fails when engagement changes, group activity drifts, or mismatch reduces cohesion. PRISM-Coach models peer-group assignment as a constrained contextual bandit problem in which the system selects an action (group assignment) given a user context and observes short-horizon rewards [5].
D. Vault Hardening and Governance Controls
A. Feature Engineering and Activity Analytics
We harden the vault and restoration boundary using operational controls commonly required in production healthcareadjacent systems: (1) encryption at rest (AES-256) and strict key governance, (2) role-based access control (RBAC) with multi-factor authentication (MFA) for restoration operations, (3) comprehensive audit logs for every restoration request (who, what, when, why), and (4) rate limiting and anomaly monitoring to detect abnormal restoration patterns.
The Learning view is derived from operational events using feature engineering. Numerical features (e.g., average daily calories or weekly activity counts) are normalized:
where Enc is symmetric encryption (e.g., AES-256) and KE is managed in a key management service boundary. A deterministic token may also be used as the stable vault index, such as: Tu = HMACKT (norm(SIDu ) ∥ user) ,
(4)
E. AI Data Minimization and Prompt Safety To mitigate T3, AI-facing components consume only Learning and Coaching views: pseudonymous identifiers, derived features, and de-identified summaries. The system applies prompt redaction rules excluding names, emails, addresses, and sensitive identifiers. Prompts and outputs are logged in de-identified form for auditability, which enables safety monitoring without creating a second sensitive dataset. 1) Structured De-identification for Free-Text: Free-text fields (posts, messages, captions) represent a dominant leakage channel for accidental identifier disclosure. We apply a deterministic redaction pipeline prior to AI processing. We audit this pipeline by sampling prompts and outputs and computing a leakage rate: nhits , (5) LeakRate = nsamples where nhits is the number of samples containing residual identifiers under the same detection rules.
Xnorm =
X − Xmin . Xmax − Xmin
(6)
where Xmin and Xmax are computed over a rolling cohortlevel window. Categorical inputs (e.g., dietary preference categories) are represented via one-hot encoding. The platform also computes signals for disengagement risk, including missed-check-in streaks and engagement slope over time. B. Context, Actions, and Reward At time t, user u has a Learning-view context vector xu,t excluding direct identifiers. The action selects an eligible group g ∈ Gu,t satisfying capacity and stability constraints. Reward captures short-horizon improvement while penalizing disruptive churn: ru,t = wA ·∆Adhu +wE ·∆Engu −λ·ChurnPenaltyu,t . (7) where ∆Adhu and ∆Engu denote changes relative to a fixed pre-assignment baseline window. C. Operational Constraints Capacity constraints enforce group size and coach load limits. Stability constraints rate-limit reassignment and discourage oscillation. Eligibility constraints enforce goal compatibility and avoid assigning users into inactive cohorts.
Algorithm 2 Privacy-Constrained Contextual Bandit Group Assignment Require: Learning-view context xu,t , eligible groups Gu,t , parameters θ, confidence β 1: Filter Gu,t by capacity, stability, and eligibility constraints 2: for each group g ∈ Gu,t do 3: Estimate µ̂(xu,t , g) = θ⊤ ϕ(xu,t , g) 4: Compute UCB score sg = µ̂(xu,t , g) + β · σ(xu,t , g) 5: Apply stability penalty: sg ← sg − λ · ChurnPenaltyu,t (g) 6: end for 7: Select g ⋆ = arg maxg sg 8: Assign user to g ⋆ ; observe reward ru,t after evaluation window 9: Update θ using (ϕ(xu,t , g ⋆ ), ru,t ) 10: return g ⋆
Capacity. Each group g has a maximum size Cg and each coach c has a maximum active load Lc : X |Ug (t)| ≤ Cg , |Ug (t)| ≤ Lc . (8) g∈G(c)
A. Software and Cloud Architecture The production system employs a modern cloud architecture for scalability and availability. The front end is implemented in React.js for a responsive user experience. The backend is implemented in Node.js and supports business logic, realtime communication, and integration with AI services. Data persists in a MySQL database storing pseudonymous user profiles, group assignments, daily reports, and interaction logs. Deployment uses a split-hosting model: front end hosted on Netlify, backend hosted on Heroku, and MySQL hosted on AWS RDS. This separation supports independent scaling of user-facing and backend services. B. Presentation and Output Capabilities
Stability. We restrict reassignment using a minimum dwell time τ and penalize disruptive churn: I{t − tlast < τ } ⇒ g ∈ {gucurrent }. u
as sensitive health data: the system strips EXIF metadata, avoids attaching direct identifiers, and processes images via a contracted processor under a no-retention agreement Raw images are excluded from research exports; only derived nutritional features enter the Learning view.
(9)
We define ChurnPenaltyu,t (g) = 1 when g ̸= gucurrent and < τ ′ , else 0, with τ ′ ≥ τ to discourage oscillation. t − tlast u Eligibility. We restrict candidate groups using goal match, language/time compatibility, and activity thresholds:
Users receive a dynamic dashboard summarizing progress and actionable guidance, real-time notifications (e.g., reminders and milestone messages), and periodic downloadable reports summarizing performance over a specified time frame. Coaches receive a dashboard for cohort oversight, individual progress trends, and AI-generated suggestions routed for review under the Coaching view boundary.
VIII. H UMAN - IN - THE -L OOP C OACHING A SSISTANT AND g ∈ Gu,t ⇔ GoalMatch(u, g)∧Active(g, t)∧PolicyEligible(u, g). S AFETY (10) The coaching assistant is explicitly assistive. It reduces Constraint filtering occurs in the Operational view. The coach cognitive load and improves responsiveness but does not scoring model consumes only Learning-view features. replace human judgment. The assistant consumes Learningview features and Coaching-view summaries and generates D. Policy: Constrained LinUCB-Style Selection (i) risk flags indicating likely disengagement and (ii) draft We implement a LinUCB-family selection policy with conmessages designed to encourage low-friction re-engagement. straint filtering and a stability penalty [5], [6]. The algorithm A conceptual interface for bounded generation is: estimates expected reward for each eligible group using a learned linear model and adds an uncertainty bonus to balance Advice = GPT(DeID Summary, Features, Template), exploration and exploitation. (11) where inputs are de-identified and templated. Coaches review VII. S YSTEM I NSTANTIATION IN AN drafts before delivery and may edit, approve, or discard. I NDUSTRY-D EPLOYED P LATFORM This workflow addresses known generative AI risks [9], We instantiate PRISM-Coach in a commercially deployed, [17]. The system restricts prompts to de-identified templates, social media-inspired lifestyle coaching platform used for prohibits clinical diagnosis or prescribing language, and logs health and fitness goals via community engagement and coach assistant usage for audit and monitoring. Users can opt out of oversight. The system operated in routine production use for AI-assisted messaging while remaining in coach-led support. three years and served approximately 2,800 users under real IX. D EPLOYMENT, M ONITORING , AND L EARNING coach-capacity and group-stability constraints. Users join via H EALTH S YSTEM L OOP invitation and are grouped by objectives (e.g., weight loss, healthy eating, maintenance). Each group is assigned a coach Learning health systems emphasize a closed loop from rouwho monitors daily reports on eating and exercise habits. The tine data capture to evidence generation to implementation and platform supports peer interaction through posts, media shar- measurable outcomes [18], [19]. PRISM-Coach operationaling, group chats, and scheduled one-on-one sessions. It also izes this loop through behavioral instrumentation, assignment supports optional AI-driven meal photo analysis for calorie policy monitoring, and privacy-governance audits. PRISMestimation and daily reminders to keep users aligned with Coach instruments daily adherence and weekly engagement goals. When users enable meal photo analysis, we treat images actions, monitors policy behavior (reward drift, instability,
constraint violations), and monitors governance through periodic review of vault restoration logs and anomalous access patterns. For cohort reporting and research dashboards, PRISMCoach can apply differential privacy mechanisms to reduce re-identification risk in aggregated outputs [13]. X. E VALUATION A. Ethics, Consent, and Data Governance This study uses product telemetry and survey responses collected as part of routine platform operation. We report only aggregated results and de-identified examples. Consent and transparency. The platform presents a datause notice describing operational data processing and research reporting. Users may opt out of research reporting without losing access to standard coaching features. Data minimization. Our analysis uses Learning-view features and pseudonymous Operational-view events. We do not export Identity-view fields for analytics. Retention and deletion. Identity-view data is retained for 24 months after account closure or last authenticated activity unless the user requests deletion earlier. Operational/Learning telemetry used for product quality monitoring and research reporting is retained in pseudonymous or derived form for up to 36 months to support longitudinal analyses. User deletion requests propagate across Identity, Operational, Learning, and Coaching views using the linked token identifier. B. Dataset and Units of Analysis We evaluate PRISM-Coach on longitudinal deployment data from approximately 2,800 users over three years. We analyze adherence at the user-day level and engagement at the userweek level. Evidence sources include: needs assessment survey, instrumented platform outcomes, controlled comparison windows between AI-enabled and static assignment, and privacy validation through exposure simulation and governance review. We report engagement indices separately for (i) the full population and (ii) the matched comparison window, because each answers a different estimand. C. Study Design and Cohort Construction We evaluate PRISM-Coach using a mixed-methods design. • Longitudinal observational analysis over the full deployment period to quantify adherence and engagement trends. • Controlled comparison window using a quasiexperimental cohort design to compare static grouping with AI-enabled adaptive assignment and bounded AI assistance. For the controlled window, we used 1:1 propensity score matching without replacement. Propensity scores were estimated with logistic regression using baseline adherence, baseline engagement score, goal category, and tenure (weeks since onboarding), and we applied nearest-neighbor matching with a caliper of 0.2 standard deviations of the logit propensity score. We exclude users with fewer than 21 active days in the pre-period to reduce noise from immediate dropouts, where
an active day is a day with at least one instrumented event (e.g., check-in completion, meal/activity log, post, comment, or coach-message interaction). We define the intervention start date t0 as the deployment date of adaptive assignment for the AI-enabled cohort, with a pre-period of Wpre weeks and post-period of Wpost weeks: [t0 − Wpre , t0 ) → baseline,
[t0 , t0 + Wpost ) → outcome. (12)
D. Operational Metric Definitions Daily adherence is an instrumented event: yu,d = 1 if user u completes the required daily check-in on day d, else 0. Cohort adherence over a period D is: ! 1 X 1 X yu,d . (13) Adh = |U | |D| u∈U
d∈D
Weekly engagement score. We define a weekly engagement score K X Su,w = αk · c̃(k) (14) u,w , k=1 (k)
where c̃u,w denotes a bounded, non-negative normalized count so that E[Su,w ] > 0 and the post/pre ratio in Eq. 15 is welldefined. Specifically, for each action type k we winsorize raw (k) counts cu,w to the [5, 95] percentile range estimated on the pre-period distribution, then scale to [0, 1]: (k)
c̃(k) u,w =
(k)
(k)
(k)
min(max(cu,w , P5 ), P95 ) − P5 (k)
(k)
P95 − P5
,
+ϵ
P with ϵ = 10−6 for numerical stability and k αk = 1. Engagement index (relative). To report interpretable changes, we define an engagement index relative to a reference period or cohort: EngIndex =
E[Su,w | post] , E[Su,w | pre]
(15)
so EngIndex = 1.35 indicates a 35% increase relative to baseline. We compute EngIndex using cohort-level means of Su,w over the relevant pre/post windows. Because Su,w is defined as non-negative (above), EngIndex values below 1.0 indicate decreases, and values above 1.0 indicate increases. EngIndex is computed within each analysis window as the post/pre ratio (Eq. 15). Population-level and matched-window EngIndex values need not coincide because they use different cohorts and denominators. User-reported outcomes are collected using in-app Likert (5-point) items; we report the fraction of responses at 4–5 (“positive”). E. Statistical Analysis We compute 95% confidence intervals for all primary telemetry outcomes. Due to space, the main paper reports point estimates, while the artifact (Section XV) contains the full CI tables and analysis code.
Adherence. Because yu,d is binary, we estimate adherence differences using difference-in-means with cluster-robust standard errors at the user level. As a sensitivity analysis, we fit a mixed-effects logistic regression: Pr(yu,d = 1) = β0 +β1 ·I{AI enabled}+bu +γ ⊤ zu,d , 1 − Pr(yu,d = 1) (16) where bu is a user random intercept and zu,d includes seasonality controls. We included fixed effects for calendar week-ofyear and calendar year, and adjusted for tenure (weeks since onboarding). Engagement. We compare weekly engagement using a Mann–Whitney U test and a linear mixed model as a robustness check. Multiple comparisons. For stratified analyses, we control false discovery using Benjamini–Hochberg at q = 0.05. log
TABLE V AI COMPONENT PERFORMANCE ( OPERATIONAL EVALUATION )
Component Coaching assistant Group assignment Activity insights
Metric
Value
Precision / Recall Accuracy Actionable rate
0.88 / 0.84 0.91 0.78
H. Case Study Evidence Qualitative case studies complement instrumented outcomes by illustrating mechanisms. For example, a user with thyroid issues and stress-related eating reported difficulty maintaining restrictive diets. Under the deployed workflow, the user lost 6 kg over three months and reported fewer stress-triggered eating episodes, consistent with timely coach outreach supported by risk flags and low-friction re-engagement prompts.
F. User-Reported Outcomes and Trust
I. AI Performance Metrics
We collected in-app Likert (5-point) items on perceived benefit, personalization quality, and privacy trust. We report the fraction of responses at 4–5 (“positive”). In Survey B (post-exposure), 82% reported positive perceived benefit (4–5 on a 5-point Likert item; n = 900). 72% reported that peer accountability improved motivation (n = 820). After PRISM transparency disclosures, 92% reported confidence in the platform’s privacy protections (n = 700). We report these perceptions separately from telemetryderived adherence and engagement metrics to avoid conflating self-report with instrumented behavior.
We evaluate AI components with task-specific operational metrics. For coaching suggestions, we compute precision as the fraction of AI suggestions judged actionable by coaches and recall as the fraction of recurring coach-identified issues that the assistant successfully flagged. Under this evaluation, coaching suggestions achieved 88% precision and 84% recall. For group assignment quality, we compute accuracy as the fraction of assignments that met goal-alignment and activitycompatibility criteria and sustained positive engagement; accuracy reached 91%. For activity insights, 78% of users received at least one actionable insight associated with subsequent positive behavior change. Metrics are computed over coachlabeled review logs from the same matched window, with actionable labels recorded at the time of message approval.
G. Controlled Comparison Window (Static vs. AI-Enabled) We evaluate RQ2/RQ3 using a quasi-experimental matched cohort design over a 19-week matched comparison window (8week pre, 11-week post). We compare an AI-enabled condition (adaptive assignment + bounded assistant workflow) against a static-assignment condition. Cohorts and matching. AI-enabled cohort: NAI = 1400 users. Static cohort: Nstatic = 1400 users. We match users using pre-period behavior over Wpre = 8 weeks (baseline adherence, baseline engagement score, goal category, and tenure). We exclude users with fewer than 21 active days in the pre-period to reduce noise from immediate dropouts. Outcomes. Over Wpost = 11 weeks post-intervention, the AI-enabled cohort shows higher daily check-in adherence (0.74 vs. 0.48) and higher relative engagement (EngIndex 1.33 vs. 0.90). Unless otherwise noted, Table VII reports postperiod means computed over the 11-week outcome window. Pre-period balance checks and pre/post change estimates are provided in the artifact. Among users with recorded weights in both periods (Nwt = 1100), average weight loss is 5.2 kg in the AI-enabled cohort versus 3.1 kg in the static cohort. Why baseline adherence differs from Table VI. The population-level baseline (0.35) includes early dropouts. The matched window excludes early dropouts by construction, so baseline adherence in this restricted sample is higher.
J. Privacy and Security Validation We validate privacy claims against the threat model. Under exposure simulation (T1), operational data remains nonactionable for re-identification without access to the controlled mapping boundary and cryptographic keys (Eqs. 2–4). Penetration testing of the PII vault detected no unauthorized access, and data exposure simulations confirmed that pseudonymized tokens could not be reversed without vault authorization and keys. After transparency disclosures explaining PRISM boundaries, 92% of surveyed users reported confidence in platform privacy protections. De-identification leakage audit. We sampled nsamples = 1200 assistant prompts/outputs uniformly over the matched window and re-ran the same detection rules used in Algorithm 1. We observed LeakRate = 0.17 % ( 2/1200 residual identifier hits ). Both residual hits were due to user selfdisclosure in free-text signatures; no emails, phone numbers, or addresses were observed. Population-level pre/post definition. For Table VI, “Pre” denotes the production period immediately before PRISMCoach deployment (legacy identity-handling and static grouping), and “Post” denotes the period after full PRISM-Coach
TABLE VI P OPULATION - LEVEL OUTCOMES BEFORE VS . AFTER PRISM-C OACH DEPLOYMENT ( TELEMETRY AND SURVEYS )
Metric
Pre
Post
Change
Daily check-in adherence (teleme-0.35 try; Eq. 13) Engagement index (telemetry; Eq.1.00 15) Perceived benefit (survey; positive) – Privacy confidence (survey; posi-– tive)
0.68
+0.33
1.35
+35%
82% 92%
– –
TABLE VII M ATCHED 19- WEEK COMPARISON WINDOW: STATIC GROUPING VS . AI- ENABLED WORKFLOW. F OR E NG I NDEX , WE ALSO SHOW THE IMPLIED RELATIVE CHANGE ((EngIndex − 1) × 100) AND REPORT THE NET CHANGE IN PERCENTAGE POINTS ( PP ).
Metric
Static
Daily check-in adherence (teleme-0.48 try) Average weight loss (kg) 3.1 Engagement index (post/pre; Eq.0.90 15) (−10%)
AIenabled
Difference
0.74
+0.26
5.2 1.33 (+33%)
+2.1 +43 pp
rollout. We compute each metric over all eligible userdays/weeks in the corresponding period; the artifact reports the exact calendar ranges and denominators. XI. F UTURE W ORK Future work will evaluate generalization beyond lifestyle coaching to chronic disease management (e.g., diabetes, hypertension). This includes integrating condition-specific constraints and coaching protocols, adapting group formation to disease-specific support needs, and expanding fairness audits to ensure that adaptive assignment does not systematically disadvantage new or low-activity users. XII. E THICAL , S OCIAL , AND S TAKEHOLDER I MPLICATIONS Socio-technical wellness platforms warrant explicit discussion of autonomy, group dynamics, fairness, and trust. PRISMCoach mitigates over-reliance by keeping AI assistive and requiring coach review for outgoing messages. It mitigates group harm through stability constraints, eligibility thresholds that reduce inactive cohorts, and moderation pathways. It addresses fairness by auditing outcomes across goal categories and engagement strata and by exposing coach-facing rationales for assignments. Finally, it treats privacy as trust infrastructure: user-facing transparency disclosures and auditable restoration boundaries are necessary for adoption. XIII. D ISCUSSION AND L IMITATIONS PRISM-Coach advances beyond a descriptive system narrative by making three elements explicit and testable: (i) privacy
as a boundary model with controlled mapping and governance, (ii) adaptive assignment as a constrained contextual bandit with measurable reward signals, and (iii) stakeholder-centered integration of assistive AI with human oversight. Limitations include deployment confounders (seasonality, evolving coaching practice), potential self-report bias in userreported outcomes and weight, and residual inference risk from behavioral traces even under pseudonymization. These limitations motivate stronger quasi-experimental designs, expanded fairness audits, and differential privacy for cohort analytics exports. Sustained adherence is also economically relevant, as obesity is associated with substantially higher medical expenditures, especially for obesity-linked conditions such as diabetes [20]. A. Answers to Research Questions RQ1 (privacy boundaries enable learning without PII/PHI exposure to AI). RQ1 is answered by the PRISM multi-view boundary design (Identity, Operational, Learning, Coaching) and the enforced rule that AI components consume only Learning-view features and Coaching-view de-identified summaries (Section V). The threat model and mitigations specify how leakage via operational compromise, insider misuse, and AI integration is constrained through vault separation, controlled restoration, RBAC+MFA, and prompt deidentification (Table IV; Algorithm 1). We evaluate these controls through exposure simulation and user-reported privacy confidence (Section X-J; Table VI). RQ2 (adaptive assignment improves adherence/engagement under real constraints). RQ2 is answered by the constrained contextual bandit formulation and policy that filters candidate groups under capacity, stability, and eligibility constraints (Section VI; Eq. 8–10; Algorithm 2). Evidence appears in telemetry outcomes summarized before vs. after deployment (Table VI) and in a matched comparison window against static grouping (Section X-G; Table VII). We treat these findings as associations under a quasiexperimental design and acknowledge remaining confounders in Section X-C. RQ3 (human-in-the-loop AI improves coaching throughput/experience without weakening privacy). RQ3 is answered by the bounded assistant workflow: templated deidentified inputs, prohibition of diagnosis/prescribing language, mandatory coach review, and audit logging (Section VIII). Evidence includes coach-judged utility metrics for suggestions (Section X-I; Table V) alongside the privacy constraint that the assistant never accesses Identity-view data (Section V). XIV. C ONCLUSION We presented PRISM-Coach, a stakeholder-centered systems architecture and adaptive peer-group assignment method for digital lifestyle coaching at scale. PRISM enforces four bounded views Identity, Operational, Learning, and Coaching that support learning-driven personalization while minimizing
PII/PHI exposure to AI components. In a three-year realworld evaluation with approximately 2,800 users, PRISMCoach improved adherence, engagement, perceived benefit, and privacy confidence while maintaining enforceable governance boundaries. The results support PRISM-Coach as a practical blueprint for privacy-preserving, stakeholder-centered learning health systems in everyday wellness. XV. A RTIFACT AVAILABILITY AND R EPRODUCIBILITY We provide access to an anonymized artifact package accompanying this paper at the following archive: Artifacts: https://doi.org/10.5281/zenodo.18518472 The archive contains de-identified datasets, analysis scripts, and reference implementations to reproduce the paper’s results under the stated privacy boundaries, while excluding raw PII/PHI and production details. R EFERENCES [1] G. Eysenbach, “The law of attrition,” Journal of Medical Internet Research, vol. 7, no. 1, p. e11, 2005. [2] E. McCallister, T. Grance, and K. Scarfone, “Guide to protecting the confidentiality of personally identifiable information (pii),” National Institute of Standards and Technology, Tech. Rep. NIST Special Publication 800-122, 2010. [Online]. Available: https://nvlpubs.nist.gov/ nistpubs/Legacy/SP/nistspecialpublication800-122.pdf [3] European Union Agency for Cybersecurity (ENISA), “Pseudonymisation techniques and best practices: Recommendations on shaping technology according to data protection and privacy provisions,” Nov. 2019. [Online]. Available: https://www.enisa.europa.eu/sites/default/ files/publications/Guidelines%20on%20shaping%20technology% 20according%20to%20GDPR%20provisions.pdf [4] ISO/IEC, “Iso/iec 20889:2018 — privacy enhancing data deidentification terminology and classification of techniques,” 2018. [Online]. Available: https://www.iso.org/standard/69373.html [5] L. Li, W. Chu, J. Langford, and R. E. Schapire, “A contextual-bandit approach to personalized news article recommendation,” in Proceedings of the 19th International Conference on World Wide Web (WWW). ACM, 2010, pp. 661–670. [6] R. S. Sutton and A. G. Barto, Reinforcement Learning: An Introduction, 2nd ed. Cambridge, MA: MIT Press, 2018. [7] K. Ufholz, “Peer support groups for weight loss,” Current Cardiovascular Risk Reports, vol. 14, no. 8, p. 19, 2020. [8] C. L. Yeo, M. Suliman, C. Kim, J. Savage, D. Barker, J. Shen, A. F. Ó Donnchadha, A. Bhardwaj, E. Van Loon, A. Schulte, S. Kazantzis, and M. D. Fullana, “The effects of digital peer support interventions on health-related behavioral, psychosocial, and clinical outcomes: a systematic review and meta-analysis,” Psychological Medicine, 2025. [9] T. Dave, S. A. Athaluri, and S. Singh, “Chatgpt in medicine: an overview of its applications, advantages, limitations, future prospects, and ethical considerations,” Frontiers in Artificial Intelligence, vol. 6, p. 1169595, May 2023. [10] Y. Chen and P. Esmaeilzadeh, “The potential use of generative artificial intelligence in healthcare: Viewpoint,” Journal of Medical Internet Research, vol. 26, p. e53008, 2024. [Online]. Available: https://www.jmir.org/2024/1/e53008/ [11] World Health Organization, “Ethics and governance of artificial intelligence for health: Who guidance,” 2021. [Online]. Available: https://www.who.int/publications/i/item/9789240029200 [12] National Institute of Standards and Technology, “Artificial intelligence risk management framework (ai rmf 1.0),” NIST AI 100-1, 2023. [Online]. Available: https://doi.org/10.6028/NIST.AI.100-1 [13] C. Dwork, “Differential privacy,” in Automata, Languages and Programming (ICALP). Springer, 2006, pp. 1–12. [14] N. Mani and S. Attaranasl, “A privacy-preserving system for ai-powered dynamic group assignment, behavioral insights, and personalized coaching,” in Proceedings of the 23rd IEEE/ACIS International Conference on Software Engineering, Management and Applications (SERA 2025), Las Vegas, NV, USA, 2025.
[15] N. Mani and S. Attaranasl, “Self-healing digital twins: Hybrid generative and privacy-preserving ai for adaptive wellness platforms,” in Proceedings of the ACM/IEEE International Conference on Connected Health: Applications, Systems and Engineering Technologies (CHASE 2025), Manhattan, New York City, USA, Jun. 2025. [16] N. Mani and S. Attaranasl, “Adaptive test healing using llm/gpt and reinforcement learning,” in Proceedings of the 5th International Workshop on Artificial Intelligence in Software Testing (AIST 2025), co-located with the 18th IEEE International Conference on Software Testing, Verification and Validation (ICST 2025), Naples, Italy, 2025. [17] S. Sai, A. Gaur, R. Sai, V. Chamola, M. Guizani, and J. J. P. C. Rodrigues, “Generative AI for transformative healthcare: A comprehensive study of emerging models, applications, case studies, and limitations,” IEEE Access, vol. 12, pp. 31 078–31 106, 2024. [18] Institute of Medicine, Best Care at Lower Cost: The Path to Continuously Learning Health Care in America. Washington, DC: The National Academies Press, 2013. [19] C. P. Friedman, J. C. Rubin, J. S. Brown et al., “Toward a science of learning systems: A research agenda for the high-functioning learning health system,” Journal of the American Medical Informatics Association, 2015. [20] J. Cawley and C. Meyerhoefer, “The medical care costs of obesity: An instrumental variables approach,” Journal of Health Economics, vol. 31, no. 1, pp. 219–230, 2012.