Flagship project / Engineering case study
Privacy-Preserving GeoAI
Health Surveillance
From governed surveillance data to explainable spatial intelligence.
I designed, implemented and evaluated a research prototype connecting data engineering, spatial analysis, risk classification, explainability and controlled access. The aim: help public-health teams interpret district-level surveillance evidence without overstating what a model can tell them.
My role System design, data engineering, spatial analysis, modelling, API and dashboard implementation, deployment demonstration, and evaluation.
01 / Problem
More than a risk score.
Surveillance records need to become geographically meaningful evidence: where disease burden is concentrated, which districts warrant closer review, and what influences a model’s estimates. That requires dependable data preparation, distinct analytical views, interpretable outputs and accountable access—not just an algorithm.
The study combined authorised, de-identified COVID-19 records from NPHIL with census population, administrative boundaries, CHIRPS rainfall and NASA POWER temperature data. District-level aggregation reduced disclosure risk while retaining a useful reporting geography.
02 / Architecture
One system. Clear evidence boundaries.
The frozen master diagram separates the implemented prototype, the separately validated PostGIS extension, demonstrated deployment and proposed production capabilities.
Read the two analytical paths separately. SHAP explains model predictions. Observed-incidence hotspots describe patterns in recorded disease burden; hotspots calculated from model probabilities describe a different analytical object. Neither should be mistaken for the other.
03 / What I built
Engineering the complete workflow.
A governed data foundation
Validated dates, reconciled district assignments, harmonised spatial data and constructed a complete district-month panel. Lagged predictors used preceding observations. The evaluated prototype used CSV, GeoJSON and audit-log files.
PostgreSQL/PostGIS was separately configured and validated for ingestion, SQL queries, spatial geometry and ArcGIS/Python interoperability—not presented as the public prototype’s primary backend.
Spatial intelligence and explainability
Compared Logistic Regression, Random Forest and XGBoost; implemented Moran’s I, exploratory LISA and Getis–Ord Gi* analyses; and connected global and district-month SHAP explanations to risk interpretation.
Observed burden, relative-risk rankings and model-derived hotspot evidence remain distinct in the decision-support narrative.
Controlled analytical delivery
Integrated FastAPI, JWT authentication, analyst/administrator permissions, protected endpoints and audit-event generation with a Streamlit/Folium interface.
Demonstrated Docker, AWS EC2 and Streamlit Community Cloud deployment while documenting the remaining transport-security and operational limitations.
Data lineage 8,018 operational records → 4,896 district-month observations → 4,760 modelling observations after lag exclusion. Nine predictors; 150 positive observations (3.15%) under a study-specific five-case threshold.
04 / Evaluation
Test the system—and the assumptions.
Dissertation / Evaluated prototype
Internal comparison and multidimensional evaluation
A stratified 70:30 random district-month split compared three models. The comparison partition contained 1,428 observations, including 45 positives; all districts appeared in both fitting and comparison partitions.
Evaluation also covered case-history ablation, spatial inference, SHAP stability, functional governance controls and a preliminary usability study with 14 participants.
Post-dissertation / Additional validation
Geographic separation, later periods and uncertainty
A protocol locked before execution specified five-fold district-grouped validation and a 15-month later historical holdout, with 12- and 18-month sensitivity checks.
Added calibration assessment and 95% intervals using 2,000 district-cluster bootstrap resamples. These publication-stage analyses supplement—not replace—the assessed dissertation evidence.
05 / Results
Useful discrimination. Important limits.
| Evidence stage | Evaluation design | ROC-AUC | Recall | F1 |
|---|---|---|---|---|
| Original dissertation | Internal random district-month comparison | 0.920 | 0.422 | 0.535 |
| Post-dissertation | Five-fold district-grouped validation | 0.894 | 0.200 | 0.291 |
| Post-dissertation | 15-month later historical holdout | 0.914 | 0.326 | 0.394 |
Model choice depends on the question. XGBoost offered the strongest recall/F1 balance in the original comparison. Logistic Regression achieved higher F1 in both later validation designs; XGBoost retained the highest ROC-AUC in those designs.
Ranking is not calibrated absolute risk. XGBoost recalibration slopes of 0.498 (grouped) and 0.525 (temporal) indicated overly extreme probabilities. Temporal classification intervals were wide, with only 43 positives in the primary holdout.
Spatial and usability evidence are also bounded. Five of ten unadjusted observed-incidence hotspots remained after false-discovery-rate correction. Fourteen participants provided positive preliminary usability feedback, but the later refined dashboard was not formally re-evaluated.
Source: dissertation model-comparison results; Paper 1 v1.2, Table 7; Supplementary File S2 v1.1. Results are reported from the research documents, not recalculated by this portfolio.
06 / Security & governance
Controls with explicit boundaries.
Privacy-aware design combined de-identification, data minimisation and district aggregation with authenticated access and auditability. Aggregation reduces disclosure risk; it does not establish anonymity or regulatory compliance on its own.
- Unauthenticated requests returned HTTP 401.
- An analyst attempting an administrator-only resource received HTTP 403.
- Authorised requests returned protected outputs; audit events recorded relevant roles, actions and timestamps.
These were scenario-based functional tests—not penetration testing, security certification or evidence of tamper-proof logging. SHAP explains associations, not causality; model outputs support rather than replace expert review.
07 / Deployment evidence
Demonstrated delivery.
Not production assurance.
Docker, AWS EC2 and Streamlit Community Cloud demonstrated deployment feasibility and portability. PostgreSQL/PostGIS functionality was separately validated. The hybrid architecture describes logical governance and analytics zones, not verified production network isolation.
The dashboard used HTTPS. The direct-IP EC2 API used HTTP during prototype testing, so production-grade API transport protection remained a limitation. The architecture makes that distinction visible.
08 / Limitations
What the evidence does not establish.
- External or prospective validity. Later tests remain internal to the same historical, single-country and single-disease dataset. District grouping does not impose buffers between neighbouring districts.
- Absolute outbreak risk. The five-case target is study-specific, the positive class is rare, and raw probabilities require further calibration and decision-utility evaluation.
- Causal explanations or universal spatial patterns. SHAP is associative. LISA is exploratory, and hotspot findings depend on neighbourhood and multiple-testing choices.
- Operational readiness or sustained adoption. No production-scale resilience, load, failover or adversarial-security evaluation was established. Preliminary usability findings do not demonstrate long-term adoption or improved health outcomes.
09 / Production pathway — proposed
The next engineering work.
These are development priorities, not capabilities claimed by the evaluated prototype.
Strengthen analytical validation
Repeated temporal and spatial-block evaluation, external and prospective studies, recalibration, subgroup assessment and decision-utility analysis.
Harden the platform
Production API TLS, managed secrets, independent security testing, access review, audit retention and resilience testing.
Develop operational workflows
Automated ingestion and scheduled refresh, scalable processing where justified, telemetry and drift monitoring, plus longitudinal practitioner evaluation.
10 / Repository & demonstration
Inspect the work.
The repository and interactive demonstration complement this case study. The demo is a research interface, not a live operational surveillance service.
Evidence and version notes
This narrative draws on the 2026 MSc dissertation (including its limitations and PostGIS appendix), the Paper 1 coauthor-review manuscript v1.2, and Supplementary Files S1 and S2 v1.1. Post-dissertation validation is identified separately throughout. The manuscript is not presented here as a published peer-reviewed article.
The original assessed artefact is preserved in the repository under dissertation-final-v1.1. Restricted surveillance records and the supplied review documents are not redistributed on this page.