  In the fight against Covid-19, many governments and businesses are in the
process of evaluating, trialling and even implementing so-called immunity
passports. Also known as antibody or health certificates, there is a clear
demand for any technology that could allow people to return to work and other
crowded places without placing others at risk. One of the major criticisms of
such systems is that they could be misused to unfairly discriminate against
those without immunity, allowing the formation of an `immuno-privileged' class
of people. In this work we are motivated to explore an alternative technical
solution that is non-discriminatory by design. In particular we propose health
tokens -- randomised health certificates which, using methods from differential
privacy, allow individual test results to be randomised whilst still allowing
useful aggregate risk estimates to be calculated. We show that health tokens
could mitigate immunity-based discrimination whilst still presenting a viable
mechanism for estimating the collective transmission risk posed by small groups
of users. We evaluate the viability of our approach in the context of
identity-free and identity-binding use cases and then consider a number of
possible attacks. Our experimental results show that for groups of size 500 or
more, the error associated with our method can be as low as 0.03 on average and
thus the aggregated results can be useful in a number of identity-free
contexts. Finally, we present the results of our open-source prototype which
demonstrates the practicality of our solution.
