Staged information exchange facilitated by content-addressable records indexed to pseudonymous identifiers by a tamper-evident data structure

A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:

• receiving, with a server system, via a network, a first query from a first computer system of an entity seeking to acquire information about users,
• wherein the first query comprises criteria specifying a first class of attributes of users;
• in response to the first query, accessing a first data repository and selecting a first subset of users from a set of users having information in the first data repository, wherein:
• first subset of users are selected based on the first subset of users having attributes that satisfy the criteria;
• and
• the first data repository comprises a plurality of user records each comprising:
• a respective pseudonymous user identifier, and
• a respective plurality of non-personally identifiable attributes of a respective user;
• receiving, with the server system, via the network, from the first computer system, data specifying a second query, wherein:
• the second query requests a second class of attributes of users, and
• the second class of attributes are more personally identifying among the set of users than the first class of attributes;
• based on selecting the first subset of users and receiving the data specifying the second query, sending, with the server system, via the network, to native-client-applications executing on user computing devices of at least some of the first subset of users, a request to obtain responses to the second query;
• receiving, with the server system, from the native-client-applications of a second subset of users among the first subset of users, approval to obtain responses to the second query;
• in response to receiving approval, adjusting, with the server system, respective scores associated with the second subset of users and providing responses to the second query to the first computer system, wherein at part of at least some of the responses to the second query are provided, at least in part, by:
• accessing a tamper-evident data structure that associates pseudonymous user identifiers of respective users with respective addresses of respective ciphertexts and selecting addresses in response to the respective addresses being associated in the tamper-evident data structure with respective pseudonymous user identifiers of at least some users in the second subset of users;
• retrieving ciphertexts identified by the selected addresses from a decentralized second data repository, the decentralized second data repository being different from the tamper-evident data structure and the first date repository;
• decrypting, to form plaintext records, respective ciphertexts with respective native-client-application instances executing on user computing devices of users among the second subset of users, wherein:
• different native-client-application instances have access to different encryption keys of different ones of the respective ciphertexts, and
• the server system does not have access to the encryption keys;
• and
• determining the at least part of the at least some of the responses to the second query with the plaintext records;
• and
• storing, with the server system, the adjusted scores in memory, wherein:
• the first computer system is not provided access to personally identifiable information of the plurality of users absent both permission from respective users and adjustments to scores of respective users.