Anonymized statistics from health data with differential privacy