Gravar-mail: Protecting patient privacy in survival analyses