Sort:  

It isn't easy! The only way to hide receiver is for receiver to scan all messages. Sender cannot be hidden due to bandwidth enforcement.

Yeh gareth was explaining to me it would it would make it impossible to automatically reconstruct our database from the blockchain though unless we encrypt the "to" field using our own key. He said "it'll take a bit of time to engineer into a proper solution, but the basic trick is to allow each user to store an arbitrary block of data in our database, encrypted - and with deduplication"