In an example, a plurality of segments of percentile information indicating submitted confidential data values from users matching at least one attribute of a submitting user are retrieved. Then, for each of the segments, an interquartile range is calculated for a first and a second of a plurality of percentiles in the segment, an initial lower limit is computed for the segment by taking a maximum of zero or the difference between the value for the first of the plurality of percentiles and a product of a preset alpha parameter and the interquartile range, and interpolation is performed on values for the plurality of percentiles for the segment to obtain values for a third percentile. The initial lower limits and the interpolated values for the third percentiles are aggregated across the segments. A merged lower limit is determined by applying a function to the aggregated initial lower limits and aggregated interpolated values.