Human-beings are suffering from the rapid spread of COVID-19 throughout the world. In order to quickly identify, quarantine and cure the infected people, and to stop further infections, it is crucial to expose those origins who have been infected but are asymptomatic. However, this task is not easy, especially when the rigid security and privacy constraints on health records are taken into consideration. In this paper, we develop a new method to solve this problem. In the outbreak of a disease like COVID-19, the proposed method can find hidden infected people (or communities) through volunteered share of health data by some mobile users. Such volunteers only reveal whether they are healthy or infected e.g. through they mobile apps. This approach minimises health data disclosure and preserves privacy for the others. There are three steps in the proposed method. First, we borrow the idea from traditional epidemiology and design a novel algorithm to estimate the number of infection origins based on a Susceptible-Infected model. Second, we introduce the concept of 'heavy centre' to locate those origins. The probability of each node being infected will then be derived by building a spreading model based on the origins. To evaluate our method, we conduct a series of experiments on various networks with different structures. We examine the performance in estimating the number of origins as well as their origins. The results show that the proposed method yields higher accuracies than the existing methods, even when the fraction of volunteers is small.