NHS COVID-19 app: your data and privacy

Protecting your privacy and security

Privacy and data security are crucial to the UK Health Security Agency (UKHSA) and the government. Every day, people trust us with their personal data and we take this responsibility very seriously. It’s at the heart of our relationship with the people we serve. Because of this, we’ve taken steps to make sure the NHS COVID-19 app protects your privacy and identity.

The NHS COVID-19 app protects your privacy and identity from other app users and their privacy and identity from you. The app uses random IDs that cannot be used by the NHS or the government to identify who you are, or who you’ve spent time with.

The app cannot:

• use your GPS location or track where you have been
• be used to check or monitor if you’re self-isolatingstaying at home
• be used by law enforcement to identify or track you
• see personal information on your phone, such as your messages, address book or your phone contacts

NHS COVID-19 app: protecting your privacy

How the app uses data

It is always your choice to use the app. If you do, it will share a limited amount of anonymised data with UKHSA.

You need to enter the first part of your postcode (known as your postcode district), and your local authority.

Read more about how we use your postcode district and local authority.

The data collected by the app is stored on your phone. Any data you share with UKHSA is used to help us:

• learn more about coronavirus (COVID-19) to support health services, such as your local hospital – for example, this could help to give them up-to-date information about COVID-19 in your area
• provide advice to you based on your situation (for example, when you have been near another app user who has later tested positive for COVID-19)
• provide advice to the public
• improve and monitor the effectiveness of the app

For contact tracing to work, the NHS COVID-19 app uses technology developed by Apple and Google called ‘exposure notification’ and ‘exposure logging’. This technology allows the app to send you alerts, using random IDs, when you’ve been near another app user who testslater tested positive for COVID-19.

This technology has been developed to find people you’ve been near while protecting your privacy and identity.

The app uses this data to work out:

• how near you were to other app users during this time
• how much time you may have spent near another app user

The app uses the strength of the Bluetooth signal to work out how near app users are to each other.

If you test positive for COVID-19, you will be asked if you want to share this data. Without ever sharing who you are, we can alert other app users that they are at risk of COVID-19 because they’ve spent time near someone who has tested positive. If you’ve been in close contact with users of the Northern Ireland, Jersey or Gibraltar contact tracing apps, these users will also be alerted that they’re at risk of COVID-19. This is done using the same technology that alerts NHS COVID-19 app users in England and Wales.

Deleting the app

If you choose to delete the app, all app data on your phone is deleted. Please note that you will not receive any notifications from the app about COVID-19. You can always delete all data held with the app (from the settings menu).

Safe, secure and compliant

Experts from across the UK government and industry have reviewed our design and helped us test and improve the app. Specialists from the National Cyber Security Centre were involved to make sure it is safe and secure to use. The app is also subject to Apple and Google’s privacy standards and review.

We will always make sure the app is compliant with data protection law and meets the standards expected for data security and confidentiality.

Contact tracing data stays on your phone until you choose to submit it. Nobody can track you, your movements or who you have been in contact with, including other app users.

The UKCA mark

The NHS COVID-19 app has the UK Conformity Assessed (UKCA) mark and shows that a medical device is fit for its intended purpose and meets the necessary safety requirements.

Data stored in the app

Some data collected by the NHS COVID-19 app is stored on your phone. You can see what app data is held on your phone by selecting Settings‘Settings’ on the home screen of your app.

Area data

When you first download the NHS COVID-19 app, you’ll be asked to enter your postcode district, which is the first part of your postcode. On average, this covers around 8,000 households, so anonymity is preserved. If your postcode district covers more than one local authority area, the app will ask you which local authority you live in. This is so the app can give you the most accurate information for your area.

Other data

What you see in the ‘Other’ data section depends on how you have been using the app.

Last applicable test result

YouThis cansection enterlists athe positive lateral flow test date, result intoand thekit apptype. byKit usingtypes include the 8-digitfollowing.

1. testRAPID_SELF_REPORTED

This codeindicates generatedthat when you reportedhad thea resultrapid intolateral GOV.UKflow test.

ThisFrom sectionapp alsoversion lists5.0, thethis includes any positive lateral flow test kitresult, type.whether from an NHS or paid-for test.

RAPID_SELF_REPORTED2. LAB_RESULT

This indicates that you had a rapidPCR swabtest.

Last testday thatof youself-isolation

This administeredindicates yourself.the Forlast example,day ifof youyour tookadvised thestay-at-home test at home.period.

Countdown timer

If you’ve recentlyentered testeda positive ortest haveresult registeredor symptoms in the app, you may be advised by the NHS COVID-19 app to try to stay at home. TheIf you entered a positive result, the app will provide a countdown timer so that you can keep track of this.

When you reach the end of your staystay-at-home at home period, the app will send you a notification with a link to the latest advice for you.

Symptoms information

If youyou’re reportentering COVID-19a symptomspositive test result and you are not in thea app,stay-at-home period, you will be asked for the date when your symptoms started. This is the date that’s shown here. If you said that you cannot remember when your symptoms started, the app will record it as 2the dayssame beforeday youas entered your symptoms.test date. This information helps the countdown timer to work.

Exposure notification

If you have been in close contact with an app user who has later tested positive for COVID-19 and chosen to share this result anonymously, the NHS COVID-19 app will send you an alert. The information in this section helps the countdown timer to work.

Encounter date

The encounter date tells you the date you were in contact with the person who tested positive. It is likely that they did not know they had COVID-19 at the time, and only received a positive test result later.

Notification date

This is the date that you received an alert on your phone to tell you that you’d been in close contact with someone who later tested positive for COVID-19.

Transparency

As part of our commitment to transparency (that is, clear and honest communications), you can view the:

• privacy notice, including young people and easy read versions
• Data Protection Impact Assessment (DPIA)
• terms of use
• source code for the app backend system
• source code for the Apple iOS app
• source code for the Google Android app