Guidance

[Withdrawn] NHS COVID-19 app: privacy information for young people

Updated 28 March 2023

This guidance was withdrawn on

The NHS COVID-19 app closed down on 27 April 2023, so this content is out of date.

The app was managed by the UK Health Security Agency, which is an executive agency sponsored by the Department of Health and Social Care. From 27 April 2023, the app is no longer available and is no longer collecting data or providing a service to app users. This document broadly reflects the service provided by the app during its later stages.

Your data and privacy now the app has closed down

The data collected by the app, which cannot identify app users, will be held in line with the retention period set out in the Privacy Notice for the NHS COVID-19 app.

Find out why the app has closed down and where to find the latest guidance.

Tynnwyd y cyhoeddiad hwn yn ôl ar 27 Ebrill 2023

Caeodd ap COVID-19 y GIG ar 27 Ebrill 2023 felly nid yw’r cynnwys hwn bellach yn gyfredol.

Rheolwyd yr ap gan Asiantaeth Diogelwch Iechyd y DU, sy’n asiantaeth weithredol a noddir gan yr Adran Iechyd a Gofal Cymdeithasol.  O 27 Ebrill 2023, nid yw yr ap ar gael bellach ac nid yw yn casglu data na yn darparu gwasanaeth i ddefnyddwyr apiau bellach. Mae’r ddogfen hon yn adlewyrchu’n fras y gwasanaeth a ddarperir gan yr ap yn ystod ei gamau diweddarach.

Eich data a’ch preifatrwydd nawr mae’r ap wedi cau

Bydd y data a gesglir gan yr ap, na all adnabod defnyddwyr yr ap, yn cael ei gadw yn unol â’r cyfnod cadw a nodir yn yr Hysbysiad Preifatrwydd ar gyfer ap COVID-19 y GIG.

Darganfyddwch pam mae’r ap wedi cau a ble i ddod o hyd i’r canllawiau diweddaraf.

Applies to England and Wales

© Crown copyright 2023

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/nhs-covid-19-app-privacy-information/nhs-covid-19-app-privacy-notice-for-young-people

This privacy information document is a summarised version of the NHS COVID-19 app: privacy notice.

The NHS COVID-19 app

The NHS COVID-19 app (the app) helps support the fight against coronavirus. The app is provided by the UK Health Security Agency (UKHSA), which is an executive agency sponsored by the Department of Health and Social Care (DHSC, or “us” in this document) and is available in England and Wales. DHSC is the data controller when processing user personal data in connection with the app.

By using the app, you will be making an important contribution to your community by helping to save lives.

The app’s alerts now work across different countries: Gibraltar, Jersey, Northern Ireland and Scotland.

For more in-depth information see:

Your privacy

The app has been designed to respect and protect your privacy:

  • the government and other app users will never know who you are

  • you won’t need to give your name, age or address

  • your location cannot be tracked

  • you won’t be identified if you test positive for coronavirus

  • data held only in the app cannot be accessed by us

The app cannot:

  • be used to check if you should be isolating

  • use any other data on your phone (for example, your pictures or messages)

This privacy information will tell you more about how the app protects your and other app users’ privacy.

What data is collected

For its features to work, the app uses the following data:

  • the postcode district you provide when you install the app
  • the local authority you select when the app prompts you
  • any codes generated as part of digital contact tracing
  • the information you provide when checking symptoms
  • if needed to provide you with advice, your age as a young person (under the age of 18)
  • the details of venues that you have checked into (this information is only stored on your phone, not anywhere central)

Adults over the age of 18 can choose to declare their vaccine status.

The app automatically captures information that doesn’t identify you to make sure the app is working and to help fight coronavirus. For example, if you have coronavirus symptoms and use the symptom checker your app will summarise that interaction. This data is called the analytical data set.

This anonymous information helps to inform and improve:

  • the research and planning needed to respond to coronavirus
  • the safety and effectiveness of the app
  • the accuracy of public health related advice, information and support

An IP address (a unique identifier for your phone when you use the internet) is automatically used to pass information to us. We don’t use this IP address and delete it as soon as it arrives.

You can read more about what data is collected from your phone and how it is used.

Your data choices

When you first install the app, you’ll be asked to:

  • turn on Bluetooth

  • allow notifications

  • enter the first part of your home postcode before the space (for example, E12) and select your local authority

These are needed for the app to work, but you can change them at any time:

  • any data which could identify you is only ever stored on your phone

  • the app will never share this data with anyone else

If you choose to download and install the app, you can:

  • use parts of the app without sharing any data

  • remove or update any information you provide

  • delete and uninstall the app at any time

It’s your choice if you want to share data about you or not. If you do decide to share the data, health professionals will use it to learn more about the virus.

The app uses an automated process to offer advice. We recommend you show any app alerts to a responsible adult. If you have concerns about the advice being offered, contact NHS 111.

Applying for Test and Trace Support Payments

If you are contacted by NHS Test and Trace and told to self-isolate, you’re under a legal obligation to do so.

Financial support may be available to you during any period of self-isolation. Read details of how to apply for financial support

The NHS COVID-19 app allows for you to check if you are eligible for support payments. A button on the home screen will provide you with safe and secure access to the ‘Test and Trace Support Payment’ website (or the ‘Self-Isolation Support Scheme’ (SISS) Gateway portal, if you are in Wales). Here you can enter your information to see financial support is available to you.

Please note:

  • the app only provides access to the support payment websites
  • all applications for financial support are entirely private and confidential
  • those who apply for financial support will remain under the obligation to self-isolate even if found not eligible for the payment

The app cannot:

  • identify you from this data
  • check whether you are self-isolating
  • monitor whether you are keeping to the conditions of payment

Digital contact tracing

Contact tracing is a process for identifying people at risk of disease. Healthcare workers have traditionally used manual methods to undertake contact tracing by asking those infected to:

  • identify anyone that might have been in contact with the infected person

  • identify areas where the infection may be present (places they have visited)

Digital contact tracing is a new and effective method that uses smartphone technology to speed up the process.

The NHS COVID-19 app works by using technology developed by Apple and Google. This technology is known as the ‘Google Apple Exposure Notification system’ (GAEN). GAEN allows your phone to generate and share anonymous IDs with other enabled phones.

You can turn off Exposure Notification within your phone’s settings at any time.

This data is stored only on your phone and cannot be accessed by anyone unless you choose to share it. You will be asked if you want to share this anonymous data if you test positive for coronavirus.

You can read more about GAEN on the Apple or the Google websites.

Learning about and improving digital contact tracing

When anonymous IDs are shared, both phones record:

  • how much time the phones were near to each other
  • how strong the Bluetooth signal was between them (indicating how far apart the phones were from each other)
  • the risk score generated from these measurements

By updating your phone to the latest software from Apple and Google, if you test positive for COVID-19, you can share data with the NHS to help:

  • discover how digital contract tracing is working,
  • improve how the technology and analysis works

This includes helping to:

  • assess if the risk algorithm used is working
  • understand if the risk score (calculated from interactions) accurately reflects the risk of COVID-19
  • make sure the risk threshold is working as intended and set at an appropriate level
  • benefit public health by learning and improving the app and services performance and advice

To understand how the app can help you, see the ‘How the app will help you (digital contact tracing)’ section of the privacy notice.

Interoperability (apps from different countries being able to work together)

The Health Services in Gibraltar, Jersey, Northern Ireland, and Scotland provide digital contact tracing apps that are based on the same Google Apple technology as this app.

We are ensuring these apps can share a small amount of data with each other, to help make contact tracing more effective.

Already, if you test positive you can choose to alert the people you’ve been in contact with. Now you will also be able to alert users of the Gibraltar, Jersey, Northern Ireland, and Scotland apps that you might have been in contact with, as well as users of this app.

You can’t choose only to alert app users in England and Wales. But you can choose not to alert anyone at all.

The purpose of making apps work together like this is to make contact tracing work more effectively. It is particularly important for people who travel a lot between areas covered by two different apps – for example, England and Scotland.

If you travel to Gibraltar, Jersey, Northern Ireland, or Scotland and come into contact with an infected person, you will now be alerted. This will be particularly useful for people who live near a border, for example the border between England and Scotland.

In future our app may also be able to work with other countries’ apps beyond the UK. Then you will have this app’s contact tracing functions when you travel abroad as well as when you are at home in the UK. That function isn’t in place yet.

No data that could identify you is shared with any other country. No data is collected anywhere centrally about you. No data that could identify anyone else is shared with you.

How long information is held

Your phone will store app-related data for the following times:

  • test codes which link to a test result – 24 to 48 hours

  • daily codes used for contact tracing – 14 days

  • QR scans from venue check-ins – 21 days

  • if you add it, your declaration of age – the isolation period plus 14 days

These storage times have been agreed following scientific and medical advice. In the future, this may increase or decrease as the advice changes.

Any information which is held by the Department for Health and Social Care (DHSC) will not contain any personal data. These records will be retained for:

  • 8 years, to ensure the organisation is held to account

  • 20 years, to help continue monitoring diseases (such as coronavirus)

This is governed by the Section 46 Code of Practice, Public Records Act, and the statutory duties of the DHSC.

Read more information about the storage of your data

Security and compliance

The app does not collect or transfer any information which could identify you to anyone. This includes the government, authorities, the NHS, people and organisations who have contributed to the development of the app, or any other app user.

All necessary security measures, policies and procedures are in place to prevent:

  • anyone accessing or disclosing any data collected by the app

  • any loss or destruction of any data, either deliberate or accidental

This means the app is:

  • safe to use

  • secure and confidential

  • legally compliant

Read more about safety, security and compliance.

Your rights

You can always access your data in the app. Further information about ‘Managing my data’ is available. There is also an equivalent for the Welsh service.

By law, you have several rights in relation to your personal data, such as the right to access information held about you. Your rights, their applicability, and how they can be actioned are explained in this Test and Trace privacy notice.

Information about your rights and how to use them is available from the Information Commissioner’s Office.

Contact our Data Protection Officer (DPO)

The Department for Health and Social Care (DHSC) is legally responsible for deciding how and why your personal data is used. We are also responsible for making sure the data is safe and secure.

If you have any questions or are unhappy about how your information is being used in the app, contact the DHSC Data Protection Officer (DPO) at data_protection@dhsc.gov.uk.

Transparency

As part of our commitment to transparency, you can view the:

Read more about how we keep your data safe.

For more general information about coronavirus, visit the coronavirus page on GOV.UK.

Back to top