NHS COVID-19 app: your data and privacy
Read about the steps we've taken to make sure the NHS COVID-19 app protects your privacy and identity.
Applies to England and Wales
Protecting your privacy and security
Privacy and data security are crucial to the UK Health Security Agency (UKHSA) and the government. Every day, people trust us with their personal data and we take this responsibility very seriously. It’s at the heart of our relationship with the people we serve. Because of this, we’ve taken steps to make sure the NHS COVID-19 app protects your privacy and identity.
The NHS COVID-19 app protects your privacy and identity from other app users and their privacy and identity from you. The app uses random IDs that cannot be used by the NHS or the government to identify who you are, or who you’ve spent time with.
The app cannot:
- use your GPS location or track where you have been
- be used to check or monitor if you’re staying at home
- be used by law enforcement to identify or track you
- see personal information on your phone, such as your messages, address book or your phone contacts
NHS COVID-19 app: protecting your privacy
How the app uses data
It is always your choice to use the app. If you do, it will share a limited amount of anonymised data with UKHSA.
You need to enter the first part of your postcode (known as your postcode district), and your local authority.
Read more about how we use your postcode district and local authority.
The data collected by the app is stored on your phone. Any data you share with UKHSA is used to help us:
- learn more about coronavirus (COVID-19) to support health services, such as your local hospital – for example, this could help to give them up-to-date information about COVID-19 in your area
- provide advice to you based on your situation (for example, when you have been near another app user who has later tested positive for COVID-19)
- provide advice to the public
- improve and monitor the effectiveness of the app
For contact tracing to work, the NHS COVID-19 app uses technology developed by Apple and Google called ‘exposure notification’ and ‘exposure logging’. This technology allows the app to send you alerts, using random IDs, when you’ve been near another app user who later tested positive for COVID-19.
This technology has been developed to find people you’ve been near while protecting your privacy and identity.
The app uses this data to work out:
- how near you were to other app users during this time
- how much time you may have spent near another app user
The app uses the strength of the Bluetooth signal to work out how near app users are to each other.
If you test positive for COVID-19, you will be asked if you want to share this data. Without ever sharing who you are, we can alert other app users that they are at risk of COVID-19 because they’ve spent time near someone who has tested positive.
Deleting the app
If you choose to delete the app, all app data on your phone is deleted. Please note that you will not receive any notifications from the app about COVID-19. You can always delete all data held with the app (from the settings menu).
Safe, secure and compliant
Experts from across the UK government and industry have reviewed our design and helped us test and improve the app. Specialists from the National Cyber Security Centre were involved to make sure it is safe and secure to use. The app is also subject to Apple and Google’s privacy standards and review.
We will always make sure the app is compliant with data protection law and meets the standards expected for data security and confidentiality.
Contact tracing data stays on your phone until you choose to submit it. Nobody can track you, your movements or who you have been in contact with, including other app users.
The UKCA mark
The NHS COVID-19 app has the UK Conformity Assessed (UKCA) mark and shows that a medical device is fit for its intended purpose and meets the necessary safety requirements.
Data stored in the app
Some data collected by the NHS COVID-19 app is stored on your phone. You can see what app data is held on your phone by selecting ‘Settings’ on the home screen of your app.
Area data
When you first download the NHS COVID-19 app, you’ll be asked to enter your postcode district, which is the first part of your postcode. On average, this covers around 8,000 households, so anonymity is preserved. If your postcode district covers more than one local authority area, the app will ask you which local authority you live in. This is so the app can give you the most accurate information for your area.
Other data
What you see in the ‘Other’ data section depends on how you have been using the app.
Last applicable test result
This section lists the test date, result and kit type. Kit types include the following.
1. RAPID_SELF_REPORTED
This indicates that you had a rapid lateral flow test.
From app version 5.0, this includes any positive lateral flow test result, whether from an NHS or paid-for test.
2. LAB_RESULT
This indicates that you had a PCR test.
Last day of self-isolation
This indicates the last day of your advised stay-at-home period.
Countdown timer
If you’ve entered a positive test result or symptoms in the app, you may be advised by the NHS COVID-19 app to try to stay at home. If you entered a positive result, the app will provide a countdown timer so you can keep track of this.
When you reach the end of your stay-at-home period, the app will send you a notification with a link to the latest advice for you.
Symptoms information
If you’re entering a positive test result and you are not in a stay-at-home period, you will be asked for the date when your symptoms started. This is the date that’s shown here. If you said that you cannot remember when your symptoms started, the app will record it as the same day as your test date. This information helps the countdown timer to work.
Exposure notification
If you have been in close contact with an app user who has later tested positive for COVID-19 and chosen to share this result anonymously, the NHS COVID-19 app will send you an alert. The information in this section helps the countdown timer to work.
Encounter date
The encounter date tells you the date you were in contact with the person who tested positive. It is likely that they did not know they had COVID-19 at the time, and only received a positive test result later.
Notification date
This is the date that you received an alert on your phone to tell you that you’d been in close contact with someone who later tested positive for COVID-19.
Transparency
As part of our commitment to transparency (that is, clear and honest communications), you can view the:
- privacy notice, including young people and easy read versions
- Data Protection Impact Assessment (DPIA)
- terms of use
- source code for the app backend system
- source code for the Apple iOS app
- source code for the Google Android app
Updates to this page
Published 13 May 2022Last updated 28 March 2023 + show all updates
-
Added notice explaining that the app will be closing down on 27 April.
-
Updated information on how the app uses data.
-
Updated to reflect the app version 5.0 changes.
-
Added video about the NHS COVID-19 app and protecting your privacy.
-
Added Welsh version.
-
First published.