With the UK government releasing a contact tracing app for England and Wales, many people are concerned about what this means for their personal privacy.

It's unnerving to think of the government tracking you through an app on your smartphone. But as we'll explain below, the NHS COVID-19 app can't track your location and doesn't save any personal information about you.

How Does the NHS Contact Tracing App Work?

Contact tracing in the NHS COVID-19 app works using Bluetooth. By measuring the Bluetooth signal strength between two smartphones, the NHS app can tell when you come into close contact with someone else who is also using the app.

When this happens, both smartphones exchange a randomly generated ID code over Bluetooth and assign it a score. This score varies based on how close you were to that person and for how long. The higher the score, the more likely you were to transmit coronavirus from one person to the other, if one of you was infected at the time.

If you come into contact with that person later on the same day, your smartphones exchange the same codes again and add more points to the score.

Your smartphone generates a new random ID code each day; so it's not possible for someone to track your contacts from day to day by looking at the codes on your device.

When someone reports a positive test result for coronavirus, their smartphone uploads all the recent ID codes it has generated to a UK government server. It doesn't upload the list of codes it collected from other people's devices.

The NHS COVID-19 app on other people's smartphones then checks these codes against the devices it has come in contact with. If it finds a match, and the score was high enough to suggest a possible transmission, the app sends an alert telling that user to self-isolate and book a test.

At no point does the NHS app share any information with the government or anyone else about which codes it matched, keeping your privacy secure.

Every code in the NHS app is also encrypted, making it impossible for someone else to access them on your device without knowing your passcode. And the app deletes each code after 14 days.

Can the NHS COVID-19 App Track My Location?

Because the NHS COVID-19 app uses Bluetooth for contact tracing, it doesn't need to track your location. In fact, the app can't use any location tracking features on your smartphone.

What About Local Alerts?

You can choose to enter the first half of your postcode to receive local coronavirus alerts, but the app doesn't use location tracking to verify this. That's why the postcode doesn't change as you move around the country.

Although it's possible to narrow down your location from the first half of your postcode, each region typically covers an average of 8,000 families. So there's little chance of anybody identifying you from it.

What About QR Code Check-Ins?

The NHS COVID-19 app gives you the ability to check in at different places by scanning a QR code poster. Scanning a QR code doesn't share any information about you, your device, or your location with anyone.

This is different in Wales, where you still need to enter personal contact details when you check in somewhere.

After scanning a QR code, the NHS app adds that place to a digital diary on your device. If a coronavirus outbreak is later confirmed at a place in your digital diary, the app sends you an alert to let you know.

Alerts in the NHS COVID-19 App Are Totally Anonymous

If you receive an alert from the NHS COVID-19 app, there is no way for you to find out who triggered it. Similarly, if you report a positive test result in the NHS COVID-19 app, triggering alerts for other people, there is no way for them to trace the alert back to you.

This is because alerts are triggered using the random ID codes the NHS app generates each day. Even the UK government can't identify who sent or received an alert.

This is much more private than a human track and trace system, which relies on personal information about you, your whereabouts, and your recent contacts.

What Data Does the NHS COVID-19 App Save?

The NHS COVID-19 app saves very little identifiable information about you. It can't track your location or access other data on your smartphone, such as your messages or contacts.

The NHS COVID-19 app doesn't even know your name.

What the app does keep a log of is timestamped ID codes from other people you have come into close contact with. But since these codes are randomly generated, it is incredibly difficult---if not impossible---to link them back to anyone.

The app also saves the first half of your postcode. But as we already explained, these regions typically cover an average of 8,000 families in the local area.

If you choose to book a test through the NHS COVID-19 app, it redirects you to an external website that asks for your name and address. But none of this information comes back to the app.

All of this comes in stark contrast to the information you share with social media apps, most of which request access to your contact details, your date of birth, your address book, your photos, and your current location.

Can I Delete My Data From the NHS COVID-19 App?

You can delete all your data from the NHS COVID-19 app at any time. This removes your postcode, self-isolation alerts, and venue data.

To do so, open the NHS COVID-19 app and go to About this app > Manage my data then choose to Delete all my data. You can also delete all this data by uninstalling the app from your smartphone.

To delete any contact tracing data, you need to go to the settings on your smartphone itself. This is because the NHS COVID-19 app uses a system developed by Apple and Google for contact tracing.

On an Android smartphone, open the Settings and go to Google > COVID-19 Exposure Notifications > Delete random IDs > Delete.

On an iPhone, open the Settings and go to Exposure Notifications > Exposure Logging Status > Delete Exposure Log.

Why Should I Trust That the NHS COVID-19 App Is Secure?

It's not uncommon to distrust your government, so you may not believe that the NHS COVID-19 app is as secure as it claims to be. However, you can rest assured there are plenty of systems in place to ensure the safety and privacy of the app.

By using the Exposure Logging system developed by Apple and Google, contact tracing data is decentralized and stored securely on each person's device, rather than uploading to a central government server. This means contact tracing data is encrypted behind your smartphone's passcode.

Even if someone hacked the government's server, no-one could access your contact tracing data because it isn't on there.

The British government partnered with the National Cyber Security Centre to ensure it met a high privacy and security standard during app development. Apple and Google also independently reviewed the privacy of the app before making it available to download on their stores.

In case you still aren't convinced, the UK government made the full source code for the NHS COVID-19 app available to view on Github.

Why Should I Install the NHS COVID-19 App?

One of the most dangerous elements of COVID-19 is how easily it spreads. Contact tracing apps can't help people after they get sick, but they can be a powerful weapon in reducing the spread of coronavirus infections.

By installing the NHS COVID-19 app, you'll find out quicker than ever if you came into contact with someone who tested positive for coronavirus. You can use this knowledge to self-isolate, protecting your loved ones and those around you in the process.