Privacy Policy - Easy Read

The “yes” answer when you first start to use the app (also known as your confirmation of app use)

When you download the app and you or your parent or guardian click “yes” to the question “Do you agree to continue and start using this app?” the app sends that answer to us.

This is for us to count the number of people who have started using the app. We will not be able to tell who is using the app.

Your IP address

Your IP address is a set of numbers assigned to your mobile phone. Your IP address is used to send small amounts of information from the app on your phone to us. The way it works is very technical, but this video explains how IP addresses work.

Your IP address is used to send the “yes” answer to us securely using the internet. We do not keep your IP address and will not be able to tell who is using the app. The app itself does not know or keep your IP address.

Your age group

When you first start to use the app, you will be asked to what age group you belong to. We ask this to give you the right information when you first start using the app.

Your test code, also known as your “authorisation code”.

Also known as your “authorisation code”. If you have tested positive for COVID-19, this is the code you can input into the app to allow your close contacts to receive an alert. Your test code is sent to you by text message.

Your mobile number

This is used so that your contact tracer can send your test code to you by text message. The app itself does not use or keep your mobile phone number.

If you don’t receive your test code within 24 hours you should contact the National Contact Tracing Centre or ask your parent or guardian to do so, as the Centre may have the wrong number and may need to send a new test code to you. If you are unsure what to do, you should ask your parent or guardian to do this for you.

Your estimated date of infection

This date is used to provide alerts only to those close contacts who have a risk of having caught COVID-19 from you depending on when they were in close contact with you.

Your diagnosis keys

As explained in this video, the app collects a small amount of information using Bluetooth technology when app users come into close contact with each other. This information is known as random IDs.

When you input your test code into the app, the app sends us random IDs so that those close contacts who have a risk of having caught COVID-19 can receive an alert. The random IDs sent to us are called “diagnosis keys” and they are used to provide the alerts to your close contacts. Neither you nor we are able to tell who the close contacts are.

We also anonymise your diagnosis keys and we share them with the relevant authorities in other countries so that the app can be used outside Scotland and that visitors to Scotland can use their app here. In addition, we count the number of all diagnosis keys sent to us.

Your IP address

Your diagnosis keys are sent to us securely through the internet using your IP address. We do not keep your IP address and will not be able to tell whose app sent the diagnosis keys. The app does not know or keep your IP address.

Your alert (exposure notification)

If you have been in close contact with someone who has tested positive from COVID-19, the app will provide you with an alert (this is also called your exposure notification).

The alert does not say who the close contact is and the app has no way of knowing that.

Your IP address

Your alert is sent to us securely through the internet using your IP address. We do not keep your IP address and we will not be able to tell who has received an alert. Nor does the app know or keep your IP address.

We only count the number of alerts to understand how many people have received an alert from the app.

Your email address

This is needed to send you your copy of the self-isolation certificate via email.

Receiver email address

These are the email addresses of the people or organisations that you want to share your self-isolation certificate with (e.g. your employer or Local Authority). We send the certificate to them via email once you give us approval to do so.

Your full postcode

If you want to apply for a COVID-19 self-isolation grant from your Local Authority we can send your certificate directly to them. To do this the app needs your full postcode to determine what Local Authority to send the self-isolation certificate to.

Estimated end date of isolation

This is the date on which you will no longer need to self-isolate.

Your Self-isolation Notice/Certificate reference number

This unique certificate number is included in your certificate.

Self-Isolation certificate (Estimated end date of self-isolation, Your name)

If you ask for a self-isolation certificate, the app generates the Self-Isolation Certificate unique reference number and sends you a link where you can provide your name and the email addresses of the people or organisations you want to share your certificate with.

Please give your name as you want it to appear in the certificate.

Your employer may need this information for health and safety purposes. Local Authorities need this information to support your application for a self-isolation support grant.

Your certificates are sent to the people or organisations you want to share them with using a secure email service (Gov.UK Notify).

The certificate also shows the date on which you no longer need to self-isolate.

Your request for a self-isolation certificate (when you click “continue”)

To count the total number of self-isolation certificates asked for.

That a self-isolation certificate(s) has been sent and whether you’ve sent a self-isolation certificate to a Local Authority

To count the total number of self-isolation certificate emails that have been sent.

To count the total number of self-isolation certificate emails sent to Local Authorities.

NHS Education Scotland and Amazon Web Services

NHS Education Scotland provides all the computers and the connections that the app needs to work properly. Amazon Web Services provide storage space for the app (these are known as the app servers).

Our text message and email service

We use a text message service provided by UK Government’s Gov.uk Notify to send you the text message with your test code and estimated date of infection.

We also use Gov.uk Notify to email your self-isolation certificate to yourself and the other people of organisations you want it to be sent to.

Your Local Authority

If you have told us to send your self-isolation certificate to your Local Authority. Your certificate can be used to support an application for a self-isolation grant.

Your Employer

If you have told us to send your self-isolation certificate to your Employer by giving us their email address and permission to send it to them.

Other people

If you have told us to send your self-isolation certificate to other people by giving us their email addresses and permission to send it to them.

Your test code, estimated date of infection, date of COVID-19 test and mobile phone number

These are not kept longer than 72 hours.

You may decide to keep your text message (which includes this information) on your phone for longer – this is your decision and you can delete it when you like.

Your IP address

The app uses your IP address only for a few seconds every time information needs to be sent from your app to us. IP addresses are not stored and are deleted immediately once the information they are transporting has reached us.

Diagnosis keys sent to us

We delete them after 14 days though we won’t be able to tell who the keys relate to or who sent them.

Random IDs

These are deleted every 14 days from your phone.

Your alert

We only count the number of alerts and do not keep any personal information if you receive an alert.

The “yes” answer when you first start to use the app

We only count the number of people starting to use the app and do not keep any personal information when you or your parent or guardian click “yes” when you first start to use the app.

Your age group

We don’t keep this information.

Estimated end date of self-isolation period
Your name
Your email address
Receiver email addresses
Your postcode

This information is held on the app server until the email with your self-isolation certificate is sent to all the email addresses you gave us (typically within a short period within a range of a couple of hours).

Gov.UK Notify holds this information encrypted for up to 3 days.

Your Self-isolation Notice / Certificate reference number

This information is held on the app server for 14 days in order to check that only one self-isolation certificate is given to one person for a self-isolation period.

Your self-isolation certificate (Your name, Estimated end date of self-isolation and Your Self-isolation Notice / Certificate reference number)

This information will be held by your Local Authority for seven years from the date when your application for a grant is received. If you do not submit an application for the self-isolation support grant within 28 days, then the Local Authority will delete your self-isolation certificate.

You should check with your employer and any other persons and organisation who you allow your self-isolation certificate to be sent to how long they will keep this information.