COVID Alert privacy notice (Google-Apple Exposure Notification)

On this page

Your privacy is protected

COVID Alert has strong privacy protection.

We’ve taken extensive steps to protect your privacy and data. It's extremely unlikely that you could be identified while using this app.

Use of the app is voluntary.

App performance and effectiveness metrics

To help us understand how well the app is working, starting the week of February 9, 2021, the app will collect metrics. Specifically, the app will now collect:

This data won’t be connected to you or other users. Consult Appendix B: COVID Alert App Metrics in the Privacy Assessment for more details of how the metrics are collected and stored.

What the app collects and stores on your phone

The random codes are used only to notify you and other app users of possible COVID-19 exposures.

COVID Alert has no way of knowing your:

How the data is protected

  • The app can’t identify you from the random codes.
  • Your phone encrypts the random codes.
    • Your phone will only share the random codes with COVID Alert if you agree to share them.

If you have an Android phone

To use Bluetooth scanning, Android phones using Android 6, 7, 8, 9 or 10 need the “Location” setting turned on for all apps.

While COVID Alert has no way of knowing where you are, Google may have access to your location.

If you have an Android phone using Android 6, 7, 8, 9 or 10, you may want to use the lowest accuracy option for “Location” and turn off “Google Location History.”

Android 11 doesn’t need the “Location” setting to be turned on to use COVID Alert.

You can check the app's permissions in your phone's settings. COVID Alert doesn’t have permission to use location services.

What the app shares

Some data will be collected to help us understand how:

This includes the:

This data won’t be linked to you or other users and isn’t used to identify you. It’s used to assess the effect COVID Alert is having on the pandemic.

Consult Appendix B: COVID Alert App Metrics in the Privacy Assessment for more details of how metrics are collected and stored.

If you're diagnosed with COVID-19

  • You can choose to share your random codes from the last 14 days with a central server operated by the Government of Canada.
  • You can choose to provide details to help narrow down when you were likely the most infectious.
    • Those details tell the phone which random codes to upload.
    • If you choose not to provide details, the app uploads the random codes from the last 14 days.
  • If you share your random codes, nobody will get any information about you or when you were near them.
  • You'll also be asked for permission to share your random codes with the central server for the next 13 days.
  • The random codes go into the central server. No other information is sent to the server.

If another app user is diagnosed with COVID-19

  • No information about you is shared with them.
  • No information about them is shared with you.

Other information about you

COVID Alert is a Government of Canada app. It’s designed so that your health information stays with your provincial or territorial health care provider. Health care workers have no way of providing your personal information to COVID Alert.

Your identity and health status aren’t shared with the Government of Canada. COVID Alert doesn’t know who you are and can’t access your health information.

If you receive an exposure notification, the app will suggest next steps. We won’t receive any health information about you whether taking those next steps or not.

COVID Alert doesn’t connect with or collect any information from any other app on your phone.

Positive diagnosis and your one-time key

If you test positive for COVID-19, your health care provider will give you a one-time key. It tells COVID Alert that you can upload your random codes. COVID Alert trusts this key. It uses this key so it doesn’t have to collect any information that could identify you.

If you enter a one-time key, the app asks for details to help narrow down when you were likely most infectious. This way, the app will only notify users who were near you during that time.

It asks if you’ve had any symptoms. Depending on your answer, it will ask for either the date your symptoms started or your test date. You can choose not to enter any of these details. These details aren’t sent or stored anywhere outside your phone. It just tells the app which random codes to share. The app will also tell the central server if this information was entered, which helps us know if it’s a useful feature. The date you entered for your symptoms or test isn’t shared with the government.

Provincial and territorial identification numbers

To protect the integrity of the one-time keys, your province or territory may generate a long internal identification number. This tells the app the key was requested by a valid source. We aren’t able to associate these internal identification numbers with you or other app users. They’re only used when needed to prevent cybersecurity threats.

Your IP address

As a security measure, the server stores your IP address in system logs when you:

Your IP address is not linked to any other information in the system, such as one-time keys or random codes.

These security measures prevent spammers from flooding the COVID Alert system and your phone with fake exposure notifications.

How IP addresses are used and protected

Deleting your data

Provincial and territorial links in the app

The app contains some links to websites that are managed by provincial and territorial governments. They may ask for or collect information about you. The COVID Alert system can’t access any information you give to those websites.

Privacy assessment

In July 2020, Health Canada, in collaboration with the Canadian Digital Service, completed a privacy assessment of the COVID Alert app. This assessment describes the measures we’ve taken to protect your privacy in the app.

Contact us

Contact the COVID-19 information line:

Report a problem or mistake on this page
Please select all that apply:

Thank you for your help!

You will not receive a reply. For enquiries, contact us.

Date modified: