COVID Alert privacy notice (Google-Apple Exposure Notification)
On this page
- Your privacy is protected
- App performance and effectiveness metrics
- What the app collects and stores on your phone
- What the app shares
- Other information about you
- Your IP address
- Deleting your data
- Provincial and territorial links in the app
- Privacy assessment
- Contact us
Your privacy is protected
COVID Alert has strong privacy protection.
We’ve taken extensive steps to protect your privacy and data. It's extremely unlikely that you could be identified while using this app.
Use of the app is voluntary.
App performance and effectiveness metrics
To help us understand how well the app is working, starting the week of February 9, 2021, the app will collect metrics. Specifically, the app will now collect:
- the number of active users per province or territory
- the number of users whose app changed to the “exposed” state
- the number of app users who enter a one-time key (OTK) while in the “exposed” state
- other technical performance metrics described in Appendix B of the Privacy Assessment
This data won’t be connected to you or other users. Consult Appendix B: COVID Alert App Metrics in the Privacy Assessment for more details of how the metrics are collected and stored.
What the app collects and stores on your phone
- Random codes from your phone, for 14 days.
- Random codes from other phones near you, for 14 days.
The random codes are used only to notify you and other app users of possible COVID-19 exposures.
COVID Alert has no way of knowing your:
- name or address
- phone's contacts
- health information
How the data is protected
- The app can’t identify you from the random codes.
- Your phone encrypts the random codes.
- Your phone will only share the random codes with COVID Alert if you agree to share them.
If you have an Android phone
To use Bluetooth scanning, Android phones using Android 6, 7, 8, 9 or 10 need the “Location” setting turned on for all apps.
While COVID Alert has no way of knowing where you are, Google may have access to your location.
If you have an Android phone using Android 6, 7, 8, 9 or 10, you may want to use the lowest accuracy option for “Location” and turn off “Google Location History.”
Android 11 doesn’t need the “Location” setting to be turned on to use COVID Alert.
You can check the app's permissions in your phone's settings. COVID Alert doesn’t have permission to use location services.
What the app shares
- Nothing is shared with other users without your explicit permission.
- When you give permission, the only information that's shared is the random codes from your phone.
- Only the app and its server have access to the random codes.
Some data will be collected to help us understand how:
- well the app is working
- the app is having an effect on slowing the spread of COVID-19
This includes the:
- province or territory you selected in the app, if you choose to provide this information
- number of users whose app changes to “exposed”
- number of app users who enter a one-time key while in the “exposed” state
This data won’t be linked to you or other users and isn’t used to identify you. It’s used to assess the effect COVID Alert is having on the pandemic.
Consult Appendix B: COVID Alert App Metrics in the Privacy Assessment for more details of how metrics are collected and stored.
If you're diagnosed with COVID-19
- You can choose to share your random codes from the last 14 days with a central server operated by the Government of Canada.
- You can choose to provide details to help narrow down when you were likely the most infectious.
- Those details tell the phone which random codes to upload.
- If you choose not to provide details, the app uploads the random codes from the last 14 days.
- If you share your random codes, nobody will get any information about you or when you were near them.
- You'll also be asked for permission to share your random codes with the central server for the next 13 days.
- The random codes go into the central server. No other information is sent to the server.
If another app user is diagnosed with COVID-19
- No information about you is shared with them.
- No information about them is shared with you.
Other information about you
COVID Alert is a Government of Canada app. It’s designed so that your health information stays with your provincial or territorial health care provider. Health care workers have no way of providing your personal information to COVID Alert.
Your identity and health status aren’t shared with the Government of Canada. COVID Alert doesn’t know who you are and can’t access your health information.
If you receive an exposure notification, the app will suggest next steps. We won’t receive any health information about you whether taking those next steps or not.
COVID Alert doesn’t connect with or collect any information from any other app on your phone.
Positive diagnosis and your one-time key
If you test positive for COVID-19, your health care provider will give you a one-time key. It tells COVID Alert that you can upload your random codes. COVID Alert trusts this key. It uses this key so it doesn’t have to collect any information that could identify you.
If you enter a one-time key, the app asks for details to help narrow down when you were likely most infectious. This way, the app will only notify users who were near you during that time.
It asks if you’ve had any symptoms. Depending on your answer, it will ask for either the date your symptoms started or your test date. You can choose not to enter any of these details. These details aren’t sent or stored anywhere outside your phone. It just tells the app which random codes to share. The app will also tell the central server if this information was entered, which helps us know if it’s a useful feature. The date you entered for your symptoms or test isn’t shared with the government.
Provincial and territorial identification numbers
To protect the integrity of the one-time keys, your province or territory may generate a long internal identification number. This tells the app the key was requested by a valid source. We aren’t able to associate these internal identification numbers with you or other app users. They’re only used when needed to prevent cybersecurity threats.
Your IP address
As a security measure, the server stores your IP address in system logs when you:
- enter a one-time key
- upload your random codes
- download a list of positive codes
Your IP address is not linked to any other information in the system, such as one-time keys or random codes.
These security measures prevent spammers from flooding the COVID Alert system and your phone with fake exposure notifications.
How IP addresses are used and protected
- IP addresses are stored in system logs.
- System logs are normally kept for up to 3 months.
- If there's an investigation into suspicious activity, we keep system logs for up to 2 years to help the investigation.
- System logs are closely protected and can only be used for ensuring performance and responding to security threats.
- If there's an investigation, we may share the relevant system logs, including IP addresses, with law enforcement, as required by law.
- These logs could be used to identify people who attack the system.
Deleting your data
- All random codes from your phone and other users’ phones are deleted after 15 days.
- You can delete the app at any time, and the random codes on your phone will be automatically deleted after 15 days.
- You can also delete the Exposure Logs yourself from your phone's settings.
- If you uploaded your random codes before deleting the app, they’ll be deleted from the server after 15 days.
Provincial and territorial links in the app
The app contains some links to websites that are managed by provincial and territorial governments. They may ask for or collect information about you. The COVID Alert system can’t access any information you give to those websites.
In July 2020, Health Canada, in collaboration with the Canadian Digital Service, completed a privacy assessment of the COVID Alert app. This assessment describes the measures we’ve taken to protect your privacy in the app.
Contact the COVID-19 information line:
- Phone: 1-833-784-4397
- Teletypewriter (TTY): 1-800-465-7735
(Monday to Friday, 8 am to 8 pm ET)
- Email: hc.AlerteCOVIDAlert.email@example.com
Report a problem or mistake on this page
- Date modified: