BCDEFGHIJKLMNOPQRSTUVWXYZAAABACADAEAFAGAHAI
1
What is the name of your application?Is your application intended to be used exclusively for contact tracing and/or exposure notification?Is your application designed to work in conjunction with manual contact tracing?Does your application use GPS or Bluetooth?Briefly describe the ways in which your application's architecture is centralized or decentralized?Does imputed data reside on a user's device or on a server?Do user IDs reside on their respective devices or on a server?Where is data for your application's exposure events managed?When consenting to use your application, are users informed as to the nature of the information they're disclosing? When consenting to use your application, are users informed as to how the information they're disclosing is being used?When consenting to use your application, are users informed as to the likely impacts of disclosure and use?Are events impacting the company server visible to users?How do users opt-in or opt-out of being tracked by your application?Does your application have a privacy policy? If so, please provide the link.Does your application output aggregate data analysis? If you answered yes to the above, do you apply differential privacy to this analysis?Do you use data collected through your application for anything other than the health objectives related to mitigating the impact of COVID-19?If your application is open-source, what license do you use?How is your organization structured? Has your code been audited?Are there features of your design that you or your auditor have identified as potential vulnerabilities? Will you continue running your application after the COVID-19 crisis has ended? What steps have you taken to ensure that subpopulations are not systematically excluded from using, or being accounted for in, your application?What steps have you taken to ensure that your clients (including government) only use the information for pre-determined health objectives related to mitigating the impact of COVID-19?Does your application use an openly published protocol to ensure that their solution is verifiable and interoperable? (For example, DP^3T, PACT, the TCN Protocol, and Apple/Google COVID-19 contact tracing technology)Can information such as location history, symptom reports, demographic information, or similar shared with public health officials or researchers, be linked back to or used to re-identify individuals (even by entities legally allowed to perform such linkage)Is there anything else you'd like to flag regarding your application that we have not covered in this survey?What is the name of your application?
2
YesYesBluetoothIt uses the Apple/Google GAEN protocol, which our developers explained to Apple how to build based on our original TCN protocol. Our Covid Watch team founded by researchers from Stanford and Waterloo was the first in the world to invent, develop, and open source a decentralized Bluetooth exposure alert protocol in early March.User's deviceThe system is entirely anonymous, so there are no user IDs.This is the choice of the respective public health department. We offer both solutions.YesYesYesYesThey download the app the opt-in to receiving and sending alerts. NoNoNoopen source Apache 2.0Non-profitNoWe are waiting to audit next week when the public health permission portal is also completed in addition to the app. if people want to use it to end or be prepared for other worse infectious diseases, public health might ask for this, especially since the system is anonymous, there is little to no risk if done correctlyWe were the first team to implement such a protocol on an external device in early March. We are not a hardware company, but we have been encouraging hardware companies to build cheap devices anyone could use even if they don't have a smartphone. We've designed it to only collect information useless for any other objective but sending alerts. This is why we built an anonymous, decentralized system. We originally used the TCN protocol we invented and developed in March, but switched to Apple/Google now that we expect it will be the standard.NoCovid Watch
3
COVID TraceYesYesBluetoothDecentralized contact tracing using the Apple/Google exposure notification APIs meaning the actual exposure is detected on the phone as opposed to a central server. Each deployment (per state) will have their own servers for diagnostic keys using the Google Reference Server implementation which allows for federation of diagnostic keys.User's deviceThere is no user IDCentral server controlled by our organizationYesYesNoYesExposure notification setting is an operating system permission in iOS and Android settingsYesYesNoMITNon-profitNoNoNo personal information or location data is associated with app. There is no PII within the app. The diagnostic keys used for exposure notification are not made available to be attached to a person's identity.YesNoCOVID Trace
4
HowWeFeelNoNoGPSGoogle Ccloud CentralizedYour serverYour serverWe do not really track exposure events. We have a survey question related to every being exposed or ever having a positive test resultsYesYesYesNoWe do not have tracking / exposure eventshttps://howwefeel.org/privacy-policy/YesWe plan to use diff privacy for 3rd parties that analyze the aggregate data on requestYesNon-profitYesNone that affect data privacyYesThe app is available in all countries/regions and 32 languagesDepending on the 3rd party they receive a subset or aggregated set of the data.We are not doing contact tracingNoWe are not a contact tracing app, and focus on gathering demographic/symptom data for scientist, researches, and local governments.HowWeFeel
5
NOVIDNoNoBluetoothAnonymized data (no GPS, phone number, email) on central server to send proactive rather than reactive alertsA third party serverA third party serverCentral server controlled by a third-party organizationYesYesYesYesThey can contact us at the contact on our Privacy Policyhttps://www.novid.org/privacyNoNot applicableNoFor-profitNoWe will only continue running NOVID as long as there is a need to protect against infectious disease outbreaks of similar natureWe target minimal versions of Android and iOS API's, and specifically procure old low-end phones from Craigslist to test it onWe maintain strong control of our feature set, and do not release information to governments that could be used for other objectives.We are part of the TCN coalition, and are open to collaborating with other protocols. Whenever other apps implementing other protocols are released and gain real traction, we are happy to implement their protocols to interoperate if they are fully released libraries.NoNOVID
6
COVID ShieldYesYesBluetoothOur application is structured with a shared national database of diagnosis keys (in the GAEN terminology) and decentralized integration with public health officials.We do not impute any data.User IDs reside nowhere. Temporary Exposure Keys reside on devices unless they are uploaded to a server as Diagnosis Keys.Diagnosis Keys reside on a central server managed by each region, but exposure events are only discovered and disclosed on user devices.YesYesYesNoUsers can disable Exposure Notification in their iOS settings or simply delete the app.https://www.covidshield.app/privacy/NoNoApache 2Unincorporated / Research OrganizationYesYes and they are fixed out in the open!We are not running COVID Shield, but our intention is for it to not outlive COVID-19.accessibility testing & designYesNoWe are not a vendor and we are not operating COVID Shield. We have only provided it as a reference that other organizations can use to get going with exposure notification without need to start from scratch.COVID Shield
7
COVID Near YouNoNoNeitherYour serverYour serverCentral server controlled by our organizationYesYesYesNohttps://covidnearyou.org/#!/privacyYesNoNoNon-profitYesCOVID Near You
8
CoEpiYesBluetoothCoEpi uses fully decentralized Bluetooth exposure alerting using the TCN protocol. N/A - there are no user IDsExposure events are detected locally within the app, on the device, and never leave the user’s phone.YesYesYesUsers aren't tracked. If they don't choose to report symptoms, no information ever leaves their device.https://CoEpi.org/privacyNoMITUnincorporated / Research OrganizationYesYesNoNote: CoEpi is not a research organization, or organization/company of any kind; it is an open source project made by individuals.

In CoEpi, exposure events never leave the local device (app). They never go to a server at all.
CoEpi
9
COVID Safe PathsYesYesBothWe offer both GPS and Bluetooth based technology. Both are built with a decentralized architecture, meaning that user data remains on devices and exposure notifications are generated on device based on exposure data retrieved from an external source. Our Bluetooth app is built using the Google Apple Exposure Notification API and conforms to the design intent and policies of the API. Our GPS solution is decentralized by design and works without requiring users to share any location data with anyone. If, as part of a contact tracing interview process, a user wishes to share their location data with a public health authority, they have the option to do so at their sole discretion, but such sharing is not automatic and requires proactive steps by the user.An undiagnosed member of the public's data resides only on their device. If they are diagnosed, and provide informed consent, then it is passed to the server of a healthcare authority to be redacted, and passed through a one-way hash before being published out to other users for the purposes of exposure notification.User's deviceServers managed by local health authoritiesYesYesNoYesUsers may opt out by declining to authorize the app to access GPS or Bluetooth functions of their device when installing, by revoking these authorizations at a later time, or by uninstalling the application.https://covidsafepaths.org/privacy-policy/YesYesNoMIT License https://github.com/Path-Check/covid-safe-paths/blob/develop/LICENSENon-profitYesYes, and we are releasing a production ready version imminently.YesWe have a global volunteer community engaging with public health organizations worldwide. We have cultivated a strong media relations program to promote the availability of our apps across a variety of mass media outlets. We have designed our technology to give consumers control of their private information.YesYesOur global community of volunteers is working to both develop the core technology, develop and promote best practices for contact tracing, and engage directly with health authorities to guide their projects and rollout. We have brought together leading academic researchers, technology industry veterans, trusted advisors to governments and enterprises, and implementation partners who can execute projects. We believe that this holistic approach is likely to lead the best outcome.COVID Safe Paths
10
Safe2 COVID AppYesYesBothPrimarily decentralized. Local data storage except minimum exposure data.Interesting question: We do not impute data. Minimal data with low cardinality values makes it difficult to impute missing data or de-anonymize (e.g. good k-anonymity).Neither the app nor server(s) create/store User IDs other than random Ephemeral IDs.Federated servers, syncing with each other.YesYesYesYesInstallation of app, permanently erase all data, opt-in to research/employer data sharing.https://safe2.org/privacy-policy/YesYesNoAttribution-ShareAlike 4.0 InternationalNon-profitNoYes.NoWe have actively pursued inclusive design with minority, disabled, homeless, and underserved communities. Deployment via NGOs (allowing federated sync with governments) is crucial in this strategy. We hope Apple/Google support this approach in the future.Our protocol (https://bit.ly/safe2protocol) is designed to minimize data value for non-covid-health uses. Stored data contains no user identifiers and no references to other stored data. Federated servers provides additional privacy for Safe2 users that share via NGOs (e.g. keeps IPs hidden from servers that receive indirect exposure data).YesNoWe focus on community health by informing individual awareness and choice.
- Safe Score provides awareness & visibility of current exposure status (user can choose to share).
- Hotspot map of exposure locations informs public health response & individual travel/interaction.

Health, Privacy, and Economy need not be trade-offs. We can support all three together:
- Privacy-preserving test result management & manual contact tracing integrations (see https://bit.ly/safe2protocol).
Safe2 COVID App
11
SharetraceNoYesBothSharetrace is a decentralised architecture that ISN'T limited to the device alone. It is built on user-owned cloud databases called personal data accounts.The users each own their own server, provided by Dataswift.io. See https://www.hubofallthings.com/ for more information.User IDs reside in the user private personal data accountCentral server controlled by our organizationYesYesYesNoProactively, by selecting the option to volunteer their information from their privately-owned personal data account to the centralised server (anonymously)http://www.sharetrace.org/privacyNon/aNoUnknown (sorry) but I believe the MIT Open Source licenseUnincorporated / Research OrganizationNoNoPotentially - this is dependent upon the app's ability to deliver lasting value to its users post-pandemicWe need to work harder at this. The personal data accounts that our technology is built on do enable us to better-serve less digitally-literate communities, but our current versions of the app do not. It is impossible for governments or corporations to access data from the personal data accounts issued by the Sharetrace application without the express and explicit permission of the user. Public health authorities' access to Sharetrace users' data can also be revoked at any time by the user (without informing the public health authority) and any government organisation accessing these users' information are bound by legal contracts of formal data exchange. For more information, see here: https://resources.dataswift.io/No, although the personal data accounts we are built upon are interoperable with all of these. Our ambition is to cooperate with everyone.Never without the users' express consent. Default use of the app does not allow anyone (including public health authorities) access to this information.Personal data accounts are new technology, and they create apps with a pretty unique architecture! We should talk about how all kinds of apps should be built this way, but especially sensitive apps like contact tracers. For some recent press, check out here (https://sifted.eu/articles/contact-tracing-covid-19/) and here (https://www.ft.com/content/f35db8c6-a02f-11ea-b65d-489c67b0d85d)Sharetrace
12
Coalition AppYesYesBluetoothThey are five components to take into consideration: 1. The identity generation: This is decentralized, as each phone periodically generates a new random keypair (a new identity) without registering it to a server. The private key never leaves the phone; the public key is shared with other app users over BLE (Bluetooth Low Energy) only and is never sent to a server. 2. The proof of interaction: This is decentralized; when two phones A and B meet, they automatically exchange their public key over BLE and compute (using Diffie—Hellman -https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange) two shared tokens, Ta and Tb. The token Ta will be published by phone A only if A has tested positive or self-reported for the infection, where as the token Tb will be published by phone B, only if phone B has tested positive or has self-reported for an infection. Publishing a token requires a user’s consent and validation, and consists of uploading the token to a public database. 3. Checking if an interaction was infectious: This can be done as either decentralized OR centralized. Periodically and automatically, the app will perform work in the background without a user’s intervention to check if an interaction was labelled as infectious. If user A’s app needs to check if the interaction with user B’s app was infectious, it needs to check if the token Tb has been published by B. This can be done in a decentralized fashion by downloading all the published tokens and performing the match-making locally on the phone. This can also be done in a centralized fashion by sending the token Tb to the server and letting the server perform the match-making on the user’s behalf. 4. Scoring the exposure risk to an infection: This can be done as either decentralized OR centralized. Scoring the exposure risk is a function of the number of infectious interactions (see point 3), compounded with various metadata. This is what we call the “epidemiological model.” This computation can be done in a decentralized fashion using the local database only. This computation can also be done centralized on the server as in point 3, in which case some metadata must be shared for each interaction. Metadata used for centralized scoring is only available with user’s consent and involves: the Bluetooth RSSI (Received Signal Strength Indicator) of the interaction (this is to estimate proximity) - https://en.wikipedia.org/wiki/Received_signal_strength_indication; duration of the interaction; optional: a 4-digit geo-hash which is a geographically bounded box that’s about 20km wide. This is not necessary for the tracing per se, but can be very useful for a health organization to be able to follow the spread of an infection without disclosing precise user geolocation. 5. Alerting the user: This can be done as either decentralized OR centralized. Similar to point 3 and 4, the system can be tuned to work in a purely decentralized fashion; in which case alerts are generated locally on the phone--based on point 3 and 4--or it can be done in a centralized fashion, in which case an alert is generated by the server. Note that for points 3, 4 and 5, the advantage of centralized match-making is that a user cannot infer when and where an infectious contact happens, thereby preventing the risk of discrimination. Even with centralized match-making, the server doesn’t get any PII (Personally Identifiable Information). Interaction tokens (Ta and Tb) are unique to an interaction and cannot be linked with other interaction tokens, nor linked back to a user; the server is thus unable to rebuild a social graph.The imputed data is on the phone, but the server still has encrypted tokens and can do the match-making, so we use a mix of a decentralized and centralized approach. The list of infectious interaction tokens are published to a server. Note that those infectious tokens do not carry Personal Identifiable Information (PII) and are unique to a pair of users, and cannot be used to identify users. This technique brings a better privacy model as users can never guess who infected them.The list of infectious interaction tokens are published to a server. Note that those infectious tokens do not carry Personal Identifiable Information (PII) and are unique to a pair of users, and cannot be used to identify users.YesYesYesNoOur application does not track users and isn’t using any opt-in or opt-out. Users can uninstall the application if they do not wish to use it. No Personal Identifiable Information (PII) is collected or associated with any app user.https://www.coalitionnetwork.org/privacyNoNoNoGPLv3Non-profitNoNot for now.Yes, this application can be used to track any proximity-based risk exposure other than COVID-19.We are also developing a smart wearable device, the Nodle M1 with Nodle.io and Avnet, the M1 is offered to enterprises and is interoperable with the Coalition App. It can be used for underserved communities that don’t have a smartphone.There is no sensitive information or Personal Identifiable Information (PII) that can be used for any other purpose than to alert users who have been exposed or in the case of the centralized server solution, to change the epidemiological model and/or to assess the number of alerts sent, and the number of users who declared they were infected or tested positive.Yes. We developed the Whisper Tracing protocol that was designed following the recommendation for the TCN Coalition and reviewed by peers and members of the Coalition Networks and from universities such as MIT, Stanford, USC, and Oxford.No1. The Coalition App offers the possibility for labs and doctors to communicate test results directly to a user while protecting the user's privacy. This automates results, saving a significant amount of time.
2. We are currently working on the decentralized architecture at the server level for to enable interoperability.
3. While our code has not been audited yet, our Whisper Tracing Protocol has been reviewed by cryptographers at MIT, Stanford, USC, and Oxford.
Coalition App
13
ZeroNoYesBothData is stored in a decentralized manner such that random ids and locations are only ever stored on the phone.User's deviceUser's deviceCentral server controlled by our organizationYesYesYesNoThey can turn it on and off in the settings page.YesYesNoNon-profitNoNoneNoWe have been conducting usability tests with seniors and other vulnerable populations.All health data collected will be deleted after 14 days so it cannot be used after the pandemic for other purposes.YesNoOur application can use both the Apple/Google API as well as the TCN protocol.Zero
14
Healthy Together NoYesBothOur serverOur server Central server controlled by our organizationYesYesYes- Users can optionally give permission to the app to access location, bluetooth, and contacts. - Users can turn off location or bluetooth at anytime on the "More" screen in our app. - Users can delete their account at any time. This deletes all data tied to their user account on our servers.https://www.healthytogether.io/legal/privacyYesYesNoFor-profitNoAnyone with an Android phone or iPhone with a valid phone number can sign up and use the application.Our clients are contractually bound to limit usage of our app user data for the purposes of mitigating the impact of COVID-19.YesHealthy Together
15
ViriYesYesBothHybrid. Centralized anonymous database and Decentralized PIIRandom ID's on the cloud and PII on a private hyperledger residing at the customer premiseRandom ID's on the cloud and PII on a private hyperledger residing at the customer premiseRandom ID's on the cloud and PII on a private hyperledger residing at the customer premiseYesYesYesYesPermissionsNoNoNoFor-profitYesNoComplete AnonymityThere is not other use-case. Service will be turned-off post crisis.Custom ProtocolThe app is ephemeral. Data is purged on a rolling 3-week basis.Viri
16
VerahealthNoYesNeitherCentralized using Google Commercial datacenterYour serverYour server
Central server controlled by our organization
YesYesYesNoManual self reporting.
https://acumen-health.web.app/privacy-policy
YesNoNoFor-profitYesNo
If Necssary for completion of ongoing health screening.
We are working with public health agency's to offer our technology to underserved populations.
No identifying information is provided beyond what is necessary for daily screening of known users.
NoYes
Our application includes self reported contact tracing but is also geared towards prevention and protection of known, trusted populations such as schools and employer groups. These populations have existing healthcare delivery mechanisms and are required to provide syndromic surveillance at a higher level than the general population. Our app provides an effective and private means of conducting required health screening as an alternative to public screenings at doors and entry points.

We also allow private reporting of early onset symptoms within households to allow health professionals responsible for COVID-19 response at the organization to have visibly into potential exposure by asymptomatic but exposed individuals.

It is our belief that by providing a tool for private interaction between healthcare professionals at an organization such as a school and the members of the organization we can greatly reduce the need for post infection intrusive contact tracing by reducing community spread.
Verahealth
17
YesYesBothWe offer a business focused solution, for tracking contact between employees and those customers they serve
Both - device for a period of time, until required on the sever
As above
Central server controlled by our organization
YesYesYesNo
We are GDPR compliant, so there are various levels of user protection
https://www.safer.me/privacy-policy
Yes
We do this at the company level, as we service business - it seems like your question is targeted at public focused apps
NoFor-profitYesYes
We service paying customers only - this question seems designed for public apps. We are a business app
Our clients own their data
When required by law - location history is not stored or accessible
Business focused, paid for by the New Zealand Government
SaferMe
18
YesYesBothWe offer a business focused solution, for tracking contact between employees and those customers they serve
Both - device for a period of time, until required on the sever
As above
Central server controlled by our organization
YesYesYesNo
We are GDPR compliant, so there are various levels of user protection
https://www.safer.me/privacy-policy
Yes
We do this at the company level, as we service business - it seems like your question is targeted at public focused apps
NoFor-profitYesYes
We service paying customers only - this question seems designed for public apps. We are a business app
Our clients own their data
When required by law - location history is not stored or accessible
Business focused, paid for by the New Zealand Government
SaferMe
19
YesNoNeither
Each resident and staff member wears a tracking device that uploads location information over WiFi to a centralized database for analysis. Information from each facility is stored into a central database for contact tracing analysis.
Your serverYour server
Central server controlled by our organization
YesYesYesNo
CarePredict PinPoint is designed for use in congregated facilities like nursing homes and senior living facilities that house a population that is highly vulnerable to severe illness from COVID-19. CarePredict PinPoint Contact Tracing solution uses CarePredict’s smart wearable, Tempo™, and a highly precise indoor positioning system. In senior living facilities using CarePredict, the staff, visitors, and residents wear CarePredict Tempo wrist-worn wearable that tracks precise indoor location to identify, within seconds, all the people and places that have been exposed to an infected individual. The senior living facility management obtain the opt-in from the resident’s family, residents and their staff for CarePredict location tracking services.
https://www.carepredict.com/contact-tracing/
YesNoYes
Our application is not open-source, it is a proprietary system.
For-profitNoNo
For effective infection control measures in senior living facilities and nursing homes for C.Diff, MRSA, seasonal Flu, etc.
CarePredict PinPoint is ideal for senior living facilities and nursing homes because everyone in these facilities – residents, staff and visitors wear a Tempo that tracks precise indoor location. Using this wearable-based contact tracing solution, facilities can identify all contacts – residents, staff or visitors who have been exposed to a suspected carrier.
CarePredict PinPoint solution is a digital contact tracing solution specially designed for rapid infection control in high-risk, high-density settings like nursing homes and senior living facilities. These settings house a population that is highly vulnerable to severe illness from COVID-19 and other communicable diseases due to compromised immune system and preexisting factors like comorbidities. PinPoint uses highly precise indoor location data of staff, residents and visitors to identify within seconds all the people and places that were exposed to a suspected carrier. PinPoint includes a line listing tool where the infection status and isolation status are entered by the staff in the facility. CarePredict PinPoint not only identifies all contacts who were exposed to an infected individual, but also automatically categorizes them based on high and low priority. Facilities can effectively test and isolate high priority contacts who are at higher risk from exposure and are therefore at high risk for transmitting the virus through the facility. PinPoint goes further than other contact tracing tools in identifying the places within a facility that have been exposed to a carrier. CarePredict’s Decontamination Plan provides visibility into the hotspots and specific areas visited by a suspected carrier and other frequented areas within the community, enabling facilities to focus their disinfection and decontamination efforts.
No
The tracing and location data is owned by the facility and any identification of individuals would need to be done with the facility's permission.
CarePredict’s manuscript (currently under review) — “Real-time digital contact tracing: Development of a system to control COVID-19 outbreaks in nursing homes and long-term care facilities” uses computer simulated models to assess the performance of CarePredict digital Contact Tracing system versus conventional containment methods such as manual tracing and symptom-based screening.
As senior living facilities prepare to relax restrictions and re-open to outside visitors, CarePredict PinPoint digital contact tracing will enable them to do so in a surgical, cost-effective manner that controls outbreaks while also safely giving residents back the life they once had before this pandemic hit.
CarePredict PinPoint
20
NoYesBothIt has blended architecture ( some data elements are decentralized and some are centralized)Google CloudBlended architecture
Central server controlled by our organization
YesYesYesNoApp settings
https://www.opun.ai/privacy
YesYesNoFor-profitYes
The information is non-identifiable to any individual and the only purpose of such information is for health objectives and that is implemented through proper authentication and authorization.
Proprietary protocolNo
OPUN is an immediate and long-term holistic Pandemic Lifecycle Management System that takes a 360-degree approach in addressing all phases of the Pandemic - preparedness, containment, operation and evaluation. OPUN minimizes the social and economic impact of pandemics.
OPUN
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100