Information about the COVIDSafe app

Key points

  • The COVIDSafe app was developed by the Australian Government to slow the spread of coronavirus (COVID-19).
  • You can help contact tracers by downloading the app. The app uses Bluetooth® technology to take note of contact you have had with other users who also have the COVIDSafe app.
  • If you or someone you have been in contact with tests positive for coronavirus (COVID-19), the information  securely stored on the COVIDSafe app in your phone about other users can be uploaded and used – with your consent – by health officials. This helps health officials quickly find and contact people who have been exposed to the virus.
Your questions answered

What is the COVIDSafe app?

The COVIDSafe app was developed by the Australian Government to slow the spread of coronavirus (COVID-19). The COVIDSafe app uses Bluetooth® technology on your mobile phone. It works by looking for other devices nearby that also have the COVIDSafe app installed and running.

When you are near someone who also has the app installed and running, your device will take note of this contact by securely logging the other person’s reference code, in a process called a “digital handshake”.

Then if you or someone you have been in contact with tests positive for coronavirus (COVID-19), the information securely stored by the app in your phone can be uploaded and used – with your consent – by state or territory health officials. This will help to quickly trace people who have been exposed to the virus.

Translated information about the COVIDSafe app

Why should I download the COVIDSafe app?

By downloading the COVIDSafe app you can help contact tracers quickly find people who may have been in close contact with a positive coronavirus (COVID-19) case. If you test positive for coronavirus (COVID-19), a state or territory health official will ask for your consent to upload your digital handshake information to the National COVIDSafe Data Store. This will allow contact tracers to quickly access information.

How can I download the COVIDSafe app?

Download on the app Store

Download on Google Play

The COVIDSafe app is available in Arabic, Mandarin, Cantonese, Korean and Vietnamese.

How does the COVIDSafe app work?

Using the COVIDSafe app is voluntary but using it can help to keep you and others safe.

You can download the COVIDSafe app from the Apple iOS or Google Play app stores and install it on a compatible device. The app is free to download.

You register to use the app by entering your name, age range, mobile number and postcode. Then you will get a confirmation text message to complete the installation of the App.

Based on this information, an encrypted reference code is generated for the app on that phone. When running, the COVIDSafe app uses Bluetooth® to look for other devices nearby that are also running the App.

When this happens, your app takes note of this contact, through a digital handshake – by securely logging the other user’s encrypted reference code and the date, time and signal strength of the contact on the user’s phone and notes the phone model. This information is then securely encrypted and stored on your phone by the App. Location is not recorded.

When running, the app checks for new connections every minute, so it can record the total length of time that you have been near another user who has the app.

The COVIDSafe app keeps this data from the previous 21 days, using a rolling window. Any contacts recorded more than 21 days ago are automatically deleted from your phone.

If you test positive for coronavirus (COVID-19), you will be called by a public health official from the state or territory where you had the test. They will ask for you to provide consent for the encrypted COVIDSafe app data to be uploaded from your phone to the National COVIDSafe Data Store – which is a secure information storage system administered by the Digital Transformation Agency, which is part of the Australian Government. If you agree, the uploaded information will be provided by the Digital Transformation Agency to state and territory public health officials for use in their contact tracing activities.

Who can use the COVIDSafe app?

Anyone who has an Australian mobile number and a compatible Bluetooth®-equipped Android or Apple iOS smartphone can download and use the COVIDSafe app. You need to be connected to Wi-Fi or mobile data to download the app, but Wi-Fi is not needed for the App to work.

Why has the government developed the COVIDSafe app?

The Australian Government has developed COVIDSafe to help State and Territory Public Health Officials identify and contact people who have been in close contact with a positive coronavirus (COVID-19) case.

Can I use the COVIDSafe app to notify contacts that I have tested positive to coronavirus (COVID-19)?

No. The COVIDSafe app is designed so that public health officials can notify people who may have been in close contact with a person who has tested positive for coronavirus (COVID-19).

Use of the COVIDSafe app in Victoria

How is COVIDSafe app data being used in Victoria?

The Victorian Department of Health and Human Services (DHHS) is using some data from the Australian Government’s COVIDSafe app as part of the contact tracing effort. DHHS has a team of public health officials that contact people who may have been exposed to coronavirus (COVID-19).

The DHHS contact tracing team uses data from the COVIDSafe app to supplement their usual contact tracing activities.

If you test positive for coronavirus (COVID-19), the data from the COVIDSafe app can assist the contact tracing team to identify people who may have been exposed to coronavirus (COVID-19). All people identified as a possible close contact are contacted by the DHHS contact tracing team.

COVIDSafe app data supplements other sources of data. It is not the sole mechanism used in Victoria by the contact tracing team to identify people who may have been exposed to coronavirus (COVID-19).

What is contact tracing?

Contact tracing is the process of identifying people who have been in contact with a person who has tested positive for coronavirus (COVID-19). DHHS has public health officials who undertake contact tracing. These professionals assess the risk that people may have been infected by coronavirus (COVID-19) and provide health advice to the people they speak with.

For information on what to do if you are a close contact visit the quarantine and isolation page.

Will I be required to quarantine if my phone has exchanged digital handshakes with the phone of someone who has tested positive for coronavirus (COVID-19)?

The need to quarantine is not automatic. The DHHS contact tracing team will assess your risk of exposure. This depends on where you were when your contact with a person who has coronavirus (COVID-19) occurred, and if that person was infectious at the time.

If a public health official is satisfied that you have had close contact with a person with coronavirus (COVID-19), and that they were infectious at the time, they will tell you to quarantine at home. Support is available if you need to quarantine at home.

Can the COVIDSafe app data be used for enforcement purposes?

No. The Australian Government has introduced measures to ensure that COVIDSafe app data cannot be used for general enforcement purposes. For example, legislation prohibits COVIDSafe app data being used for any purpose other than contact tracing and agencies, such as law enforcement agencies, are not allowed to access the App data unless they are investigating a breach of the COVIDSafe privacy rules.

However, the Australian Government COVIDSafe app Privacy Policy does state that:

Contact users may be advised to take such measures as are required by their State or Territory (such as self-isolating). Failure to comply with these measures may be in breach of State or Territory law.

In Victoria COVIDSafe app data will be used, along with other information, to contact people who have potentially been exposed to coronavirus (COVID-19) and evaluate the risk of transmission.

Mandatory directions to quarantine, consistent with national guidance, have been made by the Victorian Chief Health Officer under the Public Health and Wellbeing Act 2008 (Vic). The legislation also gives the DHHS broad powers to act if those directions are not followed; but the COVIDSafe app data will not be used by DHHS for that purpose.

Privacy protections

Is use of the app voluntary?

Use of the COVIDSafe app is voluntary and you can stop using the app at any time.

If you would like to stop using the app the following information explains what happens to your data:

  1. You can delete the app from your phone at any time. This will delete all digital handshakes from your phone and will stop your phone creating any new digital handshakes.
  2. You can also request the deletion of your registration data (your name, mobile phone number, age range and postcode) from the National COVIDSafe Data Store, using this online form.
  3. You cannot ask for your ‘digital handshake’ data to be deleted. This may be held in the National COVIDSafe Data Store as a result of you (or other users) uploading their data.
  4. Once the Commonwealth Health Minister has determined that the COVIDSafe app is no longer needed to slow the spread of coronavirus (COVID-19), all data in the National COVIDSafe Data Store will be deleted as soon as is reasonably practicable.

What personal information is collected, used and disclosed by the COVIDSafe app?

The amount of information collected by Victoria from the COVIDSafe app - via the Commonwealth - is limited. It includes:

  • mobile phone number (verified);
  • name (may be a pseudonym or fake name);
  • postcode (un-verified);
  • age range; (un-verified) and
  • bluetooth handshake data (filtered).

The Bluetooth handshake data collected by the COVIDSafe app can be quite detailed, but the amount of handshake data provided by the Commonwealth to Victoria is filtered. The Commonwealth will only supply any details regarding a close contact if the handshake data meets the threshold test of 15 minutes where there was a medium or high likelihood that the contact was within 1.5 metres.

Importantly, this data is intended to support, rather than replace, the normal contact tracing risk assessment process used by state health authorities. DHHS may collect other information about you during normal contact tracing activities – typically from a telephone interview.

How is my personal information protected?

The use of COVIDSafe app data in Victoria is subject to both Victorian and Commonwealth privacy legislation. This means your personal information is protected by:

  • The Australian Privacy Principles (APPs) in the Commonwealth Privacy Act; and the
  • The Health Privacy Principles (HPPs) in the Victorian Health Records Act.

Additional privacy rules have been legislated just for the COVIDSafe app data. The Privacy Act, as amended by the Privacy Amendment (Public Health Contact Information) Act 2020 (Cth) contains these special measures. Some of the key protections are:

  1. The use of your personal information is restricted to contact tracing by state and territory health officials
  2. It will be a criminal offence to use any COVIDSafe app information in any other way
  3. Other agencies, including law enforcement, will not be able to access the information unless investigating misuse of that information itself.

Security measures

Is the COVIDSafe app secure?

DHHS is required under privacy legislation to have security measures designed to protect personal and health information, including COVIDSafe app data, from misuse, loss, unauthorised access, modification or disclosure.

DHHS is also bound by the Victorian Protective Data Security Standards V2.0, which establishes 12 mandatory requirements to protect public sector information across all security areas including governance, information, personnel, Information Communications Technology (ICT) and physical security.

To provide an additional layer of security, DHHS is keeping all COVIDSafe app data that it collects in a separate secure database – so that this data will be destroyed at the end of the pandemic.

Where is my personal information stored?

Most COVIDSafe app data remains on the phone, and data older than 21 days is automatically deleted. Some limited COVIDSafe app data is held by the Commonwealth. You can read more about the Commonwealth’s record of app data at COVIDSafe Help.

In Victoria, DHHS will hold some of your personal information either from the app or from normal contact tracing processes (such as an interview). This data is encrypted.

In the general day-to-day operation and use of COVIDSafe app data by Victorian contact tracers, no information will be transferred by DHHS outside Victoria.

There may be a few one-off instances where data collected during contact tracing is disclosed across borders to other public health agencies – especially where people live close to borders or have travelled interstate. The information that is disclosed across a border will not include COVIDSafe app data itself but may include data obtained during normal contact tracing processes.

How long is my personal information kept?

COVIDSafe app data collected and held on the phone is deleted after 21 days.

COVIDSafe app data held by the Commonwealth is limited and will be deleted at the end of the pandemic.

COVIDSafe app data that is accessed by a state health authority for contact tracing is retained only until the end of the pandemic. It is kept in a separate store so that it can be easily deleted.

General DHHS data in relation to contact tracing is classified as public health information in Victoria and may be retained for lengthy periods – to enable Victoria to prepare for future public health emergencies.

What happens if there is a data breach?

Any breach of the Commonwealth rules on the handling of COVIDSafe app data by DHHS must be notified by DHHS to the Office of the Australian Information Commissioner (OAIC) and to affected individuals.

The Digital Transformation Authority (DTA), as the national administrator of the National COVIDSafe Data Store, has similar notification requirements if there is a breach of data held by them.

The DHHS has additional reporting requirements that apply to security breaches more generally and this is covered by the Victorian Protective Data Security Standards (VPDSS v2.0) established by the Office of the Victorian Information Commissioner (OVIC).

It is an offence to decrypt COVIDSafe app data that is held on your phone.

Further information

Can I access my own personal information?

Under the Commonwealth Privacy Act and the Victorian Health Records Act you will have some rights to access your own information. However, this right to access your own data may not extend to all of the detailed data collected by the COVIDSafe app, because DHHS can only disclose the COVIDSafe app data that it holds for the purpose of contract tracing. Other data held by DHHS can usually be accessed, unless providing access would have an unreasonable impact on the privacy of other individuals.

More details on access requests are contained in the DHHS Privacy Policy.

Where can I find further information about the app and privacy?

Who do I contact if I have a query or complaint?

If you have any queries or complaints about the use of COVIDSafe app data in Victoria please contact DHHS in the first instance by emailing: privacy@dhhs.vic.gov.au

If you still have unanswered questions or complaints, you can approach the relevant regulator:

Issue 

Regulator to contact

Inquiries or complaints regarding the COVIDSafe app itself or data collected by the app 

Office of the Australian Information Commissioner (OAIC)

Inquiries or complaints regarding general DHHS practices, including contact tracing 

Health Complaints Commissioner (HCC)

Inquiries or complaints regarding DHHS compliance with the Victorian Protective Data Security Standards 

Office of the Victorian Information Commissioner (OVIC)