How state health leaders say Virginia's new COVID-19 app protects your privacy

Posted at 9:10 AM, Aug 07, 2020

RICHMOND, Va. -- The Virginia Department of Health’s new COVID-19 smartphone app was downloaded 172,000 timesthe first day it launched statewide. A spokesperson for VDH said those figures were as of 4 p.m. Thursday. However, they did not know how many people had also opted-in to the app.

The app, called “COVIDWISE”, is intended to notify users of possible exposure to COVID-19. It was developed by SpringML using technology from Google and Apple. Officials said they chose to use this technology to allay privacy concerns.

“This app strictly uses Bluetooth. Unlike other apps that are out there which are using location, which is using some of your identity. This app is completely staying away from all that,” VDH’s Chief Information Officer Suresh Soundararajan said.

Using the Bluetooth technology, the app will work between two phones that have it installed, are opted-in, and within range of each other. When someone has opted-in, the app will generate random keys, or tokens, that are changed every 10 to 20 minutes.

“These random keys, Bluetooth keys, get exchanged between two phones,” said Soundararajan.

Then, if someone using the app tests positive for COVID-19, and decides to report it to the app (since reporting it is voluntary), other users who were within six feet of the patient for at least 15 minutes will get notified on their phone of possible exposure. Officials said those parameters are based on CDC guidelines.

“In the whole process it doesn't tell who it is, it doesn't tell where it was. It just says these random keys match which means you may have been exposed,” added Soundararajan.

The app will also give instructions on what people should do next if they have possibly been exposed.

In order to prevent people from reporting false positives, officials said there is a verification process for reporting cases on the app. When someone tests positive for COVID-19, a case investigator will ask that patient if they have been using COVIDWISE. If they have, the investigator will give them a unique personal identification number (PIN) they can use to report their case on the app.

But, just like downloading and opting-in, reporting a case is voluntary.

“We give the pin so that we can cross-validate, and make sure that's the person so it cannot be used anywhere,” said Soundararajan. “They have to do it within 48 hours, otherwise, that PIN expires.”

Soundararajan said if someone decided to report their case after their initial PIN expires, they can call VDH back to ask for a new one.