The following data may be collected in WA Notify:
- Downloading or enabling WA Notify.
- Receiving an exposure notification.
- Submitting a verification code or verification link.
- Uploading the random codes for positive users that have chosen to notify others.
Washington State Department of Health (DOH) uses the above event information to understand how WA Notify is being used. This data may be shared with DOH, public health entities, or authorized health authorities. It may also be used in an aggregate form for statistical or scientific research purposes. This information does not include any personal or location information nor will it be used to identify any WA Notify user.
To align with Google and Apple's intent, WA Notify is designed to protect user privacy as the top priority. WA Notify generates these data elements, which do not contain data that can identify you:
- Random codes are shared via Bluetooth between the smartphones of WA Notify users when they are near each other.
- Random codes are generated by and stored on your smartphone, not by WA Notify.
- Random codes are used only to allow WA Notify and your smartphone to check for possible exposures to COVID-19.
- Random codes are stored for a maximum of 14 days.
Verification Codes and Link
- If you test positive for COVID-19, and someone from your local public health authority reaches out, they will ask if you are using WA Notify. If you are, they will provide a verification code or link for you to enter into WA Notify.
- DOH also sends a pop-up notification and/or a text message with a verification link to everyone who recently tested positive for COVID-19 so that WA Notify users can quickly and anonymously alert other users of a possible exposure.
- Tapping on the notification or clicking on your verification link allows your random codes to be shared so that other WA Notify users you were near are anonymously alerted they may have been exposed.
- DOH sends a text message with the verification link to everyone who tests positive for COVID-19 because we do not know who uses WA Notify. If you are not using WA Notify, you can ignore the text.
- You decide whether to tap on the notification or click on the verification link to anonymously alert other WA Notify users.
- As with almost any app or internet service, WA Notify automatically generates logs when you use the service. These logs include some information about your smartphone. We use this information to troubleshoot issues with WA Notify.
- These logs do not include random codes or verification links or codes and cannot be used to tie either type of code back to you or your smartphone.
- These logs are automatically deleted 14 days after they are generated.
- If you choose to enable the extra analytics, limited aggregate data will be shared with DOH to help improve the app.
- This data includes statistics about how the app is used. It does not include any information that can be used to identify you.
- You can choose not to share this data by turning off analytics sharing in the app. By design, WA Notify does not collect location data from your smartphone and does not collect or share information tying you or your smartphone to random codes or verification codes.
What Happens When You Request a Verification Code?
WA Notify users who have a positive over-the-counter home COVID-19 test may request a verification code in WA Notify to anonymously alert other WA Notify users of possible exposure. In order to receive a verification code, WA Notify users must enter the date of their positive test result and their mobile phone number. The same device used to request the code must be used to enter the verification code or click the verification link to anonymously alert other WA Notify users of potential exposure.
To prevent duplicate reports of the same test result, WA Notify temporarily stores a cryptographically protected version of the phone number used to request the code for up to 90 days. This information will not include any personal or location information nor will it be used to identify any WA Notify user.
When Do We Share Your Information?
We will not voluntarily collect or share any of your information with anyone, unless you choose to enter a verification code or click a verification link. If you do so, WA Notify will share your random codes with other smartphones that have been near your smartphone. The verification code or link cannot be linked back to you by someone who does not have access to your smartphone. Review the "What Information Do We Collect and Use?" section at the top of this page to learn about what is collected and used in WA Notify.
How Do We Protect Your Information?
WA Notify protects random codes using Google and Apple's Exposure Notification Framework, which includes very specific requirements about how to encrypt and transfer them. WA Notify does not store or generate your random codes — your smartphone does.
Your Rights Over Your Information
Because the verification code and application logs cannot be tied to you without access to your smartphone, DOH has no way to access this information. Because of this, DOH cannot securely provide you with or delete this information if you ask. You control the use of WA Notify. Your smartphone should allow you to turn off exposure notifications or delete the exposure logs stored on your smartphone at any time. Additionally, you can uninstall WA Notify at any time. If you do, all random codes stored will be deleted.