This privacy policy applies to WA Notify, the official exposure notification technology for Washington state.
WA Notify was created with the oversight and endorsement of the Washington State Department of Health (DOH).
What Information Do We Collect and Use?
Anonymous data may be collected in WA Notify about the following events:
- Downloading or enabling WA Notify.
- Receiving an exposure notification.
- Submitting a verification code or verification link.
- Uploading the random codes for positive users that have chosen to notify others.
- Encountering technical issues with the app (diagnostic data, including app performance statistics).
DOH uses the above event information to understand how WA Notify is being used. This data may be shared with DOH, public health entities, or authorized health authorities. It may also be used in an aggregate form for statistical or scientific research purposes. This information does not include any personal or location information nor can it be used to identify any WA Notify user.
WA Notify is designed to protect user privacy as the top priority, which aligns with Google and Apple's intent. WA Notify generates the following data elements, which do not contain data that can identify anyone using the tool:
Random Codes
- Random codes are shared via Bluetooth between the smartphones of WA Notify users when they are near each other.
- Random codes are generated by and stored on your smartphone, not by WA Notify.
- Random codes are used only to allow WA Notify and your smartphone to check for possible exposures to COVID-19.
- Random codes are stored for a maximum of 14 days.
Verification Codes and Links
- To quickly and anonymously alert WA Notify users that they may have been exposed to COVID-19, DOH sends a notification and/or text message with a verification link to all phone numbers associated with a positive COVID-19 test result reported to DOH.
- Tapping on the notification or clicking on the verification link allows your random codes to be shared, which anonymously alerts other WA Notify users you were near that they may have been exposed.
- DOH sends a text message with the verification link to everyone who tests positive for COVID-19 because we do not know who uses WA Notify. If you are not using WA Notify, you can add WA Notify to your phone or ignore the text.
- You decide whether to tap on the notification or click on the verification link to anonymously alert other WA Notify users.
- If you test positive for COVID-19, someone from your local public health authority may reach out and ask if you are using WA Notify. If you are and haven’t already received a verification text message, they will provide a verification code or link for you to enter into WA Notify.
Usage Logs
- As with almost any app or internet service, WA Notify automatically generates logs when you use the service. These logs include some information about your smartphone. We use this information to troubleshoot issues with WA Notify.
- These logs do not include random codes or verification links or codes and cannot be used to tie either type of code back to you or your smartphone.
- These logs are automatically deleted 14 days after they are generated.
Analytics Data
- If you choose to enable the extra analytics, limited aggregate data will be shared with DOH to help improve the app.
- This data includes statistics about how the app is used. It does not include any information that can be used to identify you.
- You can choose not to share this data by turning off analytics sharing in the app.
- By design, WA Notify does not collect location data from your smartphone and does not collect or share information tying you or your smartphone to random codes or verification codes.
Diagnostic Data
- As with almost any app or internet service, WA Notify automatically generates diagnostic data when you use the service.
- The Android WA Notify app is developed by Google, as are other exposure notification apps using the same Apple/Google technology.
- Google uses this information to diagnose issues with WA Notify and other exposure notification apps using the same Apple/Google technology.
- This diagnostic information does not include any personal or location information nor can it be used to identify any WA Notify user.
What Happens When You Request a Verification Code?
WA Notify users who test positive for COVID-19 using a self-test may request a verification code in WA Notify to anonymously alert other WA Notify users of possible exposure. To receive a verification code, WA Notify users must enter the date of their positive test result and their mobile phone number. The same device used to request the code must be used to enter the verification code or click the verification link to anonymously alert other WA Notify users of potential exposure.
To prevent duplicate reports of the same test result, WA Notify temporarily stores an encrypted version of the phone number used to request the code for up to 30 days. This information does not include any personal or location information nor can it be used to identify any WA Notify user.
When Do We Share Your Information?
We will not voluntarily collect or share any of your information with anyone, unless you choose to enter a verification code or click a verification link. If you do so, WA Notify will share your random codes with other smartphones that have been near your smartphone. The verification code or link cannot be linked back to you by someone who does not have access to your smartphone. Review the "What Information Do We Collect and Use?" section at the top of this page to learn about what is collected and used in WA Notify.
How Do We Protect Your Information?
WA Notify protects random codes using Google and Apple's Exposure Notification Framework, which includes very specific requirements about how to encrypt and transfer them. WA Notify does not store or generate your random codes — your smartphone does.
Your Rights Over Your Information
Because the verification code and application logs cannot be tied to you without access to your smartphone, DOH has no way to access this information. Because of this, DOH cannot securely provide you with or delete this information if you ask. You control the use of WA Notify. Your smartphone should allow you to turn off exposure notifications or delete the exposure logs stored on your smartphone at any time. Additionally, you can uninstall WA Notify at any time. If you do, all random codes stored will be deleted.