SINGAPORE – The TraceTogether token and mobile phone app are used for contact tracing.
They exchange short-distance Bluetooth signals with nearby users of the token or app to quickly track people exposed to confirmed Covid-19 cases.
But what kind of data does TraceTogether collect?
When signing up for TraceTogether, a random user ID (a string of numbers and letters) is generated and linked to the user’s contact number and identification details, such as his name and NRIC number.
These details are stored in a secure server, according to the TraceTogether website.
The Ministry of Health (MOH) uses the identification details to contact the right person when necessary.
When app or token users are near one another, their user IDs are exchanged in an encrypted and randomised form, and can be decrypted only by MOH.
The encrypted Bluetooth data exchanged is stored in the app or token, and does not contain personal identifiable information.
Bluetooth data older than 25 days is also erased automatically.
Only when a user tests positive for Covid-19 will MOH request that he upload the Bluetooth data to the Government’s servers for tracing close contacts.
The app also collects anonymised information about a user’s phone and app, such as the phone model and app version, to help the Government improve the app and provide a better user experience. This data does not have personal identifiable information.
No global positioning system location data is collected.
The Android version of the app needs “location permission” from the user because Android requires apps requesting Bluetooth access to also get permission to access the user’s location information.
Still, the TraceTogether app does not collect or use the location data on Android devices.
Data about a user’s Wi-Fi and mobile networks is not collected by TraceTogether.
Deletion requests
Users can also request for their identification data to be deleted from the Government’s server, unless they are confirmed Covid-19 cases and their proximity data – or information about people near them – has already been uploaded to the Government’s server.
For a user of the TraceTogether app, he can make the deletion request by e-mailing support@tracetogether.gov.sg with the mobile number he registered in the app.
For a user of the TraceTogether token, he can return the physical token to the Government by first e-mailing support@tracetogether.gov.sg with the last four characters of his NRIC, FIN or passport number. The Government will then let him know how to return the token.
When the request is received and can be made, the Government will delete the user’s contact or mobile number, identification details and random user ID from its server.
Once the deletion is completed, the data that the user’s device has exchanged with other users’ devices becomes meaningless because that data is no longer linked to the user.
Such a deletion also means that efforts to find close contacts of confirmed Covid-19 cases could be affected.
When the need for contact tracing ends, users will be prompted to disable the TraceTogether app’s functions or return or throw away the token.
The app’s functions can be disabled by turning off its Bluetooth permissions or deleting the app.
