Question to the Department of Health and Social Care:

To ask Her Majesty's Government what security and privacy provisions are being used to protect the data of the users of the NHSX contact-tracing app, while making it effective for use by epidemiologists and public health officials.

NHSX recognises that users must have trust and confidence in the way personal data is collected by the app and subsequently used by epidemiologists to respond to the COVID-19 crisis. We have prioritised security and privacy in all stages of the app’s development and have drawn on expertise from across Government and industry to review our app designs. Any user data collected centrally by the National Health Service will be held to the highest security standards. In addition to the continual monitoring, review and oversight undertaken by the NHS we have consulted with the National Cyber Security Centre to review and supplement our processes. Companies working for the NHS will be bound by data processing agreements that specify how the data must be secured, used, and destroyed. For an explanation of how the risk scoring algorithm works we have published an explanation on the FAQ page of the NHS COVID-19 website.