Does Healthy Together COVID-19 app store and track phone contacts of users? Fact Check

A message on social media claims that COVID-19 contact tracing app Healthy Together will have access to a user’s phone contacts, and can track or locate those phone contacts.

The message poses as a copy & paste warning from each person who chooses to copy and post it, asking their friends to remove them from Facebook and from their phone contacts if they choose to install the Healthy Together app.

MIXTURE

An example of the message can be seen below.

To all my contacts who intend to install this COVID-19 app Healthy Together or similar apps, please delete me from your phone contact list and Facebook BEFORE installing this app on your smartphone!I
You DO NOT have my consent to use MY phone number in connection with your app to identify, track or locate MY family/friends with these apps.
As I understand it, all of your contacts will be known, and this will all be done without prior consent or knowledge,so PLEASE COUNT ME OUT!
Having seen what’s going on in China with this program I refuse to have any part of it!!
Thank you for your understanding. It is nothing personal.
(Feel free to copy)

The message contains a mixture of real and misleading information.

Firstly, it is important to note that the Healthy Together app, at the time of writing, has been developed for use within the US state of Utah. While it may be expanded to other areas, at the time of writing, this is the only area that has authorised deployment of this particular app.

As such, unless you live in Utah, visit it frequently or have friends or phone contacts that do, the message above would be irrelevant to you.

As for the permissions, the Healthy Together app uses a combination of Bluetooth data and GPS data to track those who have the app installed and running on their devices. These permissions are used so the app can tell you if you’ve come into contact with someone who tests positive for COVID-19, or so the app can tell others if they come into contact with you if you test positive for COVID-19. This is the contact tracing aspect of the app.

Sponsored Content. Continued below...

The Bluetooth permission is used to determine if you’ve come into close contact with another user running the app. The GPS location data helps with this but also helps the state identify “hot spots”. Other apps – such as the Australian tracing app and the Google developed API – use only Bluetooth data and not GPS location data. However users can enable or disable the types of location data in the preferences of the app.

The message above claims that the app can store the phone contacts of someone using the Healthy Together app, and use it to track and locate them. This is only half true. The app does include a feature that invites a user to share their phone contacts with the app. According to the Healthy Together privacy policy, this

This is so the app can allow the user to invite their friends to use the app. From the privacy policy –

Contact List. If you choose to share your mobile device contacts or address book with Healthy Together, we will store your contacts or address book information, including the phone numbers and names of your contacts, to enable you to invite your contacts to Healthy Together and help facilitate your user experience.

While this feature is optional and can be skipped, from a privacy perspective, this is a poor reason to ask a user to share their phone contacts with the app, since doing so isn’t required for the app to work and falls outside of its remit.

It seems users are invited to share this information simply so they can more easily share the app with their friends. We would like to see this feature removed since the circulating message above is correct in its statement that this involves the information of someone not using the app having their data shared with it without their knowledge or consent.

However the circulating message is incorrect in its statement that this allows the app or its developers to track or locate a user’s phone contacts. A person would need to have the app installed themselves for it to track them. The contact tracing app only recognises when two people have come into proximity with other if both of those users having the app installed.

As such, we rank the message above as mixture.