| NHS COVID-19 | |
| Screenshot Size: | 250px |
| Screenshot Alt: | Screenshot of app on Android device |
| Collapsible: | yes |
| Author: | NHSX |
| Discontinued: | yes |
| Latest Release Version: | 6.0 |
| Platform: | Android, iOS |
| Language: | English, Welsh |
| Genre: | Contact tracing app |
| License: | MIT |
NHS COVID-19 was a voluntary contact tracing app for monitoring the spread of the COVID-19 pandemic in England and Wales, in use from 24 September 2020 until 27 April 2023. It was available for Android and iOS smartphones, and could be used by anyone aged 16 or over.[1]
Two versions of the app were created. The first was commissioned by NHSX and developed by the Pivotal division of American software company VMware. A pilot deployment began in May 2020, but on 18 June development of the app was abandoned in favour of a second design using the Apple/Google Exposure Notification system. Scotland and Northern Ireland had separate contact tracing apps.
A 2023 study estimated that in its first year of use, the app's contact tracing function prevented an estimated 1 million cases, and 9,600 deaths.
The app allowed users to:
At first, "close contact" was defined as being within 2 metres for 15 minutes, or within 4 metres for a longer time.[9] These time durations were reduced from 29 October 2020, to as little as three minutes when the other person is at their most infectious, i.e. soon after they begin showing symptoms.[10] [11]
The Android app was coded in Kotlin, and the iOS app in Swift. The backend used Java and is deployed to Amazon Web Services using Terraform.[12] The code of the app and back-end is open-source and available on GitHub.[13]
The app was part of the UK's test and trace programme which was chaired by Dido Harding; from 12 May 2020 Tom Riordan, chief executive of Leeds City Council, led the tracing effort.
In March 2020, NHSX commissioned a contact tracing app to monitor the spread in the United Kingdom of the coronavirus disease 2019 (COVID-19) in the 2020 pandemic, developed by the Pivotal division of American software company VMware. The app used a centralised approach, in contrast to the Google / Apple contact tracing project. NHSX consulted ethicists and GCHQ's National Cyber Security Centre (NCSC) about the privacy aspects.[14]
The app recorded the make and model of the phone and asked the user for their postcode area. It generated a unique installation identification number and also a daily identification number. It then used Bluetooth Low Energy (BLE) to record the daily identification number of other users nearby.
If a user was unwell, they could tell the app about symptoms which are characteristic of COVID-19, such as a fever and cough. These details were then passed to a central NHS server. This would assess the information and notify other users that have been in contact, giving them appropriate advice such as physical distancing. The NHS would also arrange for a swab test of the unwell user and the outcome would determine further notifications to contacts: if the test confirmed infection with COVID-19, the contacts would be asked to isolate.
By June 2020, £11.8 million had been spent on the app;[15] in 2020–21, £35 million was spent on the app.[16]
The first public trial of the app began on the Isle of Wight on 5 May 2020 and by 11 May it had been downloaded 55,000 times.[17]
When the first national contact tracing schemes were launched – Test, Trace, Protect in Wales on 13 May, then on 28 May NHS Test and Trace in England, and Test and Protect in Scotland – the app was not ready to be included.[18] Replying to a question at the government's daily briefing on 8 June, Hancock was unable to give a date for rollout of the app in England, saying it would be brought in "when it's right to do so".[19] On 17 June, Lord Bethell, junior minister for Innovation at the Department of Health and Social Care, said "we're seeking to get something going before the winter ... it isn't a priority for us at the moment".[20]
On 18 June, Health Secretary Matt Hancock announced development would switch to the Apple/Google system after admitting that Apple's restrictions on usage of Bluetooth prevented the app from working effectively.[21] At the same press briefing Dido Harding, leader of the UK's test and trace programme, said "What we've done in really rigorously testing both our own Covid-19 app and the Google-Apple version is demonstrate that none of them are working sufficiently well enough to be actually reliable to determine whether any of us should self-isolate for two weeks [and] that's true across the world".
The first, ultimately rejected, version of the app was subject to privacy concerns, the government backtracking on initial statements that the data collected from the app would not be shared outside the NHS. Matthew Gould, CEO of NHSX, the government department responsible for the app, said the data would be accessible to other organisations, but did not disclose which. Data collected would not necessarily be anonymised and would be held in a centralised repository. Over 150 of the UK's security and privacy experts warned the app's data could be used by 'a bad actor (state, private sector, or hacker)' to spy on citizens. Fears were discussed by the House of Commons' Human Rights Select Committee about plans for the app to record user location data. Parliament's Joint Committee on Human Rights said this version of the app should not be released without proper privacy protections.
The second version of the app, released nationwide, addressed these concerns by employing a decentralised framework, the Apple/Google Exposure Notification system. Under this system, users remain pseudonymous: a person diagnosed with COVID-19 does not know which people are informed about an encounter, and contacted persons do not receive any information about the person diagnosed with COVID-19.
The functionality of the app was also questioned in late April and early May 2020, as the software's use of Bluetooth required the app to be constantly running, meaning users could not use other apps or lock their device if the app was to function properly.[22] The developers of the app were said to have found a way of working around this restriction.[23]
Faculty – a company linked to Cambridge Analytica – provided research and modelling to NHSX in support of the response to the pandemic. Palantir, also linked to Cambridge Analytica, provided their data management platform. These contracts began in February and March respectively.[24] [25]
As outlined on cancellation of the first app on 18 June 2020, the Department of Health and Social Care published on 30 July a brief description of the "next phase" app. Users would be able to scan a QR code at venues they visit, and later be notified if they had visited a place which was the source of a number of infections; the app would also assist with identifying symptoms and ordering a test. By using the Exposure Notification system from Apple and Google, personal data would be decentralised.[26] Zuhlke Engineering Ltd, the UK branch of Swiss-based Zühlke Group, used 70 staff to complete the development of the app in 12 weeks.[27]
Zuhlke Engineering was awarded "Development Team of the Year" title at UK IT Industry awards in November 2021 for development of NHS COVID-19 application.[28] [29]
Testing of the app by NHS volunteer responders, and selected residents of the Isle of Wight and the London Borough of Newham, began around 13 August.[30] [31] The app was made available to the public (aged 16 or over) in England and Wales on 24 September.[32] [33]
An updated app released on 29 October, in part from collaboration with the Alan Turing Institute, improved the accuracy of measurements of the distance between the user's phone and other phones.[34] At the same time, the duration threshold for determining exposure was reduced; this was expected to lead to an increase in the number of users told to self-isolate.
An update to the app in April 2021, timed to coincide with easing of restrictions on hospitality businesses, was blocked by Apple and Google. It was intended that users who tested positive would be asked to share their history of visited venues, to assist in warning others, but this would have contravened assurances by Apple and Google that location data from devices would not be shared.[35]
The app was downloaded six million times on the first day it was generally available (24 September 2020), and after a little over three days the total exceeded 10 million.[36]
After approximately two weeks the app had been downloaded around 16 million times, and Sky News reported that only one alert for an outbreak linked to a venue had been sent.[37] After five weeks, around 29 October, there had been 19 million downloads; this was said to equate to around 40% of adults with access to a compatible smartphone,[38] which Dido Harding stated was "a better performance than any other country where downloading isn't compulsory".[39]
By the end of 2020 the number of users with the app installed had fallen to 13.5million, of whom an estimated 11.5million had the app fully operational (Bluetooth and notifications turned on, and location sharing enabled if applicable).[40] At that time it was the second most-downloaded free application in the UK in the Apple App store,[41] behind Zoom and above TikTok. In 2021, the number of users began to rise again from April, reaching a peak of almost 18million in July and then falling over the next few months to end the year at 13.6million, of which 9.9million were estimated to be operational. 2022 saw a gradual but steady decline in user numbers, reaching 8.3million by the end of October.
The app's effectiveness was evaluated in a February 2021 report by a group of statisticians and epidemiologists[42] from the Alan Turing Institute and the University of Oxford, who analysed the analytical data produced by the app and created epidemiological models assessing the app's impact. It was concluded that during the first months of the second wave of the COVID-19 pandemic, the 1.7 million exposure notifications sent by the app prevented around 600,000 cases of infection in England and Wales between its launch on 24 September 2020 and the end of December 2020.[43] A later study published in Nature Communications in February 2023 estimated that in its first year of use (October 2020 to September 2021) the app's contract tracing function led to around 1 million fewer cases and 9,600 fewer deaths.[44]
In August 2021, the Office for Statistics Regulation reviewed the statistics published by the Department of Health and Social Care, relating to Test and Trace as well as (for the first time) the app. This resulted in a letter from the Director General for Regulation which called for more detail to be published on the quality of statistics about the app, in view of limitations arising from the anonymity granted to app users.[45]
At first there was no link between the app and those of other jurisdictions, but by November 2020 agreements were reached to allow exchange of data with the apps used in Gibraltar, Jersey, Northern Ireland and Scotland; those apps were also based on the Apple/Google system.[46] [47]
At first, users found they could not enter a positive infection test into the app if the test had been arranged outside the app, such as tests carried out as part of surveys or by NHS hospitals or clinics. This issue was addressed quickly, and from 27 September users could request a code from NHS Test and Trace which they could use to log a positive result. However, the app remained unable to recognise negative results from these tests.[48]
It was reported that preparations for the update to the app in late October uncovered a configuration error in the initial version: the threshold for the time spent near an infectious person had been too high, leading to fewer alerts to users.
Privacy safeguards meant that people notified by the app to self-isolate could not claim the £500 Test and Trace Support Payment under the scheme which began on 28 September 2020. (The payment is made to employed people who are asked to isolate, if they cannot work at home and are receiving certain state benefits or have a low income.)[49] This was rectified on 10 December.[50]
During the UK's third wave of COVID-19 in June and July 2021, when social distancing rules started to be relaxed and close contacts were increasing, the number of people being notified by the app and asked to self-isolate increased sharply. The term pingdemic – a play on ping, meaning notification, and pandemic – became popular in the UK's media as many people, including the Prime Minister and other senior ministers, were affected.[51]
In late July, the government responded by expanding the list of critical occupations, adding sectors including waste disposal, the food industry and transport. These workers who are close contacts of infected people are exempt from self-isolation but should take daily COVID-19 tests.[52] Further changes were made on 16 August: contacts of infected people no longer have to isolate if they are under the age of 18 or if they had their second vaccine dose at least 14 days previously. Instead, they are advised to take a PCR test.[53]
In March 2023, it was reported in the Guardian that the NHS COVID-19 app would be decommissioned due to decreasing demand and the end of lockdown restrictions, though vaccine passport functions would remain available in the NHS app.[54] The final version was released on 24 April[55] [56] and it was closed on 27 April.[57]
Within NHSX, the project was led by CEO Matthew Gould and Geraint Lewis.[58] Around 17 June, Gould and Lewis returned to their other duties, and Simon Thompson – chief product officer at online supermarket Ocado and a former Apple executive – was brought in to manage the project.[59] In October, Thompson was replaced by Gaby Appleton, on a six-month secondment from a directorship at academic publisher Elsevier.[60]
In October 2020, Randeep Sidhu held the post of 'head of product' for the app.[61]