Washington Exposure Notifications Privacy Policy

This privacy policy applies to the COVID-19 WA Exposure Notifications app. This is the official exposure notification technology for Washington State, created with the oversight and endorsement of the Washington State Department of Health.

In keeping with Google and Apple's approach, WA Exposure Notifications is designed to collect and use as little personal information as possible in order to enable exposure notification, and help limit the spread of COVID-19.

What Information Do We Use?

WA Exposure Notifications does not collect or use any personally-identifying information except for:

• Random IDs (also known as Rolling Proximity Identifiers)
• These rotating identifiers are shared via Bluetooth between users who have installed the app on nearby devices. This process is managed by your device, not WA Exposure Notifications.
• These identifiers are generated by and stored on your device, not by WA Exposure Notifications, and are used only to allow WA Exposure Notifications and your device to check for exposure when you or someone else uploads a Temporary Exposure Key.
• Temporary Exposure Keys (also known as Diagnosis Keys)
• If you receive a positive test result, you will be given a Temporary Exposure Key for you to upload and share with all users of the app, only if you decide to do so. You completely control the decision whether to upload the Temporary Exposure Key or not.
• WA Exposure Notifications stores your Temporary Exposure Key for at most thirty days.
• Other users can then use WA Exposure Notifications to determine if any of the Random IDs their device has come into contact with are associated with a Temporary Exposure Key (and thus, whether they may have come into contact with an individual who has tested positive for COVID-19).
• App Usage Logs
• As with almost any app or internet service, WA Exposure Notifications automatically generates logs when you use the service. These logs include some information about your device. We use this information to troubleshoot issues with WA Exposure Notifications.
• These logs DO NOT include Random IDs or Temporary Exposure Keys, and cannot be used to tie either a Rolling Proximity Identifier or Temporary Exposure Key back to you or your device.
• These logs are automatically deleted 7 days after they are generated.

WA Exposure Notifications does not collect location data from your device, and does not collect or share information tying you or your device to either the Random IDs or Temporary Exposure Keys you generate.

When Do We Share Your Information?

We will not voluntarily share any of your personal information with anyone, except:

• When you choose to upload a Temporary Exposure Key WA Exposure Notifications will share that information (which cannot be linked back to you by someone who does not have access to your device) with other devices that have been in contact with your device, as described in the Google and Apple Exposure Notification Framework.
• We store your personal information in an encrypted form using Amazon Web Services. Amazon Web Services may store this information outside of Canada, including in the United States.

How Do We Protect Your Information?

WA Exposure Notifications protects Temporary Exposure Keys using Google and Apple’s Exposure Notification Framework, which includes very specific requirements as to how this information will be encrypted and transferred. WA Exposure Notifications does not store or generate your Random IDs—that is handled by your device.

Your Rights Over Your Information

Because we have no way to tie a Temporary Exposure Key or our Access Logs to you without your device, we have no way to securely provide you with or delete this information upon request. That said, you have complete control over your use of this technology. Your device should allow you to turn off exposure notifications or delete the exposure logs stored on your device at any time. Additionally, you can uninstall WA Exposure Notifications at any time. If you do so, all Temporary Encryption Keys stored by WA Exposure Notifications will be deleted.

If you have any questions or complaints about the WA Exposure Notifications app’s privacy practices, you can email us at wanotify@doh.wa.gov.

Last updated October 29, 2020