COVID-19 Exposure Notifications System—Privacy Policy
Effective as of August, 2022
This “Privacy Policy” explains how the Louisiana Department of Health (LDH) collects, uses, discloses and otherwise processes end users’ data in connection with the Google/Apple Exposure Notifications System. The Technology Provider for the Louisiana Exposure Notifications System is the Government of Louisiana Office of Technology Services (OTS). This Privacy Policy also describes the choices available to individuals with respect to data when using the Exposure Notifications System. This Privacy Policy applies to Exposure Notifications device settings in Apple iOS and the Android COVID Defense App developed by Google.
About LDH and the Exposure Notifications System
LDH oversees public health efforts throughout Louisiana. The Exposure Notifications System is intended for use to facilitate contact tracing in response to COVID-19. Contact tracing consists of notifying and monitoring individuals who have been in close contact with someone who is infected with a virus and could potentially infect others. The Exposure Notifications System allows users to store data collected and processed by the System for the purposes of contact tracing locally on the respective user’s mobile device. The Exposure Notifications System can notify users if they have been exposed to a COVID-19-infected individual and provide instructions on how and where to get tested.
Specifically the Exposure Notifications System:
- Does not require your name, age, or address
- Does not require you to create an account or login
- Does not collect your phone number unless you choose to share it for a callback
- Does not track your location
- Cannot be used to check if you should be self-isolating
- Can only access information on your phone that you decide to enter or allow
- Cannot be used to identify who are your close contacts
- Cannot be used to identify people who tested positive for coronavirus
- Requires a user to enable Bluetooth and exposure notifications for the system to function
How it works
Android users can download COVID Defense on the Google Play store.
iPhone users can enable Exposure Notifications in their phone settings by finding Settings > Exposure Notifications > United States > Louisiana.
The Exposure Notifications System does not collect your name, address, location, age, or other demographic details, without your consent or “unless you consent”. You do not create an account and can use the system anonymously. Bluetooth random IDs are assigned to each device using the Exposure Notifications System. Each user’s random code changes frequently to further protect their identity. When an Exposure Notifications System user comes into close contact with another user, their random codes are exchanged using Bluetooth. Random codes for close contacts are stored in a user’s device for 14 days. No personally identifiable or location information is collected, stored, or exchanged during this process. When a user tests positive and enters the verification code; all of the time-relevant random keys are submitted to LDH, and are then made available for other users' phones to check if there is a match. If there is a match an exposure notification is presented on the user’s phone; along with recommendations on what to do next. Both users' anonymity are maintained throughout the process.
User tests positive
If a user tests positive for COVID-19, they may choose to notify other Exposure Notifications System users who have had close contact with them. To trigger such notification, a user who tests positive for COVID-19 must enter a valid, 8-digit verification code provided by a LDH contact tracer. This verification code is randomly generated by LDH and only used to enter a positive diagnosis in the Exposure Notifications System. Users receive the verification code from LDH from contract tracers via a phone call or from an SMS message.
User enters a verification code
Once a valid verification code is entered into the Exposure Notifications System, a risk calculation is made using the time, duration, and Bluetooth signal attenuation (proximity indicator) collected by the Exposure Notifications System for each contact event between Exposure Notifications System users, and other Exposure Notifications System users who are calculated to have been in close contact with the user who tested positive will be alerted. Users then receive exposure notifications in the Exposure Notifications System to let them know they encountered a possible exposure.
Your choices
Using the Exposure Notifications System
Using the Exposure Notifications System is completely voluntary, and you may choose to enable and disable Exposure Notifications settings or install and uninstall the COVID Defense App at any time. The Exposure Notifications System will never collect, track or store your location or GPS information. It also does not require you to create an account or share your personal information; with the exception of if you would like to schedule a phone call with an LDH contact tracer; you can optionally share your phone number.
Enabling exposure notifications
Enabling exposure notification in the Exposure Notifications System is your choice. You can enable and disable such notification at any time. It must be enabled for the Exposure Notifications System to exchange the random codes with other Exposure Notifications System users who you come into close contact with, for you to receive exposure notifications, or for you to notify other Exposure Notifications System users if you test positive for COVID-19 by sharing your random codes through a positive report.
Notifying other system users if you test positive
If you test positive for COVID-19, you may choose to notify other Exposure Notifications System users who you have been in close contact with. Providing notification to other Exposure Notifications System users with whom you have had close contact is completely voluntary. The notification will not disclose your identity or any personally identifying information. To enable such notifications, you will need a valid, 8-digit verification code provided by LDH. This verification code is used to verify your positive diagnosis and prevent false reports. This verification code is not associated with your identity. Once a valid verification code is entered into the Exposure Notifications System and you confirm that you wish to anonymously notify other users you may have encountered, after you confirm, all Exposure Notifications System users who have enabled their device or app configuration to receive notifications will receive your Bluetooth random IDs to determine if there has been any close contact with you. Such notifications will not include your identity or the date, time, or location of the exposure.
The system will also present to a user a multi-day time window, about when someone was in close contact with someone who tested positive for coronavirus. This is so you can discuss with your medical provider or a contact tracer to receive more accurate advice based on how long ago it has been since you were exposed to the virus.
Terminating system participation
Participation in the Exposure Notifications System may be terminated at any time by disabling the Exposure Notifications device settings in iOS or deleting or uninstalling the COVID Defense App from your device. After the Exposure Notifications System is disabled, deleted, or uninstalled, your device will no longer generate or exchange Bluetooth random IDs with other users. Any Bluetooth random IDs that were previously shared with other Exposure Notifications System users will be automatically deleted after 14 days from the date the verification code was generated.
Collection and sharing of event data
The following event data may be processed and collected in the Exposure Notifications System:
- Installing and deleting the COVID Defense App
- Enabling and disabling Exposure Notifications
- Receiving an Exposure Notification
- Submitting a verified verification code
- Sharing a positive result
- Downloading anonymous tokens for positive users that have chosen to notify others
We use the above event information to understand how the Exposure Notifications System is being used. This data may be shared with other entities. It may be used in aggregate and anonymous form for statistical or scientific research purposes. This information will not include any personal or location information nor can it be used to identify any Exposure Notifications System user.
Collection and sharing of personal data
Personal data used by the system can be provided
- by you (if you choose to provide it)
- as well as your phone.
Personal data you can choose to provide in the system
- your name, phone number and
- symptom onset date and the types of signs and symptoms you experience.
You don't have to provide any of this data if you don't want to.
Personal data provided automatically by your phone includes your IP address. If you consent to share this data; we only use it for debugging purposes.
Your phone number
We will not know your phone number unless you choose to share it. You may decide to share it if you want to receive a follow-up call if you need help or because you are a close contact of someone who has coronavirus. If you input your phone number; the LDH contact tracing team will call your phone to provide you support and guidance on testing, preventative measures, and resources to support you during this time.
Separately, through other manual contact tracing activities different from the Exposure Notifications System, LDH contact tracing team may interview COVID positive individuals who also share their close contacts' and associated phone numbers. This means that you could get a phone call from them without sending them your number through this system. All conversations with contact tracers are confidential and optional.
Your health information
If you use the COVID symptom tracker in the COVID Defense App, the app will ask you to share:
- your symptoms and when they occurred
- no other personal or demographic details
If you input this information in the app, it is not sent outside of the app. This information is to help you determine when others around you may have been exposed and to help you determine if you should seek out and find a laboratory test.
Data about how you use the system
We collect data about how you use the system. This is called system 'metric data'.
We collect it to improve the app and to understand:
- how the system is being used as well as bugs and errors
- its impact in helping slow the spread of the virus
This metric data does not reveal your identity. But it's your choice if you want to share this data or not.
Opting out of push notifications
If you opt-in to receive push notifications within the Exposure Notifications System, it may send push notifications or alerts to your mobile device from time to time. You can deactivate push notifications and alerts at any time by deleting the COVID Defense App, changing the push notification settings within the COVID Defense App, or changing your device settings.
Age requirements
COVID Defense App is not intended for children under the age of 13, and we do not knowingly allow a child under 13 to use the App. If you are between the ages of 13 and 17, you can only use COVID Defense App if your parent or legal guardian has reviewed and agreed to the Terms of Service on your behalf.
Changes to our privacy policy
We may update this Privacy Policy from time to time. If we make material changes to our Privacy Policy, we will notify you by posting the changes on the COVID Defense App or by using the contact information you provide to the Exposure Notifications System. The notification will indicate when such changes will become effective.
If you object to a new Privacy Policy, you may terminate participation in the Exposure Notifications System by deleting or uninstalling the COVID Defense App or disabling your device settings.
If you have any feedback, or any questions, comments, or concerns relating to this Privacy Policy or our privacy practices, please contact us at our Contact Us page or write to us at the following address:
Division of Administration
Office of Technology Services
1201 N. Third Street, STE. 7-210
Baton Rouge, LA 70802