Timeline: What happened with the NHS Covid-19 app

As England comes out of lockdown the use of the NHS Covid-19 app will be an “important pillar” in controlling the spread of coronavirus. The app, touted as an integral part of Test and Trace, was launched in England and Wales in September 2020 following months of setbacks. Senior reporter, Andrea Downey, looks back at what has happened since then.

Since the app was launched in September 2020 it has been downloaded more than 21 million times, with 1.7 million users advised to self-isolate following close contact with someone who had tested positive, recent Department of Health and Social Care figures show.

Digital Health News has been reporting on the app’s development since March 2020 when NHSX first confirmed it was developing a contact-tracing app to monitor and contain the spread of Covid-19. Since then the roll-out of the app has faced several challenges and setbacks.

After an initial trial in the Isle of Wight in May 2020 the app was abandoned due to technical failings, with the government announcing it would work with Apple and Google using the tech giants APIs to develop a new version of the app.

A trial of that version was announced on 13 August, again involving the Isle of Wight as well as NHS volunteer respondents in the UK. From the following week, residents in the London borough of Newham also started a trial of the app.

The revamped app, based on Apple and Google’s technology, was launched across England and Wales on 24 September, 2020. Speaking to Digital Health News in March 2021, Wolfgang Emmerich, founder of Zühlke Engineering which helped build the app, said it would be an “important pillar” in controlling the spread of Covid-19 as the UK comes out of lockdown.

The total cost of the NHS Covid-19 app was expected to top £35 million. Some £25 million was expected to be spent in the 2020/21 financial year, while a further £10 million was spent developing the original operating model that was abandoned following heavy criticism relating to data protection and privacy.

Big app-spirations

It was first reported that NHSX was working on a contact-tracing app as part of a digital solution to managing the pandemic in late March.

Based on Bluetooth technology, the app was designed to track time and distance between devices in order to determine which contacts were most at risk if another app user developed symptoms.

The app relied on the self-reporting of symptoms, which would later cause concern with privacy experts as well as the government’s own ethics advisory board – but more on that later.

Once a user had input their symptoms and was deemed to be a likely case of coronavirus their contacts would then be notified with appropriate advice to self-isolate.

Google it?

Shortly after NHSX revealed they were working on a contact-tracing app, tech giants Apple and Google announced they were joining forces in the fight against Covid-19.

In early April, the companies said they would create contact-tracing technology to enable the use of Bluetooth to help governments and health authorities track the spread of the virus.

The solution would be interoperable with both iOS and Android devices using apps from public health bodies, allowing health services to view data from every person who has opted-in to trace Covid-19.

But the key difference was Apple and Google’s technology was based on a decentralised approach, meaning data would only ever be shared between devices. Whereas NHSX’s app was based on a centralised model, which would see data collected by the app sent to a central NHS database.

At the time Matthew Gould, chief executive of NHSX, told parliament’s science and technology committee that a centralised approach offered “profound benefits” for tracking the virus and suggested waiting for Apple and Google to release their APIs would slow development down.

However, Apple and Google released their APIs on 21 May 2020, before we had a concrete date for the roll-out of the NHS contact-tracing app.

Risky business

From the offset, contact-tracing apps globally faced criticism and concern from privacy experts and campaigners.

A majority of concerns were related to NHSX’s decision to go down the centralised route, with many experts suggesting this offered less security and data protection.

An open letter, published on 19 April 2020 and signed by hundreds of professors from 26 countries, warned contact-tracing apps could “catastrophically hamper trust” if they become a tool for “large scale data collection on the population”.

They urged governments and public health authorities to evaluate the potential dangers of developing contact-tracing technology before releasing an app to market.

At the same time the Ada Lovelace Institute published a rapid review of the technical, social and public health evidence for contact-tracing apps, finding the current “technical limitations” and “social impacts” outweigh the potential benefits of an app.

From there the debate ramped up. BCS, The Chartered Institute for IT, warned those making contact-tracing apps need to have the right privacy measures in place if they are to convince the public to use them.

In late May Polly Sanderson, policy counsel at think tank Future of Privacy Forum, told Digital Health News there were “serious issues” with the app relying on the self-reporting of symptoms instead of verified diagnoses, including data poisoning.

She said the basis for a centralised approach to contact-tracing was based on the “shaky assumption” that self-reporting of symptoms is epidemiologically better.

Professor Christophe Fraser, of Oxford’s Big Data Institute which was advising NHSX on the app, defended the decision to rely on self-reporting, telling parliaments science and technology committee that waiting for test results would result in “less control” of the virus, risking a resurgence.

The app now relies on verified diagnoses and only notifies a user they have come into contact with the virus if a close contact has tested positive.

Trouble at home

Concerns about the app’s security and reliance on self-reporting were not exclusively from independent experts.

The government’s own ethics advisory board, set up in April 2020 to oversee the development of the app, wrote to health secretary Matt Hancock warning unreliable contact-tracing apps could provide a false sense of security and increase the spread of Covid-19.

Chair Jonathon Montgomery raised concerns about the risk of false positives from an app relying solely on self-reporting of symptoms.

Dr Ian Levy, the technical director of the National Cyber Security Centre, also acknowledged privacy risks associated with the app exist “in theory” but that it would require more data to be considered a threat.

Meanwhile, parliaments joint committee on human rights had called for the government to enshrine in law the parameters in which data collected by the app would be used.

Testing times

Despite the concerns, NHSX launched a trial of the app on the Isle of Wight in the first week of May 2020.

Both health secretary Matt Hancock and NHSX chief Matthew Gould had said they expected the app to be rolled-out nationally by mid-May, but when the NHS Test and Trace System was launched on 28 May 2020 the app was notably missing.

By now it had been downgraded from being integral to the test and trace service to being the “cherry on the cake”. Questions began to arise on whether the UK would actually see a contact-tracing app before the first lockdown measures were eased.

Prior to the launch of Test and Trace, Prime Minister Boris Johnson had told parliament the UK would have a “world-beating” tracing system in place by June, further fueling questions on why the app was delayed.

After weeks of silence, the government finally announced on 18 June 2020 that it was abandoning its contact-tracing app and would instead be working with Apple and Google to develop a new version – something experts had been urging for months.

The government had been running field tests on both versions of the technology, which found the NHSX version was able to register about 75% of nearby Android devices, but just 4% of iPhones.

The Apple and Google model was more accurate, logging 99% of Android devices and iPhones, but had difficulty measuring the distance between users’ devices.

Baroness Dido Harding, chair of NHS Test and Trace said neither version was fit for purpose and that the service would focus on creating an app that would “enable anyone with a smartphone to engage with every aspect of the NHS test and trace service”.

The final hurdle

More silence ensued on the progress of the app until a second trial of the revamped version was announced on 13 August 2020, with the NHS Covid-19 app later launched on 24 September. It was downloaded more than 10 million times in the first three days.

The revamped app has a number of features alongside symptom checking and alerts.

This includes:

• QR check-in, which will alert users if they have recently visited a venue where they may have been exposed to the virus
• The ability to book a free test
• An isolation countdown timer to remind people how long they must quarantine for

The app is designed to compliment the Test and Trace programme but won’t share personal data with the system, as per Apple and Google’s decentralised system. It seemed the developers had succeeded in getting privacy right with one expert telling Digital Health News they were reassured it was “more privacy centric” than the original model.

Following the launch, many users of the NHS Covid-19 app were unable to add their tests results to the app if they had requested a test elsewhere. Test results taken as a result of Office for National Statistics surveys, and those processed by an NHS hospital or Public Health England lab were initially not able to be shared via the app.

The Department of Health and Social Care (DHSC) later confirmed everyone who receives a positive test result can now log their result on the app, but further developments were underway to allow negative test results to be entered.

A number of other issues, including ‘ghost notifications’ and errors with the sensitivity level which potentially left thousands of people unaware they needed to self-isolate, were encountered in the months following the launch of the app.

In February 2021 the DHSC confirmed data on the NHS Covid-19 app would be published weekly alongside NHS Test and Trace data. Following the announcement Wolfgang Emmerich, founder of Zühlke Engineering which helped build the app, said the app would prove vital in managing the virus as the third lockdown restrictions were eased.

As hospitality venues, non-essential shops and gyms are allowed to re-open from 12 April 2021 all users will be asked to share data on the venues they’ve visited if they test positive for the virus. The app will share the data with authorities on an opt-in basis to protect privacy, the DHSC confirmed.