Contact tracing apps

To support contact tracing, schools and early learning services are encouraged to display a QR Code poster on their site(s) for the NZ COVID Tracer app.

NZ COVID Tracer App

The New Zealand government has introduced an App to support contact tracing:

NZ COVID Tracer App(external link)

Kiwis who download the app will create a digital diary of the places they visit by scanning QR codes displayed at the entrances to business premises, other organisations and public buildings. People can also register their contact information through the app so that the National Close Contact Service can get in touch if they need to.

Further versions will provide increased functionality.

Getting a QR code poster

Schools and early learning services no longer need to register with Business Connect  in order to generate a poster. 

Instead, download and complete this Ministry of Health  poster generating template(external link), and send it back to app@tracing.min.health.nz.

Once the health team receive your completed template they will call you to run a quick verification check, then they can generate your poster and it will be emailed to you.
 
If you have any other general questions about the app, NZ COVID Tracer, please email the Ministry of Health team: tracingapp-feedback@health.govt.nz

NZ COVID Tracer app – Ministry of Health(external link)

Contact tracing requirements

You are no longer required to have a contact tracing register at Alert Level 1.

You will however need to work with health authorities to support contact tracing in the unlikely event there is a case of COVID-19 in your school or early learning service.

A combination of timetable, attendance register and visitor register will provide good information to health authorities, so they can contact people that might be considered a close contact of a confirmed case, and determine whether they will need to self-isolate. 

Please keep your visitor register for at least 2 months.

Using an App for your visitor register

There are a number of contact tracing apps available that may support you to manage a visitor register.

These apps use different approaches and technologies to achieve the purpose of recording who, when and where an individual has been. Examples include Bluetooth, GPS and QR (Quick Response) Codes.

Whatever app or other solution you choose, it is important to think about privacy and security so that people trust you with their personal information.

Here are some questions to consider if you decide to choose a contact tracing app.

How will you use the app?

  • First, and most importantly, make sure people are aware you are collecting information about them, how you’re doing it, and why!
  • If you choose to ask people to use an app, remember that some people may not have access to an app-capable device or adequate network coverage, or they may have other reasons for not using an app.  Do you have an alternative system such as a physical register in place available?
  • Who are you intending to use the app?  You will already be collecting adequate information about your learners to support contact tracing, so the app may be best used by other visitors to your premises such as parents, caregivers, whānau, or service providers.
  • Apps can sometimes create a false sense of confidence ie: that the app will tell me that I am at risk.  It needs to be clear that existing health and safety recommendations and rules still apply.

What do you know about the app vendor?

  • Check if the vendor is based in a jurisdiction that has an adequate privacy regime. Examples include New Zealand, Australia, Canada, the United States, and the European Union.
  • Look for published reviews of the vendor’s reputation – you might check comments on the App store or social media reviews.
  • Check for the vendors published accreditations, for example some vendors may have internationally accepted endorsements
  • Is the app available from a reputable source, such as the App Store or Google Play?  Be very cautious about downloading apps directly from websites.
  • Scan media headlines for any comments regarding privacy and security performance of the app.
  • Read the fine print – make sure the vendor is clear that they will not use information for their own purposes (such as marketing) or on-sell it.
  • Talk with friends and colleagues about their experiences with the app.
  • Have a look at the privacy and security statements on the vendor’s website. Do they provide good detail on the vendors approach, and provide answers to some of the questions below?

Does the app meet security requirements?

  • Keeping information secure, and only available to authorised people is critical. Has the vendor made it clear how they keep information secure from loss or unauthorised access? Is there adequate detail about where information is stored, and how it is secured as it moves around?
  • Every technology has its challenges.  Have the challenges of the apps specific technology been addressed? Examples include:
    • Bluetooth. This is a wireless technology used for exchanging data between devices over short distances. Issues can arise from broadcast mode, or from inaccuracies in distance measuring
    • GPS (Global Positioning Systems). This is real-time location tracking through satellites triangulating a device’s position. Whilst accuracy is generally good there are a number of related privacy issues related to tracking movements
    • QR (Quick Response) Codes. This is a machine-readable optical label (like a bar code) that contains information, can be scanned by a device, and ultimately translates into a link.  Links can be compromised by hackers or malicious code and result in attacks on mobile devices or other intrusions.

Does the app help you meet your privacy requirements?

When choosing a contact tracing app, look at the general requirements of the Privacy Act 1993, and ask the following:

  • For contact tracing you generally only need to collect a person’s name, contact details, and the date and time they were on your premises. Is the app collecting only the bare minimum of information required for contact tracing?
  • You’ll need to be clear about the purpose of your contact tracing app, and tell people what information you’ll be collecting, for what purpose, who it may be shared with. Does the app’s privacy statement specifically limit use and disclosure of your personal information to contact tracing? Is the privacy statement clearly visible or linked to the app’s user interface? Also, remember only the relevant government authorities should be able to see the collected personal information, and they should be listed clearly in the privacy statement
  • Remember that people have a right to know what information you hold about them. Does the app vendor tell you clearly how you can get access to, and correction of, the personal information that it holds?
  • You’ll only need contact tracing information for as long as it is needed for contract tracing purposes. Does the app vendor make it clear that personal information will be permanently and securely destroyed when you no longer need it after the COVID-19 emergency?

Remember, you can find more information and advice on contact tracing from the Unite for the recovery website(external link) and Office of the Privacy Commissioner(external link) websites.

Last reviewed: Has this been useful? Give us your feedback