How the NHS Covid-19 app works and the reasons behind some of its flaws

The NHS contact tracing coronavirus app , called NHS Covid-19, is based on a piece of software, an API, built by tech giants Apple and Google, who came together in an unprecedented alliance at the start of the pandemic.

It works via Bluetooth, which is fitted to almost every smartphone in the world, and involves a notification system to alert people if they have been in close proximity with someone diagnosed with Covid-19.

Apple and Google let the NHS determine what it deems to be suitable exposure for a a person to be considered at risk for infection.

The NHS set the limit as within 2m for 15 minutes.

However, Apple and Google have openly said the app is not perfect, due to the fact Bluetooth is being used for something it was never designed for.

Therefore, phones with the app installed can struggle to tell exactly how far away another device is.

Although the threshold is set at 2 metres, it emerged in early trials that people as far away as 4m were told thought by the technology to be less than 2m away.

Officials say that about 30 per cent of people told to self-isolate may have been more than two metres away from a positive case.

However, they claim most of these cases will be at a distance of 2.1m or 2.2 m, with 4m being a rarity.

Apple and Google have been aware of this issue since the inception of the project and have recently revealed they have used hundreds of different devices to help calibrate the system.

It is claimed the NHS app is more accurate than other contact tracing apps around the world which also use the Apple and Google API.

All the technology for the app is done in the phone itself, and no external servers are used, helping protect user data.

No location or personal data is sent to Apple, Google or the NHS and all interactions between phones are anonymous.

The randomised and untraceable links are only stored for two weeks on the phone itself before being permanently deleted.

A person can also choose to wipe their data clean, either in the app's settings or by deleting the app.

In a conference call this week, representatives from both Google and Apple said the app is not intended to replace manual tracing, but to enhance it.

They added that, in the tests done in-house during development, 30 per cent of the exposure notifications that were triggered were not picked up by manual contact tracing.

For a person to receive am infection notification via the app, both they and the infected person must both have had the app at the time of their interaction.

During this interaction, on a bus for example, the phones acknowledge the device has met the 2m/15 min criteria.

The devices then automatically exchange anonymous ‘keys’ with each other via Bluetooth. The keys randomise and change approximately every 15 minutes.

If a person then receives a positive test, they receive a unique PIN from the NHS and input this in the app.

Once they have done this, all the anonymised keys from the phone of the infected person are added to a cloud database.

Every app is constantly checking in with the same cloud database to see is any of the 'keys' it has come into contact with match the keys of positive tests.

If a person's phone finds a match, that person then receives a notification informing them they have been exposed and may be infected.

The app then provides that person with detailed information from the NHS on the next steps.

The mobile data needed for the app to work is being allowed free of charge in the UK by network carriers and it is believed the app has negligible impact on battery life.