Users can now choose to share with the government whether or not their sample has been collected for COVID-19 testing on Aarogya Setu, and if they have tested positive for COVID-19. Users can also know how many people in their neighbourhood (up to 1 kilometre) are at risk, are COVID-19 positive, have taken the self-assessment test, have been self-assessed as “Unwell”, amongst other things. Some of the features that we had reported upon earlier have now been included.

1. Upload information about sample collecting, COVID-19 positive status

In the updated app, once users select the option about sample collection, users can proceed only if they confirm that they understand that their Bluetooth and GPS services will be shared with the government.  The privacy policy (which was last updated on April 12) does not mention that data about sample collection would be sought from users. It is not clear how collecting such data from Aarogya Setu users is useful.

This dialog box can be accessed by clicking the caution icon on top-left of the app (circled in Screenshot 1). On selecting both “Sample Collected for Testing” and “Tested Positive for Covid19”, the second screen appears. I selected “Confirm & Proceed” only for the first option (sample collection) and got the third screen.

It is not clear if users can select the option for having tested postitive for COVID-19 only in the presence of a medical officer. I was too conscious of taxing scarce health resources to test the feature with a false response. The Ministry of Home and Family Welfare said in its latest guidelines for home isolation that patients with mild cases of the virus must download the app. However, there isn’t anything in the app that prevents a user from uploading false information about this. Limiting the conditions around uploading this information will help in limiting abuse of the app.

2. Information about the neighborhood

The updated app also gives certain information about the neighbourhood up to a radius of 1 km: how many users have taken the self-assessment test (not clear if it is the number of users/devices the test has been taken on or the number of times the test has been taken), how many users self-assessed as “Unwell”, how many users have been diagnosed with COVID-19 positive, how many users have been identified as “At-risk” via Bluetooth proximity.  It is not clear if the COVID-19 positive diagnosis is determined by someone selecting “Tested positive for COVID-19” on the app, or if that’s data that is pushed on devices from the back end.

Aarogya Setu now gives neighbourhood details as well.

Interestingly, in response to a comment on a comment on the Play Store, the developers say that the radius is 2 kilometre. We only saw 1 kilometre on both iOS and Android.

Issues with giving such information for an area with radius of 1 kilometre:

  • Anonymisation is undermined: If this area has a very low population density, it can be very easy to figure out who has COVID-19 and who does not, and who is at risk. Even in places with higher population density, moving across neighbourhoods can give enough information to narrow down suspected patients significantly.
  • Overstepping privacy policy and terms of use: Such usage goes beyond the stated objectives of using Bluetooth and location data of users. As per the privacy policy, personal information (name, gender, age, profession, travel history and phone number) will only be used in “anonymized, aggregated datasets for the purpose of generating reports, heat maps and other statistical visualisations for the purpose of the management of COVID-19 in the country or to provide you general notifications pertaining to COVID-19 as may be required”. Location and Bluetooth data were to be used only by the government to identify if “disease clusters” were forming, not to share the data with anyone, even in an anonymised manner. At this stage, in the absence of a data protection law, the Privacy Policy and the Terms of Use are the only two documents through which the developers of this app can be held responsible for their actions.

3. Other features: Bluetooth and GPS usage, Media tab

Bluetooth and GPS usage: Details of Bluetooth and GPS usage are calculated from the time of downloading the app. Thus, if users delete the app and install it afresh, the counter starts again. It doesn’t pop up when you open the app for the first time after downloading it.

Comparison of the updated app on iOS (L) and Android (R) devices: On the iOS device, we did not give the app permission to use Bluetooth, which is why Bluetooth Active Time is 0%. Similarly, for location services, we switched it to “Only while using the app”. On Android, we do not have the option of not using Bluetooth services or location services. This is why it shows that Bluetooth and GPS have been active 97% of the time since the app was downloaded.

Media tab, Trending Now section, and video integration: The updated app has a Media tab and a Trending Now section which currently have videos related to COVID-19 and protecting yourself from the virus. The videos include one featuring MEITY Secretary Ajay Prakash Sawhney explaining how the app works and and others on how to protect yourself, boost your immunity, and make your own masks.

Notice that on an iOS device, the app doesn’t use active location data all the time. It accesses the user’s location data when you launch the app after quitting it (symbolised by clack arrow), and then resorts to geofencing (that is, an action will be performed on the phone only when the user changes their location; symbolised by hollow arrow.)

We also noticed that if users who have taken the risk assessment test in the past and download the app afresh, the app says “Assess again” showing that it recalls previous data. In the last update, we had reported that the app takes consent for uploading these test results to the government server. Interestingly, the app now doesn’t immediately change the user’s risk status on the basis of the test unlike earlier.

Interestingly, the “COVID Updates” tab, which gives details of the number of confirmed COVID-19 cases in the country, provides the numbers of confirmed cases, recovered cases and deaths right on the top, something that the MoHFW website provides right at the bottom of the state-wise data; the MoHFW instead provides the number of active cases right on the top of the website, which is total cases minus recovered cases and thus, always less than the number of confirmed cases.

COVID-19 data displayed on Aarogya Setu.

For all the features and data usage that are unclear, we have reached out to NITI Aayog for clarifications and will update the story as we learn more.