North Dakota Gov. Doug Burgum issued the following statement today in response to reports on data and privacy related to the Care19 contact tracing app.
Tim Brookins, CEO of ProwdCrowd, which developed and launched the Care19 app in partnership with the North Dakota Department of Health, explained that Care19 uses a third-party service to help properly detect what places the user visits. Current versions of Care19 use Foursquare for this service.
The Care19 app user interface clearly calls out the usage of Foursquare on its "Nearby Places" screen, as required by the terms of the agreement with Foursquare. Brookins noted the agreement does not allow Foursquare to collect Care19 data or use it in any form, beyond simply determining nearby businesses and returning that information. The Care19 privacy policy has been revised to explicitly call out this usage and make it clear that Foursquare does not store or use the data for other purposes.
“The simple overarching fact here is that Care19 has stated, and Foursquare has confirmed, that they have not, and will not, collect any data from Care19 users,” Brookins said.
Following is the official response from Foursquare:
“Foursquare receives some data from Care19, a free user of our SDK, but we do not use the data in any way and it is promptly discarded. For free users of our SDK, Foursquare does not use, repackage or resell the data. Essentially, any data we might receive is immediately discarded. Here is our license agreement for developers using our SDK.
“We appreciate that Jumbo Privacy (which was founded by Foursquare alumni, and we’re proud of their mission) commits to protecting consumer privacy — we deeply believe in the same principle. In ensuring due diligence on our end, I can confirm that when reviewing Care19 as a free user, we are adhering to our commitment that no data is used in our downstream products.
“When we opened up Pilgrim SDK for free users, it was important to us that this technology could be used to empower independent developers to build engaging, useful and valuable app experiences, but first, they must meet three main guidelines: 1) provide real consumer utility per our license agreement, 2) obtain opt-in consent from users, and 3) be clear in their privacy policy and consent notifications about what data is being collected by the app.
“We’re glad to see app developers use our location technology for good. It pushes innovation forward, which is why we wanted to open up our SDK in the first place. Equally important to innovation are the ethical and privacy values behind it, and we remain committed to ensuring the proper safeguards and practices are in place.”
In addition, as noted in the privacy policy, Care19 collects various forms of usage data for the app, for example app crashes, support diagnostics and data on the app’s usage such as screens most viewed and adoption rates for new versions of the app. Two services are used to analyze this data, Google Firebase and Bugfender.
The privacy policy has been updated to clarify that Google Firebase and Bugfender may have temporary access to aspects of the data for their specific data processing tasks but will not collect this data in a form that allows themselves or others to access or otherwise use this data. None of this data includes user location information that Care19 collects.
If they have concerns, users may choose to delete their data stored on ProudCrowd servers at any time by pushing the "Erase Data" button on the Care19 About screen.
Burgum announced Wednesday that North Dakota will launch a second contact tracing app using exposure notification technology developed by Apple and Google. The app, named Care19 Exposure, is expected to be available within the next two weeks. The existing app, which has more than 33,700 users, will be rebranded as Care19 Diary. Data is collected anonymously in both applications, and participation is always voluntary.
For more information on North Dakota’s COVID-19 response, visit www.health.nd.gov/coronavirus or www.ndresponse.gov.