Alaska COVID ENX Privacy Policy

Alaska COVID ENX is the COVID-19 exposure notification system powered by technology developed by Apple and Google. The University of Alaska Anchorage (UAA) operates the service for Alaska.

The ENX system is designed to protect user privacy. The following non-identifying analytics data may be collected in Alaska COVID ENX:

• Metrics on the number of devices contributing anonymous data
• Exposure notification metrics and interaction metrics
• Submitting a verification code or verification link
• Uploading a random code to notify others of potential exposure

This data may be shared with public health entities. It may also be used in aggregate form for statistical or research purposes. The aforementioned data does not include any personal or location information nor will it be used to identify any Alaska COVID ENX user.
Random codes are generated by your smartphone and stored locally on your phone. A random code is stored for a maximum of 14 days. They are shared via Bluetooth between the smartphones of other Alaska COVID ENX users when they are nearby and your smartphone will check periodically to see if your random code appears on the exposure list.

Verification Codes and Generating Exposure Notifications to Others

If you test positive for COVID-19 there are two ways you may notify others of exposure via Alaska COVID ENX:

1. You may request a self-verification code in Alaska COVID ENX to anonymously alert other users of possible exposure. In order to receive a self-verification code, Alaska COVID ENX users must enter the date of their positive test result (must be within the last 14 days) and their mobile phone number. The same device used to request the code must be used to enter the verification code or to click the verification link to anonymously alert other Alaska COVID ENX users. A new verification code cannot be requested on the phone until 90 days have elapsed. Phone numbers are cryptographically protected on the verification server and cleared after 90 days if the code is used or after 60 minutes if the verification code or link is not used.
2. If your positive test result is being communicated to you through a lab or health authority, they may provide you with a verification code for Alaska COVID ENX that can also be entered into the app to notify other users of possible exposure. The code could come in the form of a SMS message with a verification link that initiates the anonymous alert process.

Neither the verification code nor the verification link is associated with a user’s identity. Choosing to anonymously notify other Alaska COVID ENX users of a positive test result is completely voluntary.
When a user consents to alert others, the notifications that may be generated do not disclose the COVID-19 positive user’s identify, location, phone number, or other personal data. The exposure notification does include the date of the exposure within a 24 hour window. Sharing the exposure date is important to ensure that users have the information necessary to take the right precautions, such as getting tested at the appropriate time based on the exposure date. It is possible that someone who receives an exposure notice could guess the identity of the COVID-19 positive individual, if they had a very limited number of known contacts on a given day.

Age Requirements

Alaska COVID ENX is intended for ages 18 and over as well as users between the ages of 13 and 17 with parent or legal guardian consent. There is no Alaska COVID ENX-specific parental approval system for this age group. However, parents can control access by using the tools readily available to parents to manage their children's access to device settings, apps, and purchases.

How Do We Protect Your Information?

Alaska COVID ENX protects random codes using Google and Apple’s Exposure Notification Framework, which includes very specific requirements about how to encrypt and transfer them. A third party does not generate your random codes — your smartphone does.

Your Rights Over Your Information

Because the verification code and application logs cannot be tied to you without access to your smartphone, UAA has no way to access this information. Because of this, UAA cannot securely provide you with or delete this information if you ask. You control the use of Alaska COVID ENX.

Disabling exposure notifications

Users may disable Alaska COVID ENX at any time by, turning off the feature in their smartphone settings, turning off the mobile device, or turning off the Bluetooth function. If the user deactivates Alaska COVID ENX, all codes currently stored on the device will be immediately deleted.
If Alaska COVID ENX is deactivated, your device will no longer generate or exchange random codes with other users’ mobile devices. Any random codes that were previously shared with other Alaska COVID ENX users will be automatically deleted after 14 days from the date the code was generated.