* Contact tracing data is only shared if one chooses to when they test positive
* The app's source code is publicly available ([github](https://github.com/nihp-public/covid19-app-system-public)), and a vulnerability exposure program has been set up ([here](https://hackerone.com/nhscovid19app?type=team))
  * Source available doesn't mean app is secure, but can mean vulnerabilites are found more quickly