Terms & Conditions for the Protect-Scotland app



These are the terms of use for the Protect Scotland app (also known as Protect-Scot and referred to in these terms as the app). The app has been designed to help stop the spread of COVID-19 (alongside other public health measures) by notifying people who have been in close contact with someone who has tested positive for COVID-19. The app has been developed as part of NHS Scotland’s Test and Protect service for the benefit of people residing in and those visiting Scotland.

Using this app is entirely a matter of personal choice. There is no requirement to download or use the app. You will never be asked to prove you have the app, and you should never be asked to show the status of the app to anyone else – that is entirely up to you.

Phones with the app installed emit coded ‘keys’ or ‘identifier Beacons’, which change every 15 minutes. These ‘keys’ are stored on the user’s phone anonymously for 14 days before being discarded. When close to each other, app users’ phones exchange these ‘keys’, and if they are in close proximity with another user for a significant period of time, each phone will store the anonymous ‘key’ of the other phone for 14 days.

Test ‘Authorisation Codes’ are anonymous random six-digit alphanumeric codes generated to verify that a positive COVID-19 test has been received by the app user, allowing ‘exposure notifications’ to be provided via the app. On entering the authorisation code, the user is asked to release the anonymous keys their phone has transmitted over the previous 14 days; these are known as ‘diagnosis keys’. These are then released to the secure registry supporting users of the app, to be shared with other app users.

‘Diagnosis keys’ are anonymised identifiers generated on entry of the ‘authorisation code’ on the app, and stored in a secure registry, maintained by NHS Scotland’s secure cloud services account on Amazon Web Services (based in London). Every app user’s phone regularly checks for ‘diagnosis keys’ and where these match to the key of a contact that has entered a valid positive test ‘authorisation code’ over the past 14 days, an ‘exposure notification’ is enabled. The notification is generated on the app user’s phone, not in the NHS Scotland secure registry.

‘Exposure notification’ is an anonymous notification, received via the app, that the app user has been in contact with an unnamed individual who has tested positive for COVID-19, and that the contact was recent enough, and for a sufficient time, at a close enough distance to mean that the app user may have been at risk of transmission of the virus.

Please read these terms of use in conjunction with the Privacy notice for the app.

References to “we” and “us” in these terms are to NHS National Services Scotland which has made the Protect Scotland app available. References to “the user” and “you” refer to the person who has downloaded the app onto a device and who uses the service.

What the Protect Scotland Contact Tracing app does

Proximity data

The app records if users are in close contact with other app users (see above). If an app user tests positive for COVID-19, the app will notify any app users that have been closer than two metres for more than fifteen minutes in the previous 14 days (these parameters are in line with current public health policy, and can be changed depending on advised best practice). The app uses capabilities of mobile operating systems. Apple and Google have developed a method that allows specific government-only COVID-19 apps to make use of Bluetooth technology on phones that would otherwise not be available.

First Time Use

The first time anyone uses the app, they are prompted to allow the app to collect and share the anonymous data transmitted by nearby devices that also have the app installed. There will also be a notification seeking the user’s consent for certain processing and a screen with the full app Privacy notice.

Exposure notification

If you are notified that you have been in contact with someone who has tested positive, you will be advised to self-isolate for 14 days from the last known date of contact (calculated from the date the diagnosis key was last stored on your phone). If you have symptoms you will be directed to the latest guidance and advice on testing from the NHS Inform website.

Metric Data

Aggregated metric data does not identify you and is not personal information within the meaning of data protection law. It is used to create statistical data of how many people are using the app and the impact it is having on the virus. Here is a list of the app aggregated metrics, which you agree, are collected from the app:

  1. The total number of app users
  2. The total number of instances where ‘diagnosis keys’ have been uploaded
  3. The total number of ‘exposure notifications’ triggered

We will not be able to link any of these instances to any individual app users, simply total numbers for Scotland in any given period.

Use of Protect Scotland Contact Tracing app

Who is the app intended for?

The Protect Scotland app is free to download and use by anyone who is at least 16 years of age residing in or visiting Scotland, including citizens and anyone who is temporarily staying or travelling in Scotland. The app is only capable of processing positive Covid-19 test results from people who have an address in Scotland (this includes hotels for people who are visiting) and that have been processed through laboratories based in Scotland (NHS Boards) or the UK (Lighthouse Labs). Users downloading the app who do not have a Scottish address, and who are not tested in either Scotland or in one of the UK’s Lighthouse Labs will not be able to receive ‘authorisation codes’ in relation to a positive test for COVID-19. On downloading and activating the app, users are asked to confirm that they are residing / have an address in Scotland and, if not, you are discouraged from using the app. You are encouraged to use a similar app intended to cover your own area.

Technical requirements and functionality

Use of the app requires an Android or iPhone mobile device which supports Android 6.0 or higher (in the case of Android phones) or iOS 13.5 or later (in the case of iPhones). In addition, in order to operate correctly, the app also requires Bluetooth functionality switched on and the COVID Exposure Notification service enabled. As the app will need to use the most current version of the phone’s operating system, users may be asked to upgrade the first time they use it. The app cannot be used on older phones, on which it is not possible to upgrade the operating system. It is not available on phones which use a different operating system, other than the Android or iOS system deployed by Google / Apple.

If you agree to the Exposure Notification service provided by the app (this can be disabled in the settings) and want to receive this service, you will need to enable Bluetooth and location services (on Android) and you will need to permit push notifications from the app. To work on Android phones, the app requires that location services are switched on but the app does not use GPS location services or Google location services to track your movements. The app will prompt you about enabling this service and providing relevant permissions. The app simply uses the strength of the Bluetooth signal of phones (when these features are activated) to measure the proximity to other phones that have the app installed and the length of time spent at a given proximity. The date and time of Bluetooth signals received from other phones are also recorded.

There are certain situations where we advise you to have the Bluetooth signalling functionality of your device switched off. As Bluetooth is required for the creation of the anonymous keys, no keys would be created when Bluetooth is switched off.

Your use of the app

You are permitted to use (a) the app, (b) the services you connect to via the app and the content we provide you through it (the Services) and (c) the online or electronic documentation related to the app (the Documentation) on the basis of the Apache License, Version 2.0 a copy of which can be obtained at http://www.apache.org/licenses/LICENSE-2.0 (the “OS Licence”). If there is any ambiguity between these terms and the OS Licence, the OS Licence shall take precedence.

How to provide feedback on the app

If you want to report back to us about your experience of using the app, or want to report any problems with the use of the app or the Services, please contact us by e-mailing testandprotect@nhs.scot.

Your privacy

We only use any personal information we collect through your use of the app and the Services in the ways set out in our Privacy notice. The Privacy notice confirms the terms on which your personal information is collected and used in respect of your use of the app and the Services.

app store’s terms also apply

When you download the app, or when you access or use the app or the Services, you may also be subject to the terms of use and policies of the relevant app store (Google Play Store or Apple Store) from which you download the app. Please review those terms of use and policies very carefully.

Your access to, and use of, the app and the Services will be governed by these terms of use, unless the terms of use and policies of the relevant app store say otherwise.

You must be 16 to accept these terms and to download and use the app

You must be at least 16 years of age to accept these terms and to download and use the app. We are not liable if you allow or enable a person under 16 years of age to install or use the app.

Only you should use the app and you should not permit anyone else to use your app

For the app to work properly, use of the app and the Services should be personal to you. Use of the app by multiple individuals from the same device undermines the accuracy and efficacy of the app’s contact tracing function (if enabled). If you let another person use the app on your device or you use the app on the device of another person, this could lead to exposure notifications being provided that are not accurate. If you permit someone else to use the app or Services on your device then you are responsible for that person’s use and you must ensure that the person knows about and complies with these terms.

We strongly recommend that, if you sell any device on which the app is installed, you first remove the app from the device and delete the app data using device settings.

The app can be used by any person in assistive, medical, care or similar capacity on behalf of another person.

Changes to these terms

We may need to change these terms to reflect changes in law or best practice or to deal with additional features we introduce.

If we change these terms, this will be done as part of a version change to the app. You will be prompted to update the app from the app store and, as part of that update, you will be provided with and asked to accept the updated terms.

If you do not update to a new version, you will have to discontinue use of the app and the Services. This will be your choice.

Updates to the app and changes to the Services

From time to time we may automatically update the app and change the Services settings to improve performance, enhance functionality, reflect changes to the operating system or address security issues. Alternatively, we may ask you to update the app for these reasons. If you choose not to install such updates or if you opt out of automatic updates, you may not be able to continue using the app and the Services, and this may also compromise the security of your data or your device.

If someone else owns the phone or device you are using

If you download and install the app onto any phone or other device not owned by you, you must have the owner’s permission to do so. You will be responsible for complying with these terms, whether or not you own the phone or other device.

We are not responsible for other websites you link to

The app or the Services may contain links to other independent websites which are not provided by us, such as websites for purposes of booking a test. Such independent sites are not under our control, and we are not responsible for and have not checked or approved their content, terms & conditions or their privacy policies (if any). You will need to make your own independent judgement about whether to use any such independent sites.

Your obligations when using the app

You must:

  • Ensure, to the extent it is reasonably possible for you to do so, that all information that you provide in the course of using the app and the Services is accurate, complete, honest and not misleading, to the best of your knowledge, information and belief;
  • Not knowingly or recklessly use the app or the Services in a manner that would generate exposure notifications that are false or inaccurate;
  • Not use the app or any Services in any unlawful manner, for any unlawful purpose, or in any manner inconsistent with these terms, or act fraudulently or maliciously, for example, by hacking into or inserting malicious code, such as viruses, or harmful data, into the app, any Services, the app backend or any operating system;
  • Not infringe our intellectual property rights or those of any third party in relation to your use of the app or any Services;
  • Not transmit any material that is defamatory, offensive or otherwise objectionable in relation to your use of the app or any Services;
  • Not use the app or any Services in a way that could damage, disable, overburden, impair or compromise our systems or security or interfere with other users; and
  • Not collect or harvest any information or data from the app or any Services or our systems or attempt to decipher any transmissions to or from the servers running any Services

Intellectual property rights

The core parts of the app (known as Covid Green) are made available under the terms of the OS Licence and we have used that licence to build this app. We have made amendments to the core app, the intellectual property rights in which belong to us.

Both the core parts of the app (Covid Green) and our amendments are licensed to you in terms of the OS Licence.

You do not own any intellectual property rights in, or to, the app, the Documentation or the Services other than the right to use them in accordance with these terms.

Our responsibility to you

No implied terms. As the app, Documentation and Services are provided for free, the terms that would otherwise be implied by statute as set out in sections 34 (Satisfactory quality), 35 (Fitness for purpose), section 36 (Digital content to be as described) and section 37 (Pre-contractual information) of the Consumer Rights Act 2015 do not apply.

We are responsible to you for foreseeable loss and damage caused by us. If we fail to comply with these terms, we are responsible for loss or damage you suffer that is a foreseeable result of our breaking these terms or our failing to use reasonable care and skill, but we are not responsible for any loss or damage that is not foreseeable. Loss or damage is foreseeable if either it is obvious that it will happen or if, at the time you accepted these terms, both we and you knew it might happen.

We do not exclude or limit in any way our liability to you where it would be unlawful to do so. This includes liability for death or personal injury caused by our negligence or the negligence of our employees, agents or subcontractors or for fraud or fraudulent misrepresentation, or in respect of any of your legal rights as a consumer (to the extent that these cannot be excluded).

When we are liable for damage to your property. If defective digital content that we have supplied damages a device or digital content belonging to you, we will either repair the damage or pay you compensation. However, we will not be liable for damage that you could have avoided by following our advice to apply an update offered to you free of charge or for damage that was caused by you failing to correctly follow installation instructions or to have in place the minimum system requirements advised by us.

We are not liable for business losses. If you use the app, the Documentation and the Services for any commercial, business or re-sale purpose we will have no liability to you for any loss of profit, loss of business, business interruption, or loss of business opportunity.

Limitations to the app and the Services. While the app provides notification to those who may have been exposed to a confirmed positive case, providing advice to self-isolate, the app provides no additional functions. All those in Scotland with a positive test result for COVID-19 would be expected to receive a phone call from a contact tracer from Public Health Scotland or local Health Protection Team (NHS Board). This public health service is separate from the app and works in parallel. The app works in parallel to the manual Test and Protect contact tracing process. Information from the app is not shared with those working in the manual service.

It is also possible that the app will generate exposure notifications in cases where there has been no risk of exposure, for example where two app users are within close proximity but wearing appropriate protective equipment or there is a screen, glass or wall between them. The functionality of the app does not enable us or you to identify whether the exposure notification has arisen in these types of circumstances.

The app uses transfer of data over communications networks and facilities to carry out the app functions such as providing you with exposure notifications. Those networks and facilities can be subject to limitations, delays and other problems which could prevent or delay app functions. If you have Covid-19 symptoms, read the following advice or if your symptoms are getting worse call 111.

Withdrawal of or changes to the app or Services. The app and Services are intended to be made available for a limited period only while the COVID-19 crisis is ongoing. Without prejudice to this, we expressly reserve the right, at any time, without prior notice, to withdraw the app and the Services. We also expressly reserve the right, at any time, and without prior notice, to make changes and/or improvements to the app and Services. When we withdraw the app, the contract between us (as set out in these terms) comes to an end.

Check that the app and the Services are suitable for you. The app and the Services have not been developed to meet your individual requirements. Please check that the facilities and functions of the app and the Services (as described on the app store site and in the Documentation) meet your requirements.

We are not responsible for events outside our control. If our provision of the app or the Services or support for the app or the Services is delayed by an event outside our control then we will publicise this on our website. We will not be liable for delays caused by the event, but if there is a risk of substantial delay you may end your use of the app at any time.

You can end your use of the app and what happens if you do

By virtue of the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, consumers often have a statutory right to withdraw from online contracts for digital content if they change their mind within fourteen days from the day of the conclusion of the contract. This statutory right does not apply to your use of the app as you hereby consent to immediate performance of the contract between us and acknowledge that you will lose your statutory right of withdrawal from the contract once the download of the app has begun.

However, you can stop using the app at any time, and you can delete it at any time from your device. When you uninstall the app, the contract between us (as set out in these terms) comes to an end.

If you delete the app, you will not be able to access the Services, and all rights granted to you by these terms will cease. Any data held on your phone can be removed as indicated in the app instructions. Details are provided in relation to personal information processed by the app in the Privacy notice.

We may end your rights to use the app and the Services if you break these terms

We may end your rights to use the app and Services at any time if you have broken these terms in a serious way. If what you have done can be remedied we will give you a reasonable opportunity to do so.

If we end your rights to use the app and Services:

  • You must stop all activities authorised by these terms, including your use of the app and any Services
  • You must delete or remove the app from your device(s) and immediately destroy all copies of the app which you have and confirm to us that you have done this
  • We may end support and linkage to the app, from the app backend, rendering the app redundant

We may transfer our rights and obligations to someone else

We may transfer our rights and obligations under these terms to another organisation. We will always tell you if this happens and we will ensure that the transfer will not affect your rights under these terms.

You need our consent to transfer your rights to someone else

You may only transfer your rights or your obligations under these terms to another person if we agree in writing.

No rights for third parties

These terms do not give rise to any rights under the Contract (Third Party Rights) (Scotland) Act 2017 to enforce any of its provisions.

Individuals not residing in Scotland

It is our stated intent that this app should not be used by individuals not residing / present in Scotland. In order to avail of the app’s functionality in terms of exposure notification, it is essential that users are tested in Scotland or by the Lighthouse Labs in the UK, in order for us to be able to deliver authorisation codes in relation to test results. During the on-boarding process, app users are given clear instruction not to use the app if they are not in Scotland, and that the app functionality will not be available to them. As a result, we can accept no liability for anyone ignoring the instruction and using the app improperly.

If a court finds part of these terms illegal, the rest will continue in force

Each of the paragraphs of these terms operates separately. If any court or relevant authority decides that any of them are unlawful, the remaining paragraphs will remain in full force and effect.

Even if we delay in enforcing these terms, we can still enforce them later

Even if we delay in enforcing these terms, we can still enforce them later. If we do not insist immediately that you do anything you are required to do under these terms, or if we delay in taking steps against you in respect of your breaching these terms, that will not mean that you do not have to do those things and it will not prevent us taking steps against you at a later date.

Terms survive

Any of these terms that are intended to come into or continue in force on or after termination or expiry (which includes for the avoidance of doubt the provisions dealing with Our responsibility to you) will remain in full force and effect following termination or expiry. Termination or expiry shall not affect any rights, remedies, obligations or liabilities of you or us that have accrued up to the date of termination or expiry, including the right to claim damages in respect of any breach of the terms which existed at or before the date of termination or expiry.

Which laws apply to these terms and where you can bring legal proceedings

These terms are governed by the law of Scotland and, as a Scottish resident, you can bring legal proceedings in respect of these terms (or anything to do with the app or the Services) in the courts in Scotland only.

Help stop the virus. Download the app today.

By voluntarily choosing to use the Protect Scotland app, alongside existing public health and contact tracing measures, you can help to stop the spread of the virus in Scotland.

Help family members to download the app, encourage your colleagues to use it and share it with friends.

If we all play our part, we can all help protect ourselves, our families and Scotland against coronavirus.