Aarogya Setu data safe, stored for limited period: IT Minister Ravi Shankar Prasad

A government official quoted in the report said that most of the data would be deleted in 30 days and information pertaining to COVID-positive people would be deleted in 60 days. The official reiterated Prasad’s statement of deleting all data once the coronavirus crisis was over. 

The same can be read in the privacy policy of the app (read here) that says:

All personal information collected under Clauses 1(b), 1(c) and 1(d) will be retained on the mobile device for a period of 30 days from the date of collection after which, if it has not already been uploaded to the Server, will be purged from the App. All information collected under Clauses 1(b), 1(c) and 1(d) and uploaded to the Server will, to the extent that such information relates to people who have not tested positive for COVID-19, will be purged from the Server 45 days after being uploaded. All information collected under Clauses 1(b), 1(c) and 1(d) of persons who have tested positive for COVID-19 will be purged from the Server 60 days after such persons have been declared cured of COVID-19.

“Let us make this absolutely clear that the data is not shared with anyone. All data is anonymised, your personal information is encrypted. It creates an anonymous device ID. All future interactions happen with the anonymised device id, and then for most people data remains on the phone only,” the official said.

Security researcher and ethical hacker Elliot Alderson raised concerns over the app after Rahul Gandhi called Aarogya Setu a sophisticated surveillance tool. Aarogya Setu’s team denied any such concerns which put the privacy of 90 million Indians at risk.

The government recently made it mandatory for all employees (including the private sector) to download the COVID-19 contact tracing app while holding heads of respective organisations liable for any negligence.