This Privacy Policy should be read in conjunction with the Terms and
Conditions applicable to the EHTERAZ Application (hereinafter referred to
as the “Application”). The Application is owned and operated by the
Ministry of Public Health (“MOPH”) to contribute towards the national
response to the new coronavirus (“COVID-19”) outbreak and contact tracing
efforts being made to contain its spread and protect the health and
wellbeing of the citizens and residents of Qatar.
Each individual’s privacy is very important to the MOPH and we understand
its importance. We want you to feel safe when using this application and we
are committed to maintaining your privacy while using the application. We
require our employees, suppliers and partners to maintain confidentiality
in accordance with applicable data protection laws in the State of Qatar.
This Privacy Policy (together with our Terms and Conditions) sets out the
basis on which we process, share, secure, and delete any personal data we
collect from you, or that you provide. Please read the following carefully
to understand the manner in which your personal data is processed.
We want you to feel safe when using this Application and are committed to maintaining your privacy and confidentiality by using only the minimal amount of required information, personal data, and device permissions in order to function in a manner that aims to protect public health in the State of Qatar in light of the ongoing COVID-19 outbreak and in accordance to Law Number 13 of 2016 on Protecting Personal Data Privacy.
The Application is designed to support fast, accurate, digital contact tracing through your phone by using:
- Bluetooth Low Energy (BLE) broadcasting to determine your proximity to a suspected, infected, or confined person, or an individual who subsequently becomes suspected, infected, or confined.
- Background location services should be enabled to always know where your device is located to maintain that prompt action is taken to contain the spread of COVID-19 in areas where individuals have been infected and to protect public health and wellbeing of the citizens and residents of Qatar.
By "Personal Data" we mean any information relating to an identified or identifiable natural person.
The Application helps protect the public’s health and wellbeing in the State of Qatar by:
- Alerting you when you come into close proximity with a suspected, infected, or confined person, or an individual who subsequently becomes a suspected, infected, or confined person
- Providing you with a unique QR code which is color-coded based on your risk of exposure, infection status, and health profile
- Providing the MOPH and appropriate government entities with location information to allow prompt action to contain the spread of COVID-19
- Providing you with the latest developments, official news, social distancing advice, and other suggestions related to reducing the spread of COVID-19
The following minimal necessary device permissions are required the enable the functioning of the Application:
- Permission to write to the file system - required to allow storage of a small, encrypted file which holds a unique ID, QR code, infection status, configuration parameters, and proximity data of other devices using the Application
- Bluetooth Low Energy (BLE) – is used to poll nearby devices to support future contact tracing and determine proximity of suspected, infected, or confined persons
- Background location services – is used to support the identification of areas where individuals have been infected allowing prompt action to contain the spread of COVID-19
- Manage Phone - This allows users to call customer service directly from the application.
- Device Id - This is for identifying each device uniquely.
This application is created specifically for the COVID-19 response and it only accesses this personal and sensitive data required to directly support the ministry of public health in Qatar and only uses the data collected to support COVID-19-related efforts or epidemiological research.
The minimum necessary amount of data is requested from the user and retrieved in order for the Application to function. Data will be periodically be synchronized with the central management system (“CMS”) which is stored on secure and protected Government servers.
In the event that you are to disclose Personal Data on behalf of another person, you will ensure that the individual whose Personal Data is supplied to MOPH has authorized the disclosure, is informed of and consents to processing of their Personal Data in accordance with this Privacy Policy. Where the disclosure is in respect of a child’s Personal Data, you should do so only as the parent or legal guardian of that child, and only if you have the legal authority to enter into relevant contracts on behalf of that child.
The following information is requested during installation and first use of the Application:
- Phone Number – to send a SMS confirming your mobile number
- Qatar ID + Expiry Date / Visa Number / Passport Number + Nationality – to authenticate and verify your information
The Application will download configuration settings and synchronize the above data with the CMS and generate a unique ID and QR code for your device. The QR code will be color-coded based on your initial infection status and prominently displayed in the Application.
The following data is stored locally on the device during everyday use. This data remains on the device until the next synchronization with the CMS. The data is used to 1) record contact tracing information between different devices in close proximity with the Application installed 2) always have access to your location to help inform individuals and healthcare professionals in order to locate and provide support to suspected or infected individuals in a manner that allows prompt identification and minimal exposure to wider community to maintain lower risk of exposure.
The BLE Protocol is used to retrieve the following data:
- Unique ID – supports contact tracing of individuals who subsequently become suspected, infected or confined
- Infection status – provides receiving devices with an immediate alert of a suspected, infected or confined person in close proximity
- Data, time, and duration of contact - to determine risk of exposure based on contact occurrence and duration
- BLE signal strength – indicates distance from contact and used to evaluate risk of exposure
Background location services are used to retrieve the following data:
- Location GPS – to promptly locate areas where individuals have been infected allowing the MOPH and appropriate government entities to take prompt action.
Data collected is deleted from the local device after:
- Being uploaded to the CMS during periodic synchronization
- Removal of the Application from the device
- A duration exceeding the COVID-19 incubation period for the last time contact occurred
Data will be retained in the CMS during the active spread period of COVID-19 and as mandated by public health guidelines, data retention policies, privacy laws in the State of Qatar and in compliance with international standards to fulfill the purpose described in this Privacy Policy.
Personal Data will be permanently deleted from both the local device and
the CMS by taking all reasonable and technical measures to make the
Personal Data irrecoverable or irreproducible in accordance with the
applicable laws.
You can request access, rectification, review of processing, of your
Personal Data processed by MOPH at any time by sending a request via the
e-Mail provided in the Support section below. Any request must include the
following information: Your name and address and any other information
which may identify you.
Your personal data, and all electronic storage and transmission of data shall be safeguarded and secured with appropriate security and encryption technologies.
- Data is periodically synchronized and uploaded to the CMS using key verification and encryption to ensure tamperproof communication.
- The CMS resides on Government servers which are protected by the State of Qatar’s active security protocols and other security standards to protect against any attempt to expose, alter, disable, destroy, steal or gain unauthorized access to or make unauthorized use of data or any other assets
By choosing to use the Application, you fully consent to:
- MOPH's use of all your Personal Data for the purpose of the work of this application, and that you grant MOPH permission to use this information as outlined in the Privacy Policy and Terms and Conditions.
- Share your Personal Data with MOPH and relevant data to be only shared with other Government agencies in the State of Qatar, for the purpose of protecting your health and the health and safety of the wider community, in the most efficient and effective manner, unless such sharing is prohibited by law.
- Display Personal Data you have previously shared with MOPH and/or other Government agencies in the State of Qatar. We will retain your Personal Data only as necessary for the effective delivery of public services.
- Give MOPH and the relevant Government agencies in the State of Qatar access to your location at all times during the active spread period of the COVID-19 pandemic in order to safeguard your health and the health of all the citizens and residents in Qatar.
Your Personal Data and the data collected by the Application will be used by the MOPH and the relevant Government agencies to:
- Identify users who have been in contact with a suspected, infected, or confined person
- Quickly identify locations where infection rates are rising and take appropriate action
- Determine breaches in confinement in contradiction to the relevant law and guidelines
- Create de-identified, aggregate reports using the appropriate data to inform decisions and evaluate the effectiveness of the Application
We do not disclose your Personal Data to any non-Government agency in the State of Qatar, except:
- Where such entities have been authorized to carry out specific Government services in Qatar.
- To third parties, including law enforcement officials, courts and government and regulatory authorities: (a) if we believe disclosure is required by any applicable law, regulation or legal process (such as to respond to subpoenas or judicial orders); or (b) to protect and defend the EHTERAZ application developer’s rights, or the rights or safety of third parties, including to defend against legal claims.
- When third parties act as data processors of your Personal Data, based on MOPH instructions. We enter into an agreement with the relevant data processor for the processing of your Personal Data. In this agreement, we include obligations to ensure that your Personal Data is processed by the data processor solely to provide healthcare services and to ensure that the data processor has adequate safeguards in place and complies with the applicable data protection laws.
This Application may contain links to enable you to visit third-party websites, mobile sites, and mobile applications which are governed by their own privacy policies. Please note we do not have any control over these websites and are not responsible or liable for the protection and privacy of any information that you receive while visiting these external websites.
This application is created specifically for the COVID-19 response and it only accesses personal and sensitive data required to directly support the ministry of public health in Qatar and only uses the data collected to support COVID-19-related efforts or epidemiological research.
If you have any questions about our privacy policy, or wish to request access, rectify, or review your Personal Data, please contact us at info@ehterazapp.qa or call us on 109.