Privacy Policy for “Ma3an – Together Against Corona” App
Version 1.1
Last update: September 1, 2020
This privacy notice explains what data is collected when you use the “Ma3an - together against Corona” (further referred to as “Ma3an”) app, how the data is used, and your rights under data protection law.
What IS Ma3an and what is it for?
Ma3an is a free, digital contact tracing app. The purpose of Ma3an is to facilitate the contact tracing activities that the Lebanese Ministry of Public Health in Lebanon (the “MOPH”) is already performing; it will make these activities more efficient and quicker, enabling the MOPH to react faster and reach out to possibly infected people to render the necessary health care, and to potentially minimize the spread of the virus.
Contact tracing apps like Ma3an are part of a global strategy to mitigate the COVID-19 pandemic
.
This application is not mandatory, its use is on a voluntary basis. By installing this app, you will contribute to the fight against COVID-19.
Who Provides You with this APP?
Ma3an is provided by the Lebanese Ministry of Public Health (the “MOPH”). Ma3an was conceived and designed by experts from the MOPH and from the American University of Beirut (Faculty of Health Sciences, Maroun Semaan Faculty of Engineering and Architecture, and Faculty of Arts and Sciences). The app was developed and deployed by TedMob, supporting the MOPH.
How Does it Work?
- Ma3an generates a random code for your device and uses Bluetooth wireless communication to broadcast its presence anonymously to other nearby mobile devices. This code is randomly generated and does not contain any personal or identifying information. When your app detects another device with the Ma3an app, the devices exchange their respective random codes. The random numbers exchanged change every 15 minutes.
- Ma3an does not store or collect your location and it does upload any recorded data of nearby devices without your consent. Ma3an operates on simple proximity detection.
- When a user tests positive for COVID-19, the MOPH will either send them a notification or provide them a code to upload their data on secure and encrypted MOPH servers, so to immediately notify other users who have been in close contact with the positive case. This happens without direct identification of positive users.
What Type oF Information will be Collected, and When?
Ma3an collects some personal information (only your mobile phone number) and contact data in the following instances:
When you Register for Ma3an
When you download Ma3an you will be asked to provide a mobile number, so that we can send you a unique one time password (OTP) via SMS. The OTP is a numeric code to activate the app. This is the only personal information we collect; we will ask you to consent to reach you on your phone in case we need to contact you for the purpose of contact tracing. Ma3an does not require you to provide other personal information, such as your name or address.
When you use Ma3an
After the activation, your app will record the following contact data on your phone:
- an encrypted user ID;
- random and temporary codes generated by the server;
- Bluetooth signal strength of other Ma3an users with whom you come into contact;
- date and time of contact.
This information will also be recorded on the other users’ devices. No user will be able to see the contact data stored on their device as it will be encrypted. Contact data stored on a device will be automatically deleted after 21 days.
Location Information: Ma3an does not require your location to work. Android devices require the location permission to be granted in order for the app to access Bluetooth features. Your location data is not sent to our servers.
If you or other users test positive to COVID-19
We will contact you and ask for your consent to upload contact data on your device into the server, so that other users are notified; this information will be shared with health officials to enable contact tracing. If another user tests positive to COVID-19, they may upload their contact data, which may include details of their proximity with you.
What Information is Stored on the MOPH Servers?
As part of your use of Ma3an, we will collect:
- your registration information (date and time) after you successfully enter the OTP sent by SMS;
- information about your encrypted user ID when you have Ma3an running on your device;
- your contact data, when you or another Ma3an user you have come into contact with tests positive to COVID-19 and upload contact data from their device;
- the periods of exposure of users to people who tested positive for COVID-19, stored on the central server;
- a status of “contacts at risk of contamination”, based on the time and proximity of users;
- anonymized device model and app version;
- the date of the last interaction with the central server.
We cannot access any contact data stored on your device, or share this with health officials, unless and until you or other users consent to upload the data to the server.
Who is the Data Controller?
This application is placed under the responsibility of the Lebanese Ministry of Public Health, the entity responsible for processing and protecting your data.
How will Personal Information be Collected?
Use of Ma3an is completely voluntary. You can install or delete the app at any time.
How will Personal Information be Stored?
We are committed to safeguarding the confidentiality of your information. We provide physical, electronic, and procedural safeguards to protect information we process and maintain.
The data on your device is encrypted. We will store all registration information, encrypted user IDs and contact data, in a secure server, using cloud-based infrastructure. Data are first encrypted on Firebase (Google cloud), then decrypted and sent to Amazon Web Service using a secure socket layer connection.
Contact data on your device will automatically expire after 21 days after contact occurs. It will also be deleted if you remove Ma3an from your device or upload your contact data to the data store. We will delete all data in the data store after the COVID-19 pandemic has concluded.
How will Personal Information be Used and Disclosed?
We will use your personal information to enable our health officials perform contact tracing while ensuring the maximum level of confidentiality.
Only if you tested positive for COVID-19 or came in contact with a positive case, we will use your mobile number, which you entered during registration, to contact you and perform contact tracing to take precautionary measures to avoid spreading the virus, such as self-isolation, or performing a PCR test.
We will use the data stored on your phone (encrypted user IDs) to notify other Ma3an users (contact users).
We will not use or disclose your personal information for any other purpose.
We will also receive de-identified analytical data from App Store and Google Play about Ma3an including the number of downloads, average use time, and deletions.
We will use de-identified, anonymized contact data for evaluation purposes and in the context of publications, research work, reports etc.
Can Personal Information be Deleted?
We will delete any of your personal information held in the server when you will make a request via email. Also, you can uninstall Ma3an at any time; this will automatically delete all information stored on your device and stop other users from collecting your contact data.
Uninstalling Ma3an will not automatically delete any information already uploaded to the server, or any of your contact data stored on another user’s device in the last 21 days, which could still be uploaded to the data store and used for contact tracing purposes. If you wish any of your contact data uploaded to the data store to be deleted you can expressly ask us to delete your information.
What are my Rights as a Ma3an User?
You have the right to be informed, to correct or rectify (edit), delete, or surrender your data. You also have the right to restrict data processing and the right to object against data processing too. You also have the right to withdraw consent without consequences on yourself.
Further information about your rights to data protection
If you have any questions regarding this Privacy Policy, please contact us:
Ministry of Public Health
National E-health Program
Bir Hassan, Jnah, next to Ogero
Beirut- Lebanon
Phone: +961-1-830300 ext: 508
Email:
ehealth@moph.gov.lb
https://www.moph.gov.lb/en/contact
The MOPH Mobile application that you can download on the following link
www.moph.gov.lb/app
