The TraceTogether app was introduced on March 20, while the token was rolled out on June 28. According to Mr Wong, there are only about 2.5 million people (or 45 per cent of the population) who are currently using the TraceTogether app or token.

Privacy concerns have been one of the biggest obstacles in TraceTogether’s nation-wide implementation. However, a study conducted by the Data Protection Excellence Centre (Dpex)— the learning and research arm of data protection consultancy Straits Interactive—had reported in May that it was the least intrusive amongst similar apps in Southeast Asia.

The “privacy sweep” assessed the types of permissions sought by the app, whether these permissions exceeded what would be expected based on the app’s functionality, and how the app explained to consumers why the personal data was collected and how it would be used.

It concluded that “Singapore’s TraceTogether comes up tops in terms of privacy communications and overall marks, demonstrating clear evidence of privacy by design”.

With TraceTogether becoming mandatory for entry to everyday venues, here’s what to know about the programme.

A collaboration between Singapore’s Ministry of Health (MOH), SGUnited and GovTech, TraceTogether is a contact-tracing programme powered by the Government Digital Services and Blue Trace. Available in the form of a mobile app or physical TraceTogether token, the system works by exchanging anonymised proximity information using Bluetooth signals.

This information is encrypted and stored on the phone, and only shared with the MOH if a user tests positive for Covid-19, allowing MOH to quickly identify other users who may have been exposed to the virus.

For mobile app users, all you have to do is to keep your Bluetooth on and keep your app open in the background, and the system will do its work. An earlier version of TraceTogether faced issues working in the iOS background, but it has since been solved in the new update.

For those using physical tokens, no further action is required after your token is activated and registered in your name. Simply bring the token everywhere you go so it can accurately capture proximity data.

(Related: Singapore Airlines To Resume Weekly Non-stop Flights To New York In November 2020)

TraceTogether will not be replacing SafeEntry, but will instead work hand-in-hand to amplify contact-tracing efforts. According to TraceTogether’s FAQ, the programme helps MOH identify people in close proximity with Covid-19 cases during the infectious period, while “SafeEntry helps Covid-19 cases remember the places that they’ve been to so that MOH can spot potential clusters”.

The TraceTogether app has a SafeEntry check-in function built-in so that you can effortlessly check-in and out of venues. It also allows you to save locations that you frequent for faster check-in.

According to TraceTogether, three types of data are collected in the programme. Firstly, your contact number and unique identification number is collected, with a random anonymised user ID associated with it. These details are stored in a secure server and accessed only for contact tracing purposes.

Secondly, TraceTogether exchanges anonymised and encrypted data via Bluetooth with nearby phones. The data includes information about phone models and signal strength in order to measure proximity, and is stored on the phone. It is only shared with MOH if you test positive for Covid-19.

Finally, TraceTogether also collects analytics data to improve the function of the app across different phone models and operating systems (OS). This includes device information such as brand, model and OS version, as well as app information such as app version, country and language, and usage statistics from time of installation.

(Related: Phase 3 is Almost Here: What We Know So Far About Singapore’s Roadmap to Re-opening) 

According to TraceTogether, the Bluetooth signals exchanged will never reveal personal identities. Instead, a temporary ID is generated by encrypting the user ID and stored locally in the user’s phone.

The temporary ID, which is regularly refreshed, can only be decrypted by MOH and is never accessed unless the user tests positive for Covid-19. Otherwise, it will be automatically deleted after 25 days. The programme stresses that any data shared with MOH is solely for Covid-19 contact tracing.

The programme also does not collect geolocation data or data about your WiFi and mobile network.

For added confidence, TraceTogether also assures that the app’s functionality can be disabled at any time by turning off its Bluetooth permissions or deleting the app. Identification data can also be deleted from the servers by contacting its support team via email.

It also confirms that once contact tracing ceases, users “will be prompted to disable the functionality of the TraceTogether app or return/dispose of the token”.

The mobile app for TraceTogether can be downloaded from the App Store for Apple users and the Google Play Store for Android users.

All residents—including pass holders—aged 7 and above can also collect physical TraceTogether tokens at selected community centres or clubs (CCs) in Singapore. Collection is currently available at 38 CCs, but will be made available at all 108 CCs in Singapore by the end of November.