Privacy policy

Rakning C-19 – APP

Rakning C-19 is an app you can choose to download to assist in the tracing of COVID-19 infections. The APP is based on Bluetooth technology which enables it to automatically trade anonymous randomized ID´s with other app users within a predefined proximity to your mobile device. If anyone you trade keys with confirms a COVID-19 infection through the app you may receive a Exposure Notification in your app.

The Directorate of Health, Katrínartúni 2, 105, Reykjavík, is the data controller for all processing of personal data related to your use of the APP and the registration website for exposed individuals.

Which personal data do we process?

When you download the APP and activate it on your mobile device you can choose to register your phone number. The phone number will be used to send negative results from PCR tests at arrival to Iceland. While the APP is active on your device it collects anonymous randomized ID´s and stores them for 14 days in a secure manner. The APP starts collecting data when you activate it. The randomized ID´s are only stored on your device and will only be shared in case you contract COVID-19 and you consent in sharing data upon request by the Contact Tracing Team. No personally identifiable data will be shared from the APP, only the anonymous ID´s. Those who receive a Exposure Notification based on your data will not know from whom the notification is sent.

Exposure Notifications

Ef you receive a exposure notification you will be given the opportunity to visit a website with further information about what the exposure notification means and which measures you should take in response to the notification. You will also have the opportunity to register as an exposed individual. By doing so you will automatically be booked for a free COVID-19 test, seven days after your exposures.

In the registration form you will have to provide your name, Icelandic social security number (where applicable) and date of birth.

What is the purpose of the processing?

The purpose of the processing of personal data relating to the use of the APP is to ensure quick and effective contact tracing and thereby assisting the Contact Tracing Team to find individuals who may have been exposed to COVID-19.

The purpose of the processing of personal data on the website for registration of exposed individuals is to ensure effective infection control to fight the COVID-19 pandemic.

According to Act 19/1997, on Health Security and Communicable Diseases, data collected for contact tracing cannot be used for other purposes.

What is our legal basis for processing your data?

The procsesing of data in the APP is based on your consent, this includes the registration of your phone number and the registration of randomized ID´s on your device and eventual exposure notification or confirmed COVID-19 infections you choose to register. You can withdraw your consent at any given time by simply deleting the APP from your device, by doing so your device will no longer send or receive randomized ID´s and all data which may have been registered in the APP will also be deleted.

The processing of personal data relating to the registration website is processed or sharing of ID´s with the Contact Tracing Team is based on the authority vested in the Chief Epidemiologist of Iceland by the Act on Health Security and Communicable Diseases.

Security of processing

We take care of your personal data in a secure way to ensure it is not inappropriately lost, misused, accessed, disclosed, altered or destroyed.

All communication of personal data is encrypted or routed through encrypted communication channels.  

All databases are encrypted and secured by firewalls. Automated threat detection and response mechanisms are used to prevent any unauthorized access or attempts to breach databases.

Access to databases is logged and access is only granted to pre-defined personnel.

Your Rights

We are committed to respecting the data subjects’ rights. You have the right to access all data we may process regarding you. You also have the right to ask us to correct your personal information. You also have the right to demand amendment or deletion of personal information we have about you as well as the right to data portability, restriction of processing of your personal data, to object to the processing and to file a complaint with the Icelandic Data Protection Authority, Persónuvernd.

If you intend to exercise your rights or if you need any further information, please contact us at:

Back to home page