Hoia protect yourself and your closest ones

HOIA is a mobile app that helps limit the spread of the COVID-19 virus with the help of the app users. The purpose of the app is to inform the close contacts of those infected with the coronavirus and, therefore, to provide them with initial instructions on how to proceed. In this way, the user can quickly find out about possible close contact with a COVID-19 infected person, allowing them to take steps to protect their own health and the health of others.

Phones that use the app register the Bluetooth signals from other nearby phones. If the signal is sufficiently close and long enough, an anonymous code referring to a close contact will be stored in their phone. If a person now confirms their infection with the HOIA app, the anonymous codes on their device will be uploaded to a central server where all users can download them. It is not possible to identify a person based on an anonymous code. The user’s phone compares whether the infected person’s anonymous code matches a code previously stored on their phone. If so, the user is considered to be a close contact and they will be notified with instructions. It will not be revealed to the user who the infected person was with whom they were in contact with, or any other information that would allow the indirect identification of the infected person.

Indeed, the emergency situation is over and we all hope that the more difficult days of the COVID-19 epidemic have currently passed. However, we must not lose vigilance. The pandemic has not ended, and if the movement of people increases both within Estonia and internationally, there is still a risk that the disease will spread again. This does not mean that we should pause our everyday life until researchers find a cure or vaccine against the coronavirus. The HOIA app is designed so that we can face the next wave one step ahead of the virus. The earlier the chain of infection spread is stopped, the fewer people become infected and the easier it is to get rid of the virus. Informing the close contacts of an infected person as soon as possible is an important tool in limiting the spread from person to person, and HOIA does just that. Now that the times are calmer, it is our best chance to test this important tool and practice using it with our closest ones.

Viruses such as COVID-19 can spread before symptoms occur, therefore, an infected person may spread the disease without the knowledge of themselves and others. This means that by the time the symptoms appear, the virus may have already spread to others, and it is not enough for symptomatic people to stay at home to stop the virus from spreading. Through the HOIA app, an infected person can quickly inform all people with whom they have been in close contact during the infectious period. In this way, the app users can find out about a possible infection early on and take steps to protect themselves and the health of others. By using the HOIA app, you contribute to reducing the number of infections in Estonia, regardless of whether you are infected or in close contact.

Indeed, the Health Board has a team tasked with calling everyone infected with the coronavirus, finding out with whom they were in close contact and in turn informing those close contacts about a possible infection. This work is very important to limit the transmission of the infection, but it has certain natural shortcomings. Not every infected person may be able to remember all the people they were in close contact with: some people tend to forget and some cannot easily identify them. For example, most people do not know who they were sitting next to on a bus. Therefore, HOIA creates significant added value to the work of the Health Board, as it can also identify those close contacts that the infected person does not know or remember.

Some studies have shown that if we only used the app, it could be possible to control the epidemic by covering 60% of the population. In reality, it is not necessary to reach such a large number of users, as the app serves merely as one of several means in our toolbox to limit the spread of this virus. It is a simple and safe tool of protection that will make all other measures more effective. It also depends on who the users are – people who move around a lot, come into contact with potentially sick people and generally more people on a daily basis could definitely use the app. As one person transfers COVID-19 to two other persons on average, it does not take long for one infected to spread the disease to many others. Therefore, every user counts: if we cut through at least one chain of infection thanks to the use of the app, we will avoid the wider spread of the virus.

The use of the HOIA app is completely optional. We do not want to oblige anyone, but to give people the opportunity to help limit the spread of the virus in Estonia.

The app is in three languages - Estonian, English and Russian. In the iOS app, changing the language can be done within the app. For Android apps, the first version supports changing the language of the app at the level of the operating system. If the device OS is in English, the app will be in English. For newer Android phones, changing the OS language can be done via "Settings" -> "General management" -> "Language and input". Exact instructions can be found at your phone manufacturer. Future versions of the Android app shall support changing the language within the app.

The app is only used to control the coronavirus epidemic in Estonia. We need to be prepared that the epidemic has more than one wave in Estonia, so the app may also be in active use for more than one period. Initially, we cannot say whether HOIA could be suitable for limiting the spread of another viral disease, but we are open to this possibility.

If you were notified by the app, it only means that you have probably been in close contact with someone infected with the coronavirus. This does not mean that you will definitely get sick. It is now important to stay home and observe your symptoms. Self-isolation requirement does not apply if you have fully completed COVID-19 vaccination or you have had COVID-19 during the last 180 days. For example, if you have a dry cough, fever or breathing difficulties, please contact your family doctor who will arrange for you to be tested and treated. It is also vital to remember that even if you have an infection, this does not mean that it is severe: most cases pass easily.

If you have already isolated yourself by the time you receive a close contact notification and you are certain that you have not been in contact with anyone during the isolation period in a way that could have transmitted the infection, start counting 10 days from the day you began your isolation period. If you isolated yourself 7 days ago and you received the notification today, please stay home for another 3 days.

Report yourself as sick in HOIA app, using Smart-ID or Mobile-ID. As the purpose of HOIA app is not to assess the violations of self-isolation, HOIA will cease to work. When you have recovered from the infection, we recommend deleting data from HOIA app using the "Erase Data" on HOIA home screen. After that, you can reactivate the application in HOIA settings. In this case, HOIA protects society and our loved ones by preventing re-infection.

Close contacts who have been notified through the app will be treated in the same way as those close contacts who are identified by the Health Board during an interview with an infected person. According to the current guidelines, this means that if you develop symptoms, you can also be tested by your family doctor.

If HOIA detects that you have been in close contact with a virus carrier, it will advise you to isolate yourself and observe your health for 10 days. Such caution is essential to limit the spread of the virus. Self-isolation requirement does not apply if you have fully completed COVID-19 vaccination or you have had COVID-19 during the last 180 days. You will also be offered a phone number to call for more information. Through the app, it is not possible for anyone other than you to detect that you have been in close contact with a virus carrier, therefore, nobody can impose a movement restriction on you. Restricting your movement is a personal concern for each app user that no other person or authority can control.

The HOIA app functions through private communication between phones. If you are heading somewhere and may come into contact with other people, it would be really beneficial to carry a phone with you that has the app for the best results. You should also make sure that your phone has Bluetooth turned on.

No. The HOIA app can be used at any age, including those under 13 years of age. As the app does not process personal data, the use of the app does not require the separate consent of a parent of a child under the age of 13. However, parents can always check which apps can be downloaded to their children’s phones. Children below the age of 13 can be marked as infected in HOIA by their parents or legal guardian by using their child's mobile phone and logging in with their own user.

In the interests of speed and user-friendliness, we released the first edition of the app in such a way that the app only supports mobile authentication tools, which in Estonia are Mobile-ID and Smart-ID. This way, the app user can confirm their infection directly from the phone via the Patient Portal. In addition to confirming the infection using Mobile-ID and Smart-ID, we are creating an option to also confirm your infection during an interview with the Health Board, which is carried out with each infected person and during which no authentication means are required. We recommend that every Estonian make a Mobile-ID or Smart-ID, allowing them to use the state services even without a card reader. Read more about Mobile-ID here and Smart-ID here.

No, it does not. It is possible that the person you were in close contact with does not use the app and, therefore, your phone did not detect the close contact. If another person used the app, it is still not possible to say with certainty that there was no risk of infection if the notification was not received. The infection also spreads through contact surfaces, and the app cannot detect such spread. However, it is possible to monitor such close contacts manually. Therefore, if you work in the same place as the infected person, but you have not come in contact with them personally, you may still be infected, even though there was no close contact with the person and the app did not send you any notifications.

Since people exposed to COVID-19 ("close contacts") have to isolate as to not spread the disease, they are entitled to go on sick leave if they should require it. The right to sick leave applies to all exposed people, regardless of whether they have been detected by the app or by the Estonian Healt Board. Every close contact seeking to apply for sick leave, must request this from their family doctor. In order for a family doctor to confirm that an exposure has taken place, he or she will check with the Estonian Health Board. Therefore, if the app has detected an exposure, you should notify the Estonian Healt Board by calling the number displayed (+372 794 3500). Upon calling, you will be connected with an exposure notification specialist who will ask a few confirmatory questions and then register your exposure. After that you may apply for sick leave at your family doctor.

The arrival of notifications depends on the fact when the app requests the codes of the infected and when you came into contact with the infected. If you came into contact with an infected person on the day their infection was confirmed, the system will reveal the infected person’s code to you the next day. If you came into contact with an infected person before the day their infection was confirmed, the system will reveal the infected person’s code to you as soon as your app asks for the codes. Currently, the Google and Apple application interfaces allow you to request codes twice a day.

Based on your phone model and its operating system you get weekly informative notifications, which include summarised information about possible close contacts. In Apple IOS it is possible to switch the notifications on or off in Settings - Notifications - COVID-19 Exposure Notifications - Allow Notifications. In Android you have to choose Settings - Google - COVID-19 exposure notifications and toggle the on-off button for activation or deactivation. These notifications are visible on the notification panel only until you click on them or swipe them left or right.

HOIA app sends notifications to the notification panel with the following information: New message. Open the app to read the message. Once you click on the notification it opens the HOIA app and on the main screen a possible close contact information is displayed with a suggestion to isolate yourself for a certain period of time: You have been in contact with 1 COVID-19 carriers. To stop the spread of the virus, stay at home until xx.xx.xx. This information is visible in the app for 10 days. If you delete your data from the app the possible close contact information is also deleted and you are no longer able to see this. If you swipe the HOIA notification off from the notification panel you can still see the close contact information in HOIA app.

A represented person may be e.g. your underaged child or an adult with limited legal capacity whose rights you have been granted to represent.

The main function of the app is to inform and guide you if you may have been in close contact with a person infected with COVID-19. Therefore, the app uses three types of information: information on close contact, information on infection, and information on code of conduct.

1. Close contact is defined as having been in contact with the infected person for at least 15 minutes and less than 2 metres apart during the day. The phones automatically collect information about close contacts via the Bluetooth radio signals, and the interpretation of the signal into a distance is based on extensive international research carried out by Google and Apple, among others, which have developed your phone’s operating system.
2. Infection of persons is confirmed against an external source of evidence, which in Estonia are the Health Board and the Health Information System. This means that no user can signify themselves to be infected, unless they are really sick. If the phone notifies you of close contact with an infected person, you can be certain that the person who sent the notification is actually infected.
3. If you turn out to be a close contact, the instructions shown to you have been approved by the Health Board. In addition, you will be displayed the phone number of the Health Board, where you can call for more information.

The use of the HOIA app does not require that you should waive your right to privacy. The app can be used in such a way that no other user can find out about your infection or contact with the infected person. No government authority will be able to monitor any user through the app. If the app detects that you have been in close contact with an infected person, you can contact the Health Board to report it, but the Health Board will not collect this information through the app. If you turn out to be the infected one, then this information will reach the Health Board via laboratories and family doctors, not through the app.

As Bluetooth is a positioning technology, it is formally a part of Android location services. Turning on Bluetooth in an Android application will therefore require you to permit the app to use location services. We assure you that HOIA does not gather any information about your location.

HOIA sends out a notification if you have been in close contact with an infected person. This notification does not tell you who the infected was, where and for how long you were in contact with them, or when you were in contact with them. Therefore, it is not possible to identify the infected person on the basis of the notification.

The app cannot access the information on your phone (contacts, location, etc.). If you start confirming your infection through the app, the app will redirect you to the national Patient Portal, however, this portal will not return your health information to the app, but will only confirm the infection to the app server in a non-personalised manner.

A short-term anonymous code is generated for each user of the app, which changes regularly. When you are close enough with another user, your phones exchange each other’s anonymous codes. In addition to the code itself, the phone saves how long it has been seen and how far the owner of the code may have been during this time (based on the strength of the Bluetooth signal). If you turn out to be the infected one, you will have the option to download your anonymous codes to the app server, where other users can also download them to compare whether or not their phone has already seen your code. The app does not collect any other information about you or your close contacts.

The first and most important step in limiting information leakage is to minimise the amount of information collected. The data collected by the app is not personally identifiable. The information about infected persons, which is necessary for the confirmation of an infectious disease, is stored in the Health Information System, as has been the case for already more than ten years. No new database will be created for the app, so no new information leakage risk will be established. The app server, which receives the anonymous codes of the infected, is located in the Estonian Government Cloud, where it is protected from attacks. Even if someone could access the server, they would only see a bunch of anonymous codes there, which in themselves do not carry any information. The app is based on a distributed principle, as a result of which useful information from the data exchanged through the app is created only on the basis of cooperation between the various components of the app, and this information is displayed only to you via your phone. Read more about how to better protect your phone from possible information leaks here.

In order to use the app, you need a phone based on the Android or iOS operating system. For HOIA to function best, you need to use the close contact notification interface provided by Google and Apple. Therefore, usability is limited to phones manufactured in the last 5 years. Android phones are, therefore, suitable for all phones that support the Android 6.0 operating system. All Apple phones that support the iOS 13.5 operating system (from iPhone 6S) are compatible.

Initially, the HOIA app is only available for smartphone users. If an infected person does not have a smartphone, they are still able to notify their close contacts: to this end, the Health Board has set up a separate team of people who help the infected person to find out and inform their close contacts during the interview.

The HOIA app runs in the background on your phone and requires a Bluetooth connection to function. This also results in slightly higher battery usage. For the Bluetooth connectivity, the app uses the official application interface developed by Google and Apple. This interface tries to minimise battery drain and maximise device uptime when using the app.

The app only needs Bluetooth for regular operation. At least once a day, connect your phone to the Internet to check nearby contacts. During this check, a small amount of information is downloaded, which should not exceed 200 kB. Therefore, the app uses little Internet connection and the availability of the mobile Internet is not absolutely necessary – downloading the information needed for notifications also functions via WiFi.

In case of phone apps used to notify people of close contacts, we speak about a ‘centralised’ approach and a ‘decentralised’ approach, i.e. a distributed approach. For centralised apps, the proximity detection calculation is performed on a central server. This means that the anonymous codes of both the infected person and the person who has come into contact with them are uploaded to the server, and a calculation is performed on the server to identify whether the respective persons were in close contact. In case of distributed apps, only the anonymous codes of the infected persons are downloaded to the server, and other phones will download these anonymous codes. Therefore, in case of a distributed solution, the server cannot calculate the occurrence of a close contact, but it must be done by a person, i.e. your own phone. In case of centralised solutions, the owner of the app server (mostly the state) will receive slightly more information about the infected and their close contacts than in case of distributed solutions. Privacy researchers have pointed out that with a centralised solution, the server owner can create a social chart of the infected, which is beneficial for epidemiological research, but which also creates the possibility to indirectly identify the close contacts of the infected. With a distributed solution, the server owner cannot detect the infected person’s close contacts either directly or indirectly. HOIA is a distributed solution.

The close contact information apps are relatively new to the world, and the longest experience with them has been in Singapore, where the epidemic has been managed very successfully so far. The main lesson has been that in developing such apps, it is necessary to work closely with companies that create phone operating systems to avoid typical app performance problems. Therefore, the Estonian app has been integrated with the application interface developed by Google and Apple, ensuring smoother operation of the app and the lowest possible battery consumption.

HOIA has been created in cooperation between the state and Estonian companies. Among other things, the companies contribute to developing the app for free of charge, as they believe in the value of this app in limiting the spread of infection and restoring normal life. Therefore, the state spends taxpayers’ money minimally, however, according to the state, the app still benefits taxpayers, allowing citizens to react faster in the event of a possible risk of infection.