RKI app: With fitness tracker data against Corona

Lisa Vogel studied departmental journalism with a focus on medicine and biosciences at Ansbach University and deepened her journalistic knowledge in the master's degree in multimedia information and communication. This was followed by a traineeship in the editorial team. Since September 2020 she has been writing as a freelance journalist for

More posts by Lisa Vogel All content is checked by medical journalists.

"Wash your hands. Keep distance. Donate data. Your contribution against Corona ”- with this request, the Robert Koch Institute (RKI) addresses the users of its new app. The application accesses the health data of fitness trackers and smartwatches and is intended to help in the fight against Corona. But how? And is the sensitive data really safe?

The RKI's “Corona data donation” app has been available free of charge in the App Store and Google Play since the beginning of April. It uses data that smartwatches or fitness trackers collect about their wearers.

Around five million people in Germany already use such devices. Any owner who is at least 16 years old can register and donate their personal health information. More than 160,000 people have already downloaded the app.

Increased resting heart rate as an indication of an infection

Health data, such as the user's increased resting heart rate, indicate that the wearer may have contracted the coronavirus. Of course, this is not proof of infection. Nevertheless, if enough donated data is available, projections could show in which regions the coronavirus pandemic is currently picking up speed. The previously specified postcodes of the data donors serve as a guide. Location data are not collected.

Record infection occurrences in Germany faster

The data could help to shed light on the number of unreported cases of coronavirus infections and to discover possible infection hotspots at an early stage. This would allow the temporal and spatial spread of Sars-Cov-19 to be better assessed and suitable measures to be taken to contain it.

An individual infection warning, such as that provided by an independently planned, Bluetooth-based Corona app, does not occur.

How does the app work?

Fitness equipment and smartwatches record various vital parameters, for example heart rate, pulse or daily activity. These parameters change with an acute respiratory disease such as Covid-19. In the case of an infection, for example, the resting heart rate is increased.

The RKI processes the collected data. They then flow into a map that shows the spread of potentially infected people. It is displayed down to the postcode level of the app users. This map should be updated regularly and published on the website www.corona-datenspende.de. The card is not yet available.

Which data does the app use?

After the download, the application asks the user to enter their postcode and to agree to the extensive data protection regulations. The data donation will not work without this information. Each user is then assigned a pseudonym made up of letters and numbers. The data is passed on under this user ID.

These data are transmitted automatically

If stored on the tracker, some data are automatically transmitted to the RKI after consent to the data donation. This includes:

Age (rounded to five years)
Size (rounded to five cm)
gender
Weight (rounded to five kg)

These data are only transmitted with consent

With the specific measured values of the tracker, the user can specify which data he would like to disclose. Which data is collected always depends on the device used. This includes information about:

sleep
Activity and training
Heart rate
Pulse
Blood pressure
temperature
stress
weight
personal profile

Once a day, the collected data is encrypted and transmitted to the RKI. The servers are located in a German high-security data center certified for IT security and failure protection.

Are my sensitive data safe?

The data is always recorded using the assigned pseudonym. According to its own information, the RKI cannot assign any personal information such as name or address to the user ID.

“Data collection and processing are subject to strict data protection guidelines and have been checked under data protection law. The donors have the option at any time to view, manage or delete their data via the menu of the app ”, writes the institute.

Data protectionists criticize a lack of insight into the code

The German Society for Informatics (GI), on the other hand, criticizes the fact that the app does not meet the requirements with regard to data protection and IT security. In particular, the fact that the code of the application is not publicly documented and verifiable is a thorn in the side of society. This is absolutely necessary for such apps.

The Federal Commissioner for Data Protection and Information Security has also not yet assessed the Corona data donation app.

Will the user be located?

A movement pattern is not recorded by the data donation. The geographical classification is only roughly based on the postcode specified once.

Will the data be passed on to third parties?

Yes. The Robert Koch Institute works with the service provider Thryve from mHealth Pioneers GmbH. The service provider has access to certain data.The service provider processes the data “under the supervision of the Robert Koch Institute in accordance with the applicable data protection law”, writes the RKI.

What the app can't do

The evaluation of the health data can provide indications of a corona infection - even if the disease is asymptomatic or mild. However, the app cannot distinguish whether the wearer of the tracker has not been infected with another pathogen or, for other reasons, is developing a higher resting heart rate, for example.

In addition, the user does not receive any warning that he may have been infected. The data remains with the RKI.