Utah has rejected the Apple-Google approach to tracing coronavirus, and is using an app made by a social media start-up instead

More than 45,000 people have signed up for Utah's contact tracing app, Healthy Together, since it was released in late April, the app's developers told CNBC. That represents about 2% of the state's population, but could still be helpful to the state's health department as they attempt to track and notify people who might have been exposed.

Digital contact tracing is a new practice that uses software that collects signals from smartphones to track and slow the spread of coronavirus. When Utah's app launched, governor Gary Herbert said in a statement that the app would help enable Utah to "to address outbreaks with a focused approach instead of widespread stay-at-home directives."

In the United States, Utah is one of only a few states to publicly endorse contact tracing apps for iPhones and Android phones and there is no public national strategy. The adoption rate in the state suggests that getting people to download contact tracing apps in the United States may be a challenge as other states consider whether to follow European and Asian countries and release their own apps. 

Healthy Together was built by Twenty, a social media start-up that previously built an app that helps young people meet up in person. After the pandemic started, the state of Utah reached out to the company, the founders said. With their staff of about 50 employees, they repurposed their social media-oriented technology for contact tracing in three weeks.

The goal is to help the Utah Department of Health workers doing in-person contact tracing. Utah currently has 1,200 contact tracers making calls to people who tested positive to figure out where they had been and who they had been with in the past 14 days to ultimately isolate people at high-risk for Covid-19 infection. Twenty's founders say the system will improve the time to trace one positive patient's contacts from a hour-long phone call to about 16 minutes. 

"Our goal is not to replace what public health is. It's to augment their efforts that currently exist," Twenty CEO Diesel Peltz said.

For now, the Healthy Together app is still in testing, and contact tracers cannot use the data being collected. But Twenty chief strategy officer Jared Allgood explains how it will eventually work: 

"Jeff and Sarah are two individuals in this example who don't know each other but they both have the app on their phones. And so the both phones are emitting Bluetooth and GPS signals," Allgood said. "Through that data we can identify whether or not two people have spent some time together."

App users can find a test through the Healthy Together app, if they're in Utah. Users can also get their test results in the app. Then they get an invitation in the app to share their location history and contact history over the past 14 days with a contact tracer. 

"If Public Health is calling somebody who has the application on their phone, and they've granted permission to see this minimum set of data to do the contact tracing effort, now, instead of spending an hour, you know, interviewing Jeff and trying to fill in the gaps in his memory, they together can step through his list of location history," Allgood said. 

Twenty eventually hopes to sell the app and back-end to other states, as well as to private companies that want to do contact tracing among employees, which could be a multi-billion dollar industry. 

Some estimates suggest that contact tracing needs 60% of a population to download a contact tracing app for it to be effective. But Tom Hudachko, a spokesman for the Utah Department of Health, said the way Utah's app is set up means it doesn't need a large percentage of the population to download it to be useful. 

"Essentially what will happen is, is if an app user tests positive, they will be able to share their location history with the contact tracer who works their case," Hudachko said. "If you're able to share your location history, if you've been using the app, that provides a nice guide for that discussion."

Utah's governor's office spent $2.75 million for the app and other improvements, and will pay $300,000 per month in maintenance fees, according to public records cited by Utahpolicy.com, a website focusing on local politics.

Utah's approach draws a contrast with the decentralized, anonymous systems backed by Apple and Google and several countries in Europe. Those systems cannot provide information to public health departments. Instead, they send alerts directly between phones to tell people if they might have been exposed, and relies on users to contact health departments if they've tested positive.

Privacy and security-oriented technologists are generally concerned about contact tracing apps because they collect data about who people know and have met with. Some worry that the data could be stolen or used by unscrupulous governments for purposes not related to public health, or that the technology could "creep" into a larger surveillance system. 

"We are concerned about people being able to safely and securely use technology, especially when it comes to contact tracing," Kelvin Coleman, chairman of the National Cyber Security Alliance, said. "But I must be honest, the privacy part of it is much worse for me, and that 'creep' is absolutely what keeps me up at night."

Twenty's founders say that the app is totally opt-in and that users can choose to limit permissions such as GPS or Bluetooth on their phones if they don't want their location to be tracked. The user also has a choice to share their location data with the public health department if they test positive, and any Bluetooth or GPS data is deleted after 30 days, Twenty said. 

"We've explicitly limited ourselves and the state of Utah's use of all the data that is shared on to COVID-19 public health and research purposes," Peltz said.