Here’s the summary of their Privacy Policy:
“Who will be using my data?
Full details, including the institutions we are working with, can be found in our privacy policy.
A summary follows:
Your data is protected under GDPR, and can only be used for the purpose that you consent to. That means it can only be used for medical science and to help the NHS.
This is a not-for-profit initiative, and your data will not be used for commercial purposes.
We try to minimise the amount of personally identifiable information we collect (eg. year of birth but not date of birth), while recognising that the research requires it.
The data you share will be used for research purposes by King's College London, Guys & St Thomas' Hospitals and data scientists at ZOE Global Ltd. It may also be shared with the the UK National Health Service.
Anonymised data may be shared with partner research institutions. To do so, an anonymous code will be generated to replace your personal details. Our partner institutions include: Harvard University, Stanford University, Massachusetts General Hospital, Tufts University, Berkeley University, Nottingham University, University of Trento and Lundt University. Some of these research institutions are in the US, and so are not governed by GDPR, and our privacy policy explains this.
You may share your name and mobile number if you wish, but this is optional and is intended to allow us in the future to provide this information to the NHS should you appear at risk. This is not available today, and the app does not provide any diagnostic advice. If you have any health concerns you should go to the NHS website.”