Deletion is not enough. Destruction is instead required.
They need to release their server side code as the mobile app could be just the tip of a very big iceberg.
They should also provide details of the platform ecosystem and how it’s secured; trust boundaries, IAM, PAM, audit, etc.
Point being that Snowden is right when he warns that the architecture of oppression is being built in the name of COVID-19.
We need a tracing system that can only be used to serve the people, and not some wannabe tyrants.