There is a big dilemma about privacy in such contact tracing apps, solutions, that require a post of its own.

I mean, if you have no idea who access the data, who can use the data.

Yes anyone can put a TOS or privacy policy that no one can see the data, but even though that's the case, there have been numerous occasions where employees were found to misuse PII.