No central database of contact events exists. - The government or public health authority never learns who was exposed to whom. - The system is resistant to repurposing because the data needed for surveillance is never collected. - Individual users retain control — they must actively choose to uploa