Contact Tracing Web Application

During the COVID-19 lockdowns of 2020 and 2021, the UK hospitality sector faced strict operational restrictions, including mandatory contact tracing for Public Health England (PHE). Before this project, the venue was managing these requirements using a physical notebook and pen—a method that left sensitive customer details exposed on the bar for anyone to read. At a time when the official NHS app was struggling to meet operational needs, we developed a secure, bespoke solution.

The Challenge

The primary challenge was balancing strict public health compliance with customer privacy and ease of use. The physical notebook was fundamentally insecure and difficult to manage. We needed a frictionless digital system that patrons could use quickly upon arriving, whilst ensuring their data was rigorously protected, verified, and easily accessible only to authorised health officials when required.

The Solution

We replaced the notebook with table tents featuring scannable QR codes, leading patrons to a simple, browser-based check-in system. By integrating the Twilio API, we built a robust communication and verification flow. Key technical features included:

• Frictionless Check-In & Check-Out: Patrons scanned a QR code to check in, logging their name and time of arrival. The system then issued a secure checkout link via SMS to log their departure time.
• Smart Number Verification: Using Twilio, mobile numbers were verified to ensure accurate contact data. To streamline the user experience for regular patrons, this verification was only required the first time a number was used.
• Privacy-First Architecture: The system operated under a strict "no marketing" policy. Unlike other apps, we deliberately excluded unnecessary geo-location tracking, which often resulted in false-positive contacts. Contact tracing was left strictly to PHE in the event of a confirmed infection.
• Secure Data Management: We built a dedicated, secure frontend for health officials to easily view and export contact logs if an outbreak occurred. This provided much stricter access control than the previous physical notebook.
• Automated Compliance: To adhere to data protection regulations, the application featured an auto-cleanse protocol that permanently deleted all visitor data after the mandatory 30-day retention period.

The Outcome

The application successfully modernised the venue's compliance strategy during a highly volatile period for the hospitality industry. It provided patrons with reassurance regarding their data privacy, gave staff an effortless system to manage, and ensured the business fully met its statutory duties to Public Health England without relying on failing national infrastructure.