You could work with rotating anonymous uuids. 1. You log which uuids you see. 2. When someone is tested positively, you add the list of uuids you used to a pu

You could work with rotating anonymous uuids. 1. You log which uuids you see. 2. When someone is tested positively, you add the list of uuids you used to a public list (run e.g. by the government) 3. Clients fetch updates to the list and compare it to the logged uuids and alert the user if there is a match. This way the government could not identify individuals, and individuals would be in control.