Cool go ahead, you're only gonna get my device identifier, phone model, some encrypted temporary ID that identifies me for 15 minutes, which health agency the a

Cool go ahead, you're only gonna get my device identifier, phone model, some encrypted temporary ID that identifies me for 15 minutes, which health agency the app is affiliated with (the same as the attacker given we are in range), etc. Seriously my Facebook app and the underlying Android OS is sucking way more sensitive data than this is broadcasting. And only to the restricted physical range of Bluetooth. And if you did happen to get my device identifier, TempId etc, you still have to map those to my personal identity. Decrypt my TempId and what do you get, my app UserId. Not even my phone number. Try harder. My bigger concern is a malicious client that can exploit a weakness in mine by sending a specially crafted json payload and gaining remote code execution. The data on its own is pretty worthless for location tracking. It needs enrichment or correlation with other data to be used for that purpose.