The contact-tracing app for England and Wales has only sent one alert about a coronavirus outbreak in a venue since it was launched two weeks ago, despite being used for millions of check-ins, Sky News has learned.
Department of Health officials said that the system was still in its infancy and was not expected to be used frequently.
But with mass closures of pubs and bars expected in parts of the country, the absence of targeted venue alerts has raised questions about the government's strategy.
Shadow digital minister Chi Onwurah said: "On the one hand, at a government briefing on local data I'm told pubs are the primary location for common COVID exposure, on the other that the contact-tracing app has only sent out one alert about an outbreak in a venue.
"There is a plain contradiction there and ministers need to get a grip."
The app has now been downloaded 16 million times, thanks in part to its QR code scanner, a feature built into the app in addition to the contact-tracing system, which tells users whether or not they've been near someone who has tested positive for coronavirus.
The QR code scanner allows people to check in to venues such as pubs and restaurants. If there is an outbreak in a venue, then NHS Test and Trace can send an alert to anyone who has visited.
Ministers hailed the system as a crucial step forward and passed a new law making it illegal for bars, restaurants and pubs not to display an official NHS QR code.
Three days after the app's launch on Thursday 24 September, the Department for Health and Social Care boasted that more than 480,000 businesses had downloaded QR code posters.
That Saturday, Test and Trace recorded more than 1.5 million venue check-ins in a single day.
But a data file in the code for the app, uncovered by Sky News, shows that only four alerts have been sent out about outbreaks in venues, three of which expired before the app was launched nationwide.
The code for the app also revealed the text of the alert that will be sent out in the event of an outbreak in a venue, exposing the difficulties involved in using a system built to protect privacy for public health communication.
Data about check-ins is stored locally on phones, so when the app sends an alert about an outbreak it cannot name the venue where the outbreak has taken place. Instead, it says: "We are letting you know that you may have been exposed to coronavirus when you were out."
Paul Hunter, professor of health protection at the University of East Anglia, said this lack of detail meant venue alerts "almost certainly can't be relied on to be an important and effective way of controlling the epidemic."
The privacy-protecting design of the app also means that, in contrast to other QR-based or manual check-in systems, public health officials cannot look at the data to see who has checked in at a venue using the app, a fact Professor Hunter said made him question whether the app was an obstacle to effective virus control.
"If it's all done through the app and Public Health England and the local public health teams don't know anything about it, is it making the outbreak worse?" he said. "It could be acting to hide clusters and outbreaks from local public health teams.
"If that is happening then that is a really serious problem and will undoubtedly make it more difficult to control the epidemic."
Senior Test and Trace officials defended the system, saying that it made checking in easier and more accurate, while also encouraging wider adoption of the app. They pointed to a similar check-in app in New Zealand which they said had been very successful.
Yet although the check-in system works in both England and Wales, the Welsh government has not made it compulsory for businesses to display NHS QR code posters and has continued to ask pubs and restaurants to record details manually or through their own QR check-in systems, which do not have the same privacy-protecting constraints on data collection.
A Welsh government official said they wanted to avoid disrupting the country's existing contact-tracing effort.
A spokesperson told Sky News: "Our contact-tracing system, which is a publicly-run service and locally delivered, is working very well, with a very high contact and trace rate."
Asked about the difference between the Welsh and English systems, a senior Test and Trace official said it was up to each country to decide, pointing out that manual check-in logs tended to be filled with Mickey Mouses and Donald Ducks.
Please use Chrome browser for a more accessible video player
Is long-awaited test and trace app up to job?
In order to send an alert, public health officials add the code for that venue to a data file, which is automatically sent to every contact-tracing app several times a day. The app then checks to see if the codes on the file match any of the places where the user has checked in.
Rather than giving specific advice, the alert tells people to watch out for symptoms, a strategy DHSC officials described as "warn and inform".
After saying: "We are letting you know that you may have been exposed to coronavirus," the alert continues: "Although there is only a small risk that you have been infected during your visit, please continue to follow the latest advice on social distancing." It then asks people to "use the symptom checker on the app and book a free test if advised to do so".
:: Subscribe to the All Out Politics podcast on Apple Podcasts, Google Podcasts, Spotify, Spreaker
Health officials described the QR check-in system as an additional feature for the app which would only be used if a venue was linked to an outbreak, something they did not expect to happen frequently.
Asked about the absence of venue alerts in the fortnight since the app launched, a Department of Health and Social Care spokesperson said: "The NHS Covid-App is an important public health tool, downloaded more than 16 million times, which is helping to stop the spread of this virus.
"Alongside the app's contact tracing features, the QR code check-in system performs a number of important functions, not least providing a digital diary for users to prompt them as to who they have been with should they test positive.
"If Heath Protection Teams believe a venue is linked to an outbreak they may send a 'warn and inform' message to app users who attended the venue at a similar time based on when they checked-in."