The government has left open the prospect of ditching its own contact-tracing app in favour of the “decentralised” model favoured by Apple and Google after it was revealed that a feasibility study into such a change is under way. After repeated warnings that the UK will be an outlier if it insists on using its own centralised app rather than relying on Google and Apple’s technology, rights groups and MPs said on Thursday that the lack of privacy and data protections could mean that the app would be illegal. With growing questions over that approach, it emerged that the Swiss-based consultancy Zühlke Engineering has been hired to undertake a two-week “technical spike” to investigate implementing Apple and Google’s system “within the existing proximity mobile application and platform”. Zühlke has already been working on the contact-tracing app since March, documents published this week show, but a new outsourcing contract, first reported by the Financial Times and uncovered by public sector analysts Tussell, shows that the government is now seriously considering changing how the application works to overcome problems with its initial approach. After one source told the Guardian that Downing Street was now sceptical of decisions made in the health service to create a separate app, No 10 sources played down the idea of any division. But the prime minister’s official spokesman left open the possibility that a change could be made, telling reporters: “We’ve set out our plans for a centralised model and that’s what we are taking forwards but we will keep all options under review to make sure the app is as effective as possible.” Under the current plans, NHSX would build its own app, and use a “centralised” model for the service, in which information about who has had contact with who would be shared, in anonymised form, with the health service itself. The centralised model brings advantages in terms of useful insights into the spread of the disease, but also imposes technical limitations that the government has not been able to fully overcome. The Guardian reported on Wednesday that the app relies on a form of “Android herd immunity”, facing connectivity issues in situations where there are not enough users of Google’s smartphone operating system. A switch to the decentralised approach created by Apple and Google themselves would solve these connectivity issues, but limit the visibility the NHS has on the wider spread of the virus. On Monday, Matthew Gould, the head of NHSX, told a parliamentary committee that the decision to build the app without the involvement of the Californian companies was not fixed in stone. “If it becomes clear that a different approach is a better one and achieves the things that we need to achieve more effectively, we will change. We are not particularly wedded to a single approach. It is a very pragmatic decision about which approach is likely to get the results that we need. “If we want to take a different approach, we might have to do some heavy-duty engineering work to make that happen. But I want to provide some reassurance that just because we have started down one route does not mean that we are locked into it.” The day after that, on Tuesday, NHSX awarded the contract to Zühlke Engineering to explore the feasibility of a switch. News of a potential rewrite was welcomed by those who had criticised the government’s previous approach to the app. Michael Veale, a privacy expert at UCL, said: “It looks like academics, civil society and parliament would rush to vocally support the app if the government pivots to the decentralised approach that other countries’ epidemiologists and technologists promote, and place real safeguards into hard law. This has been clear for weeks.”