All your data stays on your device. You only upload your random identifier if you test positive, as confirmed by a trusted health provider. I would worry much more about them if I were you. Personally I'm far more concerned about dying from COVID-19 than the government who already knows much about me abuses my health status of this virus.

No data is. You can't judge the security or privacy of a design based on people selling it out in secret.