Wait, so how are you matching the beacons (cryptographic random values) back to individual users?The back end only gets that information if a user tests positive and agrees to submit the data.

Even then there is no reason to store that linkage so server compromises won't leak this information.