You could work with rotating anonymous uuids.
1. You log which uuids you see.
2. When someone is tested positively, you add the list of uuids you used to a public list (run e.g. by the government)
3. Clients fetch updates to the list and compare it to the logged uuids and alert the user if there is a match.
This way the government could not identify individuals, and individuals would be in control.
