The government must legally swear to delete all the data it captures using the NHS Covid-19 contact-tracing app, a committee of MPs and peers has urged.

The joint committee on human rights (JCHR) has taken the unusual step of producing a draft bill for the government to pass as soon as possible that would prevent the government from using the information gathered for any other purpose than fighting Covid-19, and require it to delete all the data after the pandemic ends.

The impending release of Apple and Google software for building decentralised contact-tracing apps will put more pressure on the government, which took the controversial decision to forge its own path and build a centralised app, in part because it was concerned that the Apple/Google system would not be ready in time.

The decision to go it alone was driven by a belief that contact tracing could be carried out faster if users were allowed to self-diagnose, as well as a hope that the NHS could gather valuable insight from data collected by the app.

But the government has declined to guarantee that the data will be deleted after the pandemic is over. Matthew Gould, the head of NHSX, the health service’s digital transformation arm, told the JCHR that the data “will either be deleted or fully anonymised in line with the law, so that it can be used for research purposes”.

In its findings from a rapid inquiry, the JCHR said the government needed to commit to total deletion and legally bind itself to that promise. “We cannot rely on the current failed mishmash of protections that were never envisaged for this situation,” said the committee’s chair, Harriet Harman.

“We need new legislation. Government collection of our movements and physical contacts would have been unconscionable before, but now it is happening. Big powers demand big safeguards. The government should not resist their assurances being put into law. Parliament completed emergency legislation for new powers. It can do it now for new protections.”

If the government does not take up the JCHR bill, the committee has asked the leader of the House of Commons, Jacob Rees-Mogg, for special permission to let Harman move it as a private member’s bill.

There is an increasing acknowledgement within No 10 that the NHSX app is having difficulties and may not survive in its current form, following trials on the Isle of Wight.

Matt Hancock, the health secretary, said this week that the app would be ready for launch in mid-May, but on Thursday Downing Street would only confirm that the human contact-tracing element of the “test, track and trace” strategy would be ready by next week.

From next Tuesday, Apple and Google users will be able to install the companies’ new software, which will show up on iPhones as iOS 13.5 and on Android phones as an update to Google Play services. They will only be able to use the contact-tracing functionality if they live in a country that has built an app using the companies’ programming tools, and have installed that app. Ireland and Germany are among the countries to have done so.

A second Apple and Google update, expected in June, will allow users to switch on contact-tracing functionality without installing any apps at all, which the companies hope will greatly increase the number of devices that are in the system. That update too will only work in countries that have decided to work with Apple and Google.