Facial recognition has been added as a way of logging in to an NHS app that lets people order prescriptions, book appointments and find healthcare data.
Initially, it will allow faster access to the services on the app, which is separate from the contact-tracing one.
But its developers say it could also be used for Covid-19 “immunity passports”.
Such passports, where people carry documented proof they have immunity because of a past infection, are already being tested in Estonia.
Health Secretary Matt Hancock has previously hinted at the possible use of a “system of certification” for those with antibodies for coronavirus.
The NHS facial-recognition system, built by iProov and available in England for both Android devices and iOS, requires users to submit a photo of themselves from an official document such as their passport or driving license.
The system scans a person’s face using their phone and, following a short sequence of flashing colours, their identification will be verified and they will have access to all the services on the NHS app.
More than a million people have now registered with NHS login, with a peak of more than 60,000 new IDs verified during the first week of April.
Founder Andrew Bud told BBC News: “NHS Digital has built a strong and trusted identity system in NHS login, which, in my opinion, should form the basis of the UK’s immunity passport.
“Whether they do so is a decision for them.”
In response, a spokesperson for NHS Digital said it “has not been commissioned to apply this technology to any other purposes beyond providing a secure login capability via mobile devices”.
Immunity passports need to link a person’s identity to their coronavirus test results, so would require a robust way of allowing people to verify themselves.
Those deemed clear of the virus could then prove their status via a code generated by an app.
The idea has proved controversial, not least because there is no hard scientific evidence that having had the coronavirus provides people with long-lasting immunity.
The World Health Organization has warned countries against implementing such passports, saying: “There is currently no evidence that people who have recovered from Covid-19 and have antibodies are protected from a second infection.”
But Mr Bud said: “At-home antibody tests are coming soon and will quickly cause the creation of a whole information system, of which they will be at the heart.
“That is inevitable and is no longer subject to political choice.
“There are big questions that this system will pose to society – such as how to discourage people from uploading false immunity results, how to prevent discrimination on the basis of immunity status and how to stop information leaking uncontrollably.”
Estonia has begun testing one of the world’s first immunity passports, which would allow citizens to show their coronavirus test results to third parties, such as employers or even restaurants.
Taavet Hinrikus, founder of Transferwise, the company is developing the technology for the Estonian system, said it would “diminish fears and stimulate societies all over the globe to move on with their lives amidst the pandemic”.
But Dr Tom Fisher, a senior researcher at Privacy International, said the implementation of such measures needed to be “necessary, proportionate and based on the epidemiological evidence”.
“For the moment, immunity passports do not meet this test,” he said.
“We must be concerned about the broad societal impact of such immunity passports.
“They are essentially about limiting the rights of those who are not deemed to be immune.
“This is a route to exclusion and discrimination.
“Similarly, an improperly implemented programme risks perverse effects, like people deliberately seeking to get infected to gain the benefits of a status of being immune.”
Robin Tombs, the chief executive of digital identity company Yoti said it would be “technically simple” to extend its work with coronavirus testers at GeneMe to antibody tests but: “The science on Covid-19 immunity is still too early to issue meaningful immunity passports.”