Eventually I decided to use processing for the core of the software as it is more easily able to read XML and access mySQL databases.
For the map itself we used the Google maps API which provided all the features we needed. To get the data into the page, we used PHP to access the database and cycle through each row adding the code for displaying an icon at the infected account’s last know location.
More posts here.