Meddy: Medical Records Security & Privacy Scorecard

by DIEGO ALEJANDRO VILLA CARDENAS · iOS

82
Overall trust score
Trustworthy
86
Security
80
Privacy

In-app purchases are processed through RevenueCat, a third-party payment service. Health data stays largely private, with limited external sharing. Network connections are well-protected, and user data is handled with reasonable care.

Best for

Personal health tracking with minimal data sharing

Findings

  • 0 critical
  • 0 high
  • 4 medium
  • 5 low
  • 11 info

1 issue identified across security and privacy analysis.

Top security issues

  • No Keychain usage — biometric authentication gates only the UI, not the data; a Frida hook on LAContext bypasses all access controls on a jailbroken device
  • Medical photos stored with default iOS data protection class (NSFileProtectionCompleteUntilFirstUserAuthentication), remaining decryptable after first unlock even with screen locked
  • MD5 used for download integrity verification — a MITM attacker able to break TLS could substitute a payload with a crafted MD5 collision and have it written to the app's cache directory

Top privacy issues

  • All health records (medical documents, photos, appointments, member profiles) automatically sync to iCloud without any in-app disclosure, consent prompt, or opt-out mechanism
  • Full health SwiftData database is shared with the MeddyWidget extension via app group, expanding the attack surface for the entire health data store to a less-sandboxed process
  • Missing NSUserTrackingUsageDescription with ATT framework referenced by RevenueCat SDK — compliance gap under App Store Review Guidelines, GDPR, and CCPA in a medical app context

Full analysis

What This Means for You

In-app purchases are processed through RevenueCat, a third-party payment service. Health data stays largely private, with limited external sharing. Network connections are well-protected, and user data is handled with reasonable care.

Recommendation: Trustworthy

Best For: Personal health tracking with minimal data sharing

Key Findings

Data Security - 4 findings (1 medium, 2 low, 1 info)

Network Security - 3 findings (1 medium, 2 info)

Code Safety - 0 findings

Privacy - 4 findings (2 medium, 2 info)

Privacy Concerns

What Data is Collected

The app collects health metrics and activity data provided or generated during use. Personal identifiers are associated with the user's health profile to deliver the app's core features. Purchase history is retained to manage subscriptions and restore purchases.

Third-Party Data Sharing

Payment and subscription information is processed by RevenueCat, a third-party service that manages in-app purchases. RevenueCat receives transaction data to verify and maintain purchase status. Data reaches only this one outside service, used solely for payment purposes.

Understanding the Scores

Area Score
Security 86/100
Privacy 80/100
Data Security 78/100
Network Security 92/100
Code Safety 94/100
Data Collection 88/100
Data Sharing 94/100
User Control 83/100

Positive Security Features

  • Network communications are well-protected, reducing the risk that health data could be intercepted while traveling between the device and the app's servers.
  • The app's code shows strong integrity, with very few patterns associated with risky behavior.
  • Data sharing with outside parties is tightly scoped, limited to payment processing only.

Areas for Improvement

  • The protections applied to health data stored on the device could be strengthened to better guard against unauthorized local access.
  • Options for managing, reviewing, or deleting personal health data could be made more prominent and easier to find within the app's settings.
  • A small number of network-related configurations could be tightened to further reduce exposure of user information during transmission.

About This Analysis

App Details
App com.darlerkens.HealthCloud
Version 1.1.0 (Build 4)
Scan Date 2026-03-29

Scores range from 0 to 100. Higher scores reflect stronger security and privacy practices. This analysis is based on static examination of the app.

Versions & scan history

ScanDateOverall score
#1 (current) 82/100