Scan results

Recommendation: Solid

Build 1.3.0 keeps health and medical records local and under the user's own iCloud control. CITT assesses this build as Solid: the data storage design is privacy-protective and the network and code safety profiles are strong, though adding app-layer encryption for stored health records would raise the overall data protection posture.

Key Findings

Data Security: 1 finding (1 high)

Network Security: 0 findings

Code Safety: 0 findings

Privacy: 2 findings (2 medium)

Privacy Concerns

What Leaves the Device

Subscription and purchase data may be sent to RevenueCat servers for subscription and purchase management; runtime network traffic was not observed.

What Stays on the Device

• Health metrics, medical appointment records, and document attachments: processed on the device and synced to the user's own iCloud account only. No evidenced flow to developer servers was identified for this data.

Third-Party Data Sharing

Third parties that may receive data from the app:

• RevenueCat - subscription and in-app purchase management
• Lottie - user interface animation rendering (no data sharing identified)

Understanding the Scores

Security: 72/100
Privacy: 76/100

Security Breakdown

• Data Security: 47/100. Health and medical records in this build are stored without an additional app-layer cipher. Unencrypted device backups may expose those records if the backup itself is not encrypted, though this was not tested.
• Network Security: 100/100. Network connections in this build use HTTPS with default App Transport Security enforced. RevenueCat network traffic uses strong industry-standard encryption.
• Code Safety: 100/100. No unsafe code patterns were identified in this build. External links open in a sandboxed Safari view with no JavaScript bridge.

Privacy Breakdown

• Data Collection: 82/100. Health and medical data is processed on the device and stays within the user's own iCloud account. No behavioral analytics or advertising SDKs are present in this build.
• Data Sharing: 88/100. Sharing is limited to RevenueCat for subscription management. No advertising networks or data-broker connections were identified.
• User Control: 80/100. Health records remain in the user's iCloud account. App-layer encryption for stored records, if added, would give users stronger protection over data accessibility in backup scenarios.

Positive Security Features

• Health and medical data stays on the device and syncs only to the user's own iCloud account; no flow to developer servers was evidenced.
• No behavioral analytics or advertising SDKs are present in this build.
• Network connections in this build use HTTPS with default App Transport Security enforced.
• RevenueCat network traffic uses strong industry-standard encryption.
• No custom URL schemes or universal links are present in this build, reducing the external input surface.
• External links open in a sandboxed Safari view with no JavaScript bridge.

Areas for Improvement

Disclosure Observations

1. App Privacy Manifest
   Apple's required-reasons API documentation (developer.apple.com, retrieved 2026-08-13) lists several APIs that require a declared usage reason in a PrivacyInfo.xcprivacy file. Build 1.3.0 does not include an app-level privacy manifest. Adding one could make the App Store privacy label more complete by explicitly declaring the APIs the build references.

2. AdServices Attribution and AppTrackingTransparency
   Build 1.3.0 links the AdServices framework but does not link AppTrackingTransparency. Apple's App Store guidelines (developer.apple.com, retrieved 2026-08-13) recommend that apps using AdServices for attribution also implement AppTrackingTransparency to present a consent prompt before attribution measurement occurs. Whether AdServices attribution is used at runtime was not observed.

Security Enhancements

1. App-Layer Encryption for Health Records
   Industry practice for health data recommends applying an application-layer cipher to records stored on the device, so that an unencrypted device backup does not expose the stored data. Adding this protection would strengthen the Data Security rating meaningfully.

Technical Context

App Type: Personal health records tracker (sensitive personal data)
Classes Analyzed: 33,734
Third-Party Services: 2 (RevenueCat, Lottie)
Context Tags: health, sensitive_data

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. The analysis is static code review of iOS applications, intended to help people make informed decisions about app security and privacy.

App Details

Developer: Darlerkens
Version: 1.3.0 (build 4)
Analysis Date: 2026-08-13
Package: com.darlerkens.HealthCloud

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on iOS build 1.3.0 (build 4) analyzed on 2026-08-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors

Right of Reply

Developer not yet contacted