CITT

    Scan results

    Doximity - Medical Network

    Android

    Doximity is a professional medical networking and clinical tools app used by over 2 million healthcare professionals. Features include AI-powered clinical documentation, HIPAA-compliant secure communication, telemedicine, and secure faxing.

    CITT SCORE
    62
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Healthcare professionals comfortable with standard analytics

    What It Means For You

    User activity is tracked by Segment Analytics and Singular, which share behavioral data with advertising and attribution networks. Bugsnag and Firebase collect diagnostic information about how the app is used. Data is stored with weaker protections than expected for a medical platform.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (13)

    Data Security

    2 total
    1 Critical
    1 Medium

    Code Security

    5 total
    2 Critical
    1 High
    2 Medium

    Privacy

    4 total
    1 High
    2 Medium
    1 Low

    Third-Party Risk

    2 total
    2 High

    Third-Party Services

    Segment Analytics, Singular, Firebase, Bugsnag, Twilio, 100ms, Telnyx WebRTC, Apollo GraphQL

    Security Strengths

    • ✓Certificate pinning implemented for doximity.com (7 SHA-256 pins)
    • ✓Encrypted OAuth tokens using AES-256-GCM
    • ✓No cleartext traffic allowed
    • ✓Certificate Transparency validation
    • ✓DPoP authorization for enhanced token security
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    health
    sensitive data
    hipaa
    medical
    professional networking
    telemedicine
    audio recording

    Package

    com.doximity.doximitydroid

    Version

    11.44.0 (Build 262908)

    Analysis Date

    Dec 21, 2025

    Classes Analyzed

    7,743

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 2 findings (1 critical, 1 medium)

    Network Security - 0 findings

    Code Safety - 0 findings

    Privacy - 4 findings (1 high, 2 medium, 1 low)

    Privacy Concerns

    What Data is Collected

    Doximity collects professional and behavioral data including usage patterns, device identifiers, and in-app activity. Diagnostic data about how users interact with the app is gathered through Bugsnag and Firebase, which monitor crashes and performance. Communication features powered by Twilio, 100ms, and Telnyx WebRTC may process audio and messaging content.

    Third-Party Data Sharing

    Behavioral and usage data is shared with the following third-party services:

    • Segment Analytics - Collects and routes behavioral data to downstream advertising and analytics platforms
    • Singular - Attribution service that shares user activity data with advertising networks to measure ad performance
    • Firebase - Google's platform for app diagnostics, crash reporting, and usage analytics
    • Bugsnag - Crash and error monitoring service that receives diagnostic information about user sessions
    • Twilio, 100ms, Telnyx WebRTC - Communication infrastructure providers that handle call and messaging data
    • Apollo GraphQL - Data query layer used for app-to-server communication

    Understanding the Scores

    CategoryScore
    Security58/100
    Privacy68/100
    Data Security45/100
    Network Security95/100
    Code Safety60/100
    Data Collection72/100
    Data Sharing70/100
    User Control65/100

    Positive Security Features

    • Network communications are well-secured, with strong protections against interception of data in transit.

    Areas for Improvement

    • Local data storage uses weaker protection settings than expected for a medical platform, increasing risk if a device is lost or accessed without authorization.
    • Behavioral data flows to advertising and attribution networks through Segment and Singular. Clearer in-app controls to limit this sharing would better protect user privacy.
    • The level of diagnostic and behavioral data collected across multiple third-party services exceeds what is typical for a professional medical networking app.

    About This Analysis

    This scorecard is based on automated static analysis of the application. Scores reflect observed practices at the time of analysis and may not capture all behaviors.

    App Details

    • App: Doximity - Medical Network
    • Package: com.doximity.doximitydroid
    • Version: 11.44.0 (Build 262908)
    • Scan Date: 2025-12-21

    Right of Reply

    Developer not yet contacted