IATI - Travel insurance Security & Privacy Scorecard

What This Means for You

App usage and behavior is tracked by Firebase Analytics and PostHog, and advertising identifiers are collected via Google AdServices. User data is handled with moderate care, though some local storage practices could be more secure. Network communication is well protected.

Recommendation: Use With Caution

Best For: Existing policyholders managing coverage on mobile

Key Findings

Data Security - 7 findings (1 high, 4 medium, 2 low)

Network Security - 1 finding (1 low)

Code Safety - 0 findings

Privacy - 4 findings (1 high, 3 medium)

Privacy Concerns

What Data is Collected

Firebase Analytics and PostHog collect behavioral data including which screens users visit, how long users spend in the app, and actions users take. Google AdServices gathers advertising identifiers to associate in-app activity with ad targeting. Push notifications are delivered via Firebase Messaging. If users use telemedicine or voice consultation features, audio and video sessions are processed through MeetingDoctors, Twilio, and OpenTok/Vonage. Crash and error reports may be sent to Sentry.

Third-Party Data Sharing

Usage data and advertising identifiers are shared with Google, PostHog, and Sentry for analytics and error tracking. Communication session data is shared with MeetingDoctors, Twilio, and OpenTok/Vonage when consultation features are used. The advertising identifier collected by Google AdServices may be used to show users targeted ads in other apps and services outside this app.

Understanding the Scores

Positive Security Features

• Network communications are strongly protected, with robust measures applied to data traveling between the device and the app's servers.
• Application code follows sound construction practices, reducing the risk of common coding-level issues that could affect user data.
• Distribution of user information to outside parties is reasonably controlled, reflecting a degree of restraint in how broadly user data is shared.

Areas for Improvement

• Some data stored locally on the device could be better protected. Account details or session information saved on the device may be stored in ways that carry unnecessary risk if the device is accessed by someone else.
• Advertising identifiers are collected and shared in ways that allow user behavior to be tracked across apps and services, which may feel out of place in a health and insurance context where greater privacy is expected.
• A few practices around how personal and policy data is handled locally could be strengthened to provide greater confidence that sensitive information stays protected.

About This Analysis

App Details