ReDi Security & Privacy Scorecard
by MED-EL · Android
App usage and behavior is tracked by Firebase Analytics, Datadog, and OneSignal, which can send push notifications. Data flows through multiple third-party services including analytics and crash reporting platforms. A network configuration issue means data may travel with less protection than expected in certain conditions.
Best for
Hearing aid users managing their device settings
Findings
- 1 critical
- 2 high
- 4 medium
- 0 low
- 3 info
1 issue identified across security and privacy analysis.
Top security issues
- Global cleartext traffic enabled app-wide, exposing auth tokens and medical rehabilitation data to network interception
- Auth0 test deep link scheme left in production build, enabling any app to hijack the OAuth callback and potentially capture access tokens
- Firebase App Check debug registrar in production allows bypassing device attestation to access Firebase backend without a legitimate app
Top privacy issues
- No consent management platform: audio rehabilitation recordings and personal data shared with Firebase and OneSignal without identifiable GDPR-compliant opt-in controls
- OneSignal Location module collects GPS coordinates and transmits to US-based servers for targeting — unnecessary for a hearing rehabilitation app and potentially non-compliant under GDPR
- Firebase A/B Testing and Remote Config enable silent behavioral experiments on medical app users without disclosed consent
Full analysis
Version: 3.4.0 (Build: 2026040544)
Scan Date: 2026-04-09
Overall Score: 63/100 (D)
What This Means for You
App usage and behavior is tracked by Firebase Analytics, Datadog, and OneSignal, which can send push notifications. Data flows through multiple third-party services including analytics and crash reporting platforms. A network configuration issue means data may travel with less protection than expected in certain conditions.
Recommendation: Use With Caution
Best For: Hearing aid users managing their device settings
Key Findings
Data Security - 2 findings (2 info)
Network Security - 4 findings (1 critical, 1 high, 1 medium, 1 info)
Code Safety - 0 findings
Privacy - 1 finding (1 medium)
Privacy Concerns
What Data is Collected
This app collects usage and behavioral data through Firebase Analytics and Datadog. OneSignal gathers device information to send push notifications. Auth0 manages account authentication. The speech recognition feature may process voice input to support app functionality.
Third-Party Data Sharing
Data is shared with the following services:
- Firebase Analytics - usage and behavioral tracking
- Firebase Crashlytics - crash and error reporting
- Firebase Cloud Messaging - push notification delivery
- Firebase Remote Config - remote feature configuration
- Datadog - performance monitoring and logging
- OneSignal - push notification targeting
- Auth0 - account authentication
- Google Play Services Auth - sign-in integration
Understanding the Scores
| Category | Score |
|---|---|
| Security | 63/100 |
| Privacy | 52/100 |
| Data Security | 100/100 |
| Network Security | 55/100 |
| Code Safety | 88/100 |
| Data Collection | 63/100 |
| Data Sharing | 70/100 |
| User Control | 63/100 |
Positive Security Features
- Encrypted local storage is used to protect sensitive data saved on the device
- A dedicated authentication service handles login and account access
- App integrity checks are in place to verify the application has not been modified
- Established cryptographic libraries are used to protect data in transit and at rest
Areas for Improvement
- A network configuration issue creates conditions where data may travel with less protection than expected in certain circumstances.
- Behavioral and usage data is shared with multiple analytics and monitoring platforms, with limited ability to opt out of tracking.
- Device identifiers collected by push notification and analytics services allow user activity to be tracked and profiled across sessions.
About This Analysis
This scorecard is based on automated static analysis of the application at the version listed below. Scores reflect the security and privacy posture of the app based on its code, configurations, and third-party integrations at the time of the scan.
App Details
- Package ID: com.medel.ai.redi
- Version: 3.4.0 (Build: 2026040544)
- Scan Date: 2026-04-09
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #2 (current) | 55/100 | |
| #1 | 71/100 |