Cayetano Security & Privacy Scorecard
Android
User activity is tracked by Firebase Analytics, Google Measurement, and Mixpanel. Payments are processed through Alignet, Mastercard, and Visa SDKs. Data protection practices leave stored information with less protection than expected.
Best for
UPCH patients comfortable with Google and Mixpanel analytics
Findings
- 3 critical
- 1 high
- 7 medium
- 0 low
- 0 info
0 issues identified across security and privacy analysis.
Top security issues
- Unencrypted Local Storage of Payment Tokens and Authentication Credentials
- Cleartext Traffic Enabled for Financial Application
- No Android Keystore Usage for Cryptographic Key Management
Top privacy issues
- Firebase Analytics Collection Without User Consent
- Advertising ID Collection Without Displaying Advertisements
- Excessive Debug Logging of Payment Data
Full analysis
Cayetano
Version: 1.61.5 | Scan Date: February 3, 2026 | Platform: Android
Security Score: 35/100 | Privacy Score: 70/100
What This Means for You
User activity is tracked by Firebase Analytics, Google Measurement, and Mixpanel. Payments are processed through Alignet, Mastercard, and Visa SDKs. Data protection practices leave stored information with less protection than expected.
Recommendation: Use With Caution
Best For: UPCH patients comfortable with Google and Mixpanel analytics
Key Findings
Data Security - 5 findings (2 critical, 3 medium)
Network Security - 1 finding (1 critical)
Code Safety - 0 findings
Privacy - 2 findings (2 medium)
Privacy Concerns
What Data is Collected
Firebase Analytics and Google Measurement track how users interact with the app, which screens are visited, and how often specific features are used. Mixpanel adds a separate layer of behavioral tracking on top of this. Firebase Crashlytics collects diagnostic data when the app encounters problems on the user's device.
Third-Party Data Sharing
User data is shared with the following third parties:
- Firebase (Google) - Analytics, authentication, cloud database, crash reporting, push notifications, and remote configuration
- Google - Sign-in, integrity verification, reCAPTCHA challenges, and measurement
- Mixpanel - Behavioral analytics and usage profiling
- Alignet - Payment processing via Payme and 3D Secure
- Mastercard - Payment processing
- Visa - Payment processing
Understanding the Scores
| Category | Score |
|---|---|
| Security | 35/100 |
| Privacy | 70/100 |
| Data Security | 25/100 |
| Network Security | 30/100 |
| Code Safety | 55/100 |
| Data Collection | 75/100 |
| Data Sharing | 85/100 |
| User Control | 60/100 |
Positive Security Features
- No notable positive security practices were identified in this version of the app.
Areas for Improvement
- Data stored on the device has limited protection, making it more accessible to anyone with physical or software access to the device.
- Data sent and received over the internet travels with less protection than expected, which may affect personal and medical information during transmission.
- The ability to manage or limit what data the app collects is restricted, giving users less control over their information.
About This Analysis
This scorecard is based on static analysis of the app's code and configuration. Scores reflect observed practices at the time of the scan and may not capture all runtime behaviors.
App Details
- App Name: Cayetano
- Package ID: com.upch.cayetanoapp
- Version: 1.61.5 (build 66)
- Scan Date: February 3, 2026
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 52/100 |