# Security & Privacy Scorecard

## Cayetano

**Version:** 1.61.5 | **Scan Date:** February 3, 2026 | **Platform:** Android

**Security Score:** 35/100 | **Privacy Score:** 70/100

## What This Means for You

User activity is tracked by Firebase Analytics, Google Measurement, and Mixpanel. Payments are processed through Alignet, Mastercard, and Visa SDKs. Data protection practices leave stored information with less protection than expected.

## Recommendation: Use With Caution

**Best For:** UPCH patients comfortable with Google and Mixpanel analytics

## Key Findings

**Data Security** - 5 findings (2 critical, 3 medium)

**Network Security** - 1 finding (1 critical)

**Code Safety** - 0 findings

**Privacy** - 2 findings (2 medium)

## Privacy Concerns

### What Data is Collected

Firebase Analytics and Google Measurement track how users interact with the app, which screens are visited, and how often specific features are used. Mixpanel adds a separate layer of behavioral tracking on top of this. Firebase Crashlytics collects diagnostic data when the app encounters problems on the user's device.

### Third-Party Data Sharing

User data is shared with the following third parties:

- **Firebase (Google)** - Analytics, authentication, cloud database, crash reporting, push notifications, and remote configuration
- **Google** - Sign-in, integrity verification, reCAPTCHA challenges, and measurement
- **Mixpanel** - Behavioral analytics and usage profiling
- **Alignet** - Payment processing via Payme and 3D Secure
- **Mastercard** - Payment processing
- **Visa** - Payment processing

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 35/100 |
| Privacy | 70/100 |
| Data Security | 25/100 |
| Network Security | 30/100 |
| Code Safety | 55/100 |
| Data Collection | 75/100 |
| Data Sharing | 85/100 |
| User Control | 60/100 |

## Positive Security Features

- No notable positive security practices were identified in this version of the app.

## Areas for Improvement

- Data stored on the device has limited protection, making it more accessible to anyone with physical or software access to the device.
- Data sent and received over the internet travels with less protection than expected, which may affect personal and medical information during transmission.
- The ability to manage or limit what data the app collects is restricted, giving users less control over their information.

---

## About This Analysis

This scorecard is based on static analysis of the app's code and configuration. Scores reflect observed practices at the time of the scan and may not capture all runtime behaviors.

### App Details

- **App Name:** Cayetano
- **Package ID:** com.upch.cayetanoapp
- **Version:** 1.61.5 (build 66)
- **Scan Date:** February 3, 2026