Industries · Healthcare

Patient data stays
where it belongs.

Telehealth, pharmacy, and care apps carry the most sensitive data people own. Nandee finds where PHI leaks into logs, caches, backups, and third-party SDKs, and hands your team the fix.

Scan your appBook a demo
class BookingViewModel { fun confirm(visit: Visit) { analytics.track("booked", mapOf("reason" to visit.reason)) api.book(visit) } fun cancel(id: String) = api.cancel(id) } A diagnosis, sent to an analytics SDK. FIX · BOOKINGVIEWMODEL.KT HIGH - mapOf("reason" to visit.reason) + mapOf("specialty" to code)

What we look for in healthcare apps

Patient data rarely leaks
through the front door.

  • Logs

    PHI in logs and crash reports

    Names, conditions, and medications written to the console or shipped with a crash.

  • Storage

    Records left lying around

    Lab PDFs, images, and visit notes in unprotected caches or device backups.

  • Third parties

    Health data in analytics events

    Conditions and appointment details passed to analytics, ad, and attribution SDKs.

  • Screens

    Results on the lock screen

    Test results in notifications and app-switcher snapshots anyone nearby can read.

  • Sessions

    Shared and family devices

    Timeouts and logout that actually end the session on a tablet the whole family uses.

  • Deep links

    Links straight into a record

    Email and SMS links that open patient screens without checking who's holding the phone.

Compliance

Evidence that you looked.
Proof that you fixed it.

HIPAA Security RuleFindings on access control, audit, and transmission security feed your risk analysis and show the safeguards you put in place.
OWASP MASVSEvery finding mapped to a control, including the PRIVACY category for data minimization.
SOC 2 and HITRUSTA dated record of what was found and fixed, ready for vulnerability management evidence.
Health system reviewsA straight answer for the security questionnaire when a hospital or payer partner asks about your app.

Nandee supports your compliance work. It isn't a HIPAA certification, and it isn't legal advice.

Example finding

A funnel metric that knew too much.

HighSAST + DASTMASVS-PRIVACY-1 · CWE-359booking/BookingViewModel.kt:57

Visit reason sent to a third-party analytics SDK

Every booking sends the patient's stated reason for the visit as an event property. DAST saw it leave the device in the analytics request. The vendor now holds health data you never meant to share.

Before 
56  analytics.track("appointment_booked", mapOf(
57    "reason" to visit.reason,
58    "provider" to visit.providerName))

"migraine follow-up", in someone else's database.

Suggested fix 
56  analytics.track("appointment_booked", mapOf(
57    "specialty" to visit.specialtyCode))

No diagnosis, no names. The funnel still works.

What healthcare teams use most

Fair questions.

Do you need real patient data?

No. Test with test accounts and synthetic records. Nandee looks at where data goes, not whose it is.

Will you sign a BAA?

Yes. We sign a Business Associate Agreement with healthcare customers.

Does this make us HIPAA compliant?

No tool can. Nandee finds and fixes mobile security issues and keeps the record, which is part of the work your compliance program has to show.

Keep the trust your patients already gave you.

Book a demo