Show HN: Kate's App

This service is currently running, in production, in the United States, and is missing key features that are regulatory or legal requirements. I won't enumerate them because I work in security, not privacy or compliance (although those are features that require strong security and I often support related projects).

The app is designed to allow sharing of personally identifiable information, and apparently doesn't distinguish regions, age, etc.

Assuming OP is American, and hosting the service in the US, and given the target audience and proposed use case, I can think of a couple of regulations that apply:

  FTC Act
  COPPPA
  CCPA
  All of the privacy laws documented here:   https://iapp.org/resources/article/us-state-privacy-legislation-tracker/

In addition, if a Canadian user signs up, then PIPEDA, and various other regulations come into play.

If an EU user signs up, then obligations must be met under the FTC's Data Privacy Framework and compliance with various EU and national regulations come into play.

It's not impossible for someone to adhere to all of the laws, it's just a full time job to do it. It's probably not reasonable for a single person to build and operate a service with the privacy and security requirements and claims that the author of KatesApp makes, and meet the compliance requirements. It is abundantly clear to anyone who works in privacy or security that the website doesn't meet the bare minimum requirements, and has very little standing to defend itself.

For reference for anyone who hasn't signed up for it, there is no terms of service, and no privacy policy.

The service includes features to allow uploading of data related to:

  Prescriptions - medication, dosage, instructions, prescriber, and pharmacy
  Medical Appointments - who (presumably the medical professional), date/time, location, and reason for medical appointment
  Doctors - a list of doctors, clinic, contact info
  Upload files, with this helpful list of suggestions of medical records to upload:
   - insurance information
   - advanced directives or DNR/DNI
   - a copy of your vaccination card
   - lab test results, doctors' reports, x-ray, MRI, and CT    - scans, or other images
   - voice recordings of visits with the doctor or other providers
   - self-monitoring logs (sleep, diet, exercise, etc.)

There are logs to show who created a data element under each of those types of records, but I didn't test the site deeply enough to determine if there are any audit controls or logs that are visible to users on who accessed what, but the privilege system implemented is rudimentary, and is fundamentally weak due to the fact that user accounts are unverified.

Anyone can sign up and create and share files and resources using this service. From the main public page, the author requires a signup code, but signing up from the HN link on the post bypasses this. There is no validation of who the user is, no confirmation that the person who signed up owns the account, or options to delete my test account or data. There are no controls that appear to limit what might be uploaded other than file size.

As of right now, this site is in violation of Canadian law and EU laws regulations. I assume it is also in violation of American laws and regulations.

I understand what the author is attempting to do, and why they are doing it, and they are deserving of empathy (and in my other comment I provided them a road map to improve some of the security issues on the site), but launching a website into production that gathers this data, in the United States is not only unwise, it is probably negligent, and it's reasonable to expect that someone could sue the owner of the application.

From a user privacy and security perspective, a user of this service would quite literally have more protections and controls using a google spreadsheet or shared folder to store and share these documents.

If you got to https://katesapp.org/static/What%20Is%20Kate's%20App.html

and click the "Kate's App" button at the very top of the page, it takes you to a 404.

Just FYI if you want to fix that.

> people probably already having a lot of tools that they use and prefer. Another tool adds to their work load.

Further, a lot of providers are very strict about what tools their organization is allowed to use. In the past I’ve tried to get providers to look at a personal web page where I’d had a medical history and links to imaging data, and they weren’t allowed to access it via policy.

(I then brought 10 disks of imaging on a thumb drive - but they wouldn’t take that either. So I re-burned them onto physical media, and they were ok with importing that.)

I do understand why those policies are necessary, and in the end I learned their systems and limitations. It’s actually been an ok experience.

From the blurb at the top: “ The app is 95% complete, […] I intend to clean up the rest of it, and go GA within a few weeks. ”

Assuming the last 5% is going to just take a few weeks is naive from a development point of view. Everyone learns this the hard way, so I don’t mean it as a dig.

Every completed project was at one point a few weeks away from being done.