Audit Date: May 17, 2026 · Auditor: Base44 Auto-Audit · Status: PRE-LAUNCH
⚠️ Have a licensed health tech attorney review findings before public launch.
| Category | Checked | 🟢 Compliant | 🟡 Partial | 🔴 Non-Compliant |
|---|---|---|---|---|
| Legal Pages | 20 | 14 | 6 | 0 |
| Consent & Gates | 16 | 4 | 4 | 8 |
| In-App Disclaimers | 14 | 8 | 4 | 2 |
| Data Rights | 12 | 5 | 5 | 2 |
| Signup Flow | 14 | 6 | 4 | 4 |
| Payment Compliance | 14 | 8 | 4 | 2 |
| Accessibility | 16 | 4 | 10 | 2 |
| Content Claims | 10 | 6 | 4 | 0 |
| Email Compliance | 10 | 2 | 4 | 4 |
| Security | 8 | 4 | 4 | 0 |
| Infrastructure | 8 | 4 | 4 | 0 |
| TOTAL | 142 | 65 | 53 | 24 |
Must fix before any public users.
ToS/Privacy Policy acceptance checkboxes at signup
Issue: The Onboarding flow (step 0) did NOT have consent checkboxes before this audit. Users were being onboarded without documented ToS acceptance.
Fix: ✅ FIXED — Added two unchecked-by-default consent checkboxes to Onboarding step 0. "Let's Get Started" button is disabled until both are checked.
Effort: Complete
Health data consent acknowledgment during onboarding
Issue: No dedicated health data consent step existed before collecting medication, weight, and injection data.
Fix: ✅ FIXED — Added a health data consent checkbox in Onboarding step 0 that explicitly states ThinShot is a tracking tool only, not medical advice.
Effort: Complete
Age verification gate (18+)
Issue: No age gate exists. A 16-year-old can create an account and have health data collected. COPPA violation risk.
Fix: ⚠️ PARTIAL FIX — The consent checkbox says "I am 18 or older" but there is no enforced date-of-birth check or hard block. A user can lie. Recommend adding a date-of-birth field with a calculated age check that hard-blocks creation if under 18.
Effort: Remaining: Add DOB input to onboarding with hard block if age < 18
Sage AI one-time disclaimer modal on first use
Issue: Sage opens immediately without any "first use" disclaimer modal. Users can interact with the AI health coach before ever seeing an explicit disclaimer.
Fix: ⚠️ NOT YET FIXED — Sage has a permanent footer disclaimer (compliant) but no first-use modal. Recommend storing sage_disclaimer_acknowledged in localStorage and showing a blocking modal on first open.
Effort: Remaining: ~2 hours — add first-use modal to SageChat component
CAN-SPAM: Physical mailing address in reminder emails
Issue: The sendInjectionReminder function sends emails without a physical mailing address of J.T. Estates LLC in the footer. CAN-SPAM requires this on all commercial/transactional emails.
Fix: ⚠️ NOT YET FIXED — Update the sendInjectionReminder, shotDayPrepEmail, and muscleAlertEmail backend functions to include "J.T. Estates LLC, New York, USA" and an unsubscribe link in the email footer.
Effort: Remaining: ~1 hour — update 3 email backend functions
Marketing email opt-in field
Issue: No marketing_email_opt_in field exists on UserSettings. If any product update or marketing emails are sent, this is a CAN-SPAM/GDPR violation.
Fix: ⚠️ NOT YET FIXED — Add marketing_email_opt_in (boolean, default false) to UserSettings entity. Show opt-in option in Settings.
Effort: Remaining: ~1 hour — entity update + Settings UI
Download My Data — incomplete export
Issue: The current export only includes medications, side effects, weights, and settings. Missing: NutritionLog, JournalEntry, PhotoLog, UserAchievements, UserPoints, BodyLog, NutritionGoals.
Fix: ⚠️ PARTIAL FIX — Filename is now date-stamped (thinshot-export-YYYY-MM-DD.json). Need to add all missing entities to the export.
Effort: Remaining: ~30 min — add missing entities to handleExport in Settings
Delete My Account — email-only flow (no in-app deletion)
Issue: The Delete My Account flow redirects to an email mailto: link. CCPA requires timely, self-service deletion capability. Email-only is not sufficient for a digital product.
Fix: ⚠️ NOT YET FIXED — Build a proper in-app deletion flow that deletes all user entities, cancels Stripe subscription, and logs the user out. The email fallback can remain as a secondary option.
Effort: Remaining: ~3 hours — backend function + UI confirmation flow
Policy update notification system
Issue: No tos_version field stored per user. No mechanism to show users when Terms or Privacy Policy change and require re-acceptance.
Fix: ⚠️ NOT YET FIXED — Add tos_version and tos_accepted_at to UserSettings. On login, check current app version against stored version. If mismatch, show non-dismissable re-acceptance modal.
Effort: Remaining: ~2 hours — entity field + login-time check + modal
Pre-checkout disclosures
Issue: The /upgrade page shows pricing but: (1) the Terms/Privacy links are not visible before clicking the upgrade button, (2) no explicit "next billing date" shown, (3) the Terms billing section previously showed "$7.99/month" (incorrect — was fixed to $4.99/$29.99).
Fix: ✅ PARTIAL FIX — Terms billing amount corrected to $4.99/mo or $29.99/yr. Remaining: Add ToS + Privacy Policy links and "cancel anytime" note directly under the Upgrade button on /upgrade page.
Effort: Remaining: ~20 min — add legal links to Upgrade page
Fix within 30 days of launch.
Cookie Policy
Cookie Policy page exists at /cookie-policy and is linked from all footers. However, opt-out mechanism for non-essential cookies is not present (though only essential cookies are stated to be used).
Accessibility Statement
Accessibility page exists and is linked. However, it has no specific contact email for accessibility issues or stated response time.
Blog article disclaimers
✅ FIXED — All blog articles now show a medical disclaimer banner at the top. However, "Last reviewed" date per article is not implemented — it would need to be a BlogPost entity field.
Progress Photos privacy notice
No privacy notice on the /photos page explaining photos are private, not shared, and how to delete them.
Referral program terms notice
✅ FIXED — Referral terms notice now appears below the copy-link button in Settings.
ARIA labels on interactive components
Hydration drops, momentum rings, quick log arrows, and modal dialogs lack proper aria-labels, aria-labelledby, and role="dialog" attributes.
Keyboard navigation
Custom buttons (dose calculator tap counter, toggle switches) may not be keyboard accessible. Focus indicators are browser-default and may not meet the 2px minimum.
Auth security details
Session management and brute force protection are handled by Base44 platform infrastructure — compliance depends on Base44's security posture, which should be verified.
Privacy/Terms accessible without login
/privacy and /terms are public routes. /cookie-policy and /accessibility are now also public routes. All confirmed accessible without authentication.
Subscription confirmation email
Stripe sends a default receipt. A custom branded ThinShot confirmation email with cancellation instructions is not implemented.
❌ NO — ThinShot cannot legally launch publicly today. The following blockers must be resolved first:
Regardless of technical compliance, these items need licensed legal review before launch:
• Final Privacy Policy language (especially HIPAA adjacency statement)
• Final Terms of Service language (limitation of liability clause)
• HIPAA applicability determination (are you a business associate of any covered entities?)
• State-specific health data law compliance (NY SHIELD Act, CMIA for CA users, TX THIPA)
• FTC enforcement risk for AI health guidance without clinical validation
• App Store submission review (17+ age rating, health data labels)
ThinShot Internal Compliance Audit · Generated May 17, 2026 · Base44 Auto-Audit System
This report is for internal use only. Not a legal opinion. Consult a licensed attorney.