This service is currently running, in production, in the United States, and is missing key features that are regulatory or legal requirements. I won't enumerate them because I work in security, not privacy or compliance (although those are features that require strong security and I often support related projects).
The app is designed to allow sharing of personally identifiable information, and apparently doesn't distinguish regions, age, etc.
Assuming OP is American, and hosting the service in the US, and given the target audience and proposed use case, I can think of a couple of regulations that apply:
FTC Act
COPPPA
CCPA
All of the privacy laws documented here: https://iapp.org/resources/article/us-state-privacy-legislation-tracker/
In addition, if a Canadian user signs up, then PIPEDA, and various other regulations come into play.
If an EU user signs up, then obligations must be met under the FTC's Data Privacy Framework and compliance with various EU and national regulations come into play.
It's not impossible for someone to adhere to all of the laws, it's just a full time job to do it. It's probably not reasonable for a single person to build and operate a service with the privacy and security requirements and claims that the author of KatesApp makes, and meet the compliance requirements. It is abundantly clear to anyone who works in privacy or security that the website doesn't meet the bare minimum requirements, and has very little standing to defend itself.
For reference for anyone who hasn't signed up for it, there is no terms of service, and no privacy policy.
The service includes features to allow uploading of data related to:
Prescriptions - medication, dosage, instructions, prescriber, and pharmacy
Medical Appointments - who (presumably the medical professional), date/time, location, and reason for medical appointment
Doctors - a list of doctors, clinic, contact info
Upload files, with this helpful list of suggestions of medical records to upload:
- insurance information
- advanced directives or DNR/DNI
- a copy of your vaccination card
- lab test results, doctors' reports, x-ray, MRI, and CT - scans, or other images
- voice recordings of visits with the doctor or other providers
- self-monitoring logs (sleep, diet, exercise, etc.)
There are logs to show who created a data element under each of those types of records, but I didn't test the site deeply enough to determine if there are any audit controls or logs that are visible to users on who accessed what, but the privilege system implemented is rudimentary, and is fundamentally weak due to the fact that user accounts are unverified.
Anyone can sign up and create and share files and resources using this service. From the main public page, the author requires a signup code, but signing up from the HN link on the post bypasses this. There is no validation of who the user is, no confirmation that the person who signed up owns the account, or options to delete my test account or data. There are no controls that appear to limit what might be uploaded other than file size.
As of right now, this site is in violation of Canadian law and EU laws regulations. I assume it is also in violation of American laws and regulations.
I understand what the author is attempting to do, and why they are doing it, and they are deserving of empathy (and in my other comment I provided them a road map to improve some of the security issues on the site), but launching a website into production that gathers this data, in the United States is not only unwise, it is probably negligent, and it's reasonable to expect that someone could sue the owner of the application.
From a user privacy and security perspective, a user of this service would quite literally have more protections and controls using a google spreadsheet or shared folder to store and share these documents.