Every time someone asks whether Protecht is end-to-end encrypted, the honest answer needs two sentences, not one. It depends on how the share happens. We’d rather explain both paths than round up to a word that doesn’t quite fit either of them.

Receipts, not promises means telling you exactly what happens to your data, not the version that sounds best. So here’s what actually happens when you share a result, both ways it can go.

When you’re both in the app, nothing touches our servers

If the person you’re sharing with has Protecht open on their phone, the results travel straight from your device to theirs over a direct connection, encrypted the whole way. Our servers are never part of that path. This is the one case where “end-to-end” is the accurate word, and we use it here on purpose.

When they don’t have the app yet

If you’re sharing with someone who doesn’t have Protecht, we fall back to a link. Your results are encrypted on your phone before anything leaves it, and the key that unlocks them is locked with our public key and sent separately. When the link is opened, the encrypted result passes through our server for a moment as part of loading the page, then the server sends back the key and deletes its copy. None of it is ever written to our database. The whole thing is built to work once: the link’s key is single-use and expires within an hour whether or not anyone opens it.

Why we’re not calling this one “end-to-end”

For a few seconds while that link is open, our server technically holds enough to read the result, the encrypted data and the key that unlocks it, even though it never stores either one and never looks. That distinction is small in practice and real on paper, and “end-to-end encrypted” glosses over it. We’d rather say the precise thing than the reassuring thing. No upload path, no PHI in our database, and a key that expires in an hour either way.

We checked the parts you can’t see, too

The claims above are only as good as the infrastructure behind them, so we went back and checked it directly: the request logs and backups that sit underneath the app don’t retain share links either. It’s not a glamorous thing to verify, but it’s the same principle as everything else here. Say what’s actually true, then go check that it still is.

A live result and a screenshot of one can say the exact same word. “Negative,” the same date, the same provider name. On screen, they’re identical. The difference is entirely in what doesn’t survive the trip from one to the other.

The instinct to go to the source instead of a screenshot is already common. In a January 2025 study of 2,601 gay and bisexual men published in the International Journal of STD & AIDS, 18% had already used a patient portal to show a partner a result live, rising to 30% among men who tested nine or more times a year and 24% among PrEP users. That’s the right instinct, done by hand. Here’s what it’s actually protecting.

Five things a screenshot can’t carry

An authenticated origin. A live result arrived through a login to the provider’s system. A screenshot arrived through a camera roll. Nothing about a JPEG can tell you where it came from, no matter how official it looks.

Structured fields, not pixels. The provider name, the lab, each test, its method, its result, the collection date and the result date are separate data fields attributed to the source in a live result. In a screenshot they’re just shapes on a picture. Any of them can be repainted, and there’s no way to tell which ones were.

Dates set by the lab, not typed by the sender. Collection date and result date come from the provider’s record in a live result. In a screenshot, the date is whatever the sender put there.

No edit path. A result pulled directly from a provider can’t be changed, cropped, or re-saved by the person sharing it. A screenshot is edited in the same app it was taken in.

A view that ends. A provider-sourced share can be read-only and time-limited, attributed to the provider by name, then gone. A screenshot sits on someone else’s phone for as long as they keep it, with no way to take it back.

So what do you actually ask for

Not “is this real,” since nobody can answer that by looking at a picture. Ask to see it live instead, in the portal or through an app that pulls it from the provider. That single request does more work than any amount of scrutinizing a photo, because it moves the result out of the one format that can’t prove anything about itself.

Sources

• International Journal of STD & AIDS, patient-portal disclosure study among MSM, January 2025

Can you trust a partner’s STD test result?

Short answer: only as much as you can trust where it came from. A result you type in yourself, or one shown as a screenshot, tells you what someone wants you to know. A result pulled directly from a provider’s system, or shown to you live in a portal, tells you what the lab actually found. The trust isn’t in the number. It’s in the path the number took to reach you.

Why the same word, “negative,” can mean two different things

A self-reported status and a provider-verified one can read identically on a screen. The difference is entirely in what’s behind them. Self-reported means someone typed it in, the same way a dating profile field works. Provider-verified means it came through an authenticated connection to the lab or clinic that ran the test, with no step where a person could type in something different from what was found. Neither is a lie by default. But only one of them can’t become one.

The one question that actually settles it

Not “do you trust them,” but “can I see where this came from.” A screenshot answers “no,” because a picture carries no record of its own origin. A live view in a patient portal, or a share from an app that pulls the result from a provider, answers “yes,” because the result is still connected to the system that produced it. Ask to see it that way. It’s not an accusation, it’s the same request you’d make of any document that mattered.

People already do this, they just haven’t had the words for it

In a January 2025 study of 2,601 gay and bisexual men published in the International Journal of STD & AIDS, 18% had already used a patient portal to show a partner a result live, rising to 30% among men who tested nine or more times a year and 24% among PrEP users. The instinct to go to the source instead of a screenshot is already common. It just hasn’t been standard.

What actually makes a screenshot unreliable

Not that most people send fake ones. Most don’t. It’s that a screenshot carries no way to check, and the ones that are edited are indistinguishable from the ones that aren’t. Any photo-editing tool can change a date, a name, or a result, and there is nothing in the image itself that reveals it. That’s not a reason to assume the worst about someone. It’s a reason to ask for the version that can’t be edited when it matters.

Frequently asked questions

Is a screenshot of a test result ever enough? For a low-stakes, established relationship, plenty of people treat it as enough. For anything where the stakes are higher, ask to see the result live in a portal or through an app that pulls it from the provider directly.

What does “verified” actually mean for a result like this? It means the result reached you through a connection to the system that produced it, not through a document someone could have altered before sending it.

Is asking to verify a result rude? Framed as “can I see it live, and I’ll show you mine too,” it reads as a habit, not a test. Most people say yes.

Sources

• International Journal of STD & AIDS, patient-portal disclosure study among MSM, January 2025

 

Someone sends you a screenshot of a negative test result. It looks real. The font matches, the logo is in the right place, the date lines up. But “looks real” and “is real” are not the same thing, and there is no way to tell the difference by squinting at a photo on your phone.

That is not a reason to assume the worst about anyone. Most people sharing a screenshot are telling the truth. The problem is structural, not personal: a photo of a document was never designed to prove anything. Anyone with a basic photo editor, a PDF form filler, or even a messaging app’s markup tool can change a date, a name, or a result in a few minutes.

The red flags worth noticing

If you are looking at a screenshot, a few things are worth a second look: a font that shifts partway through the document, margins or spacing that do not match the rest of the page, a crop that conveniently cuts off a header or footer, or a file name that does not match the lab or clinic it is supposed to be from. None of these prove anything either way. A genuine result can look slightly off because of how it was screenshotted, and a doctored one can look flawless. That is the real issue: visual inspection was never a reliable test.

Why “trust me” isn’t a system

In a 2026 survey of nearly 7,900 U.S. adults by Testing.com, 45% of people diagnosed with an STI said they had withheld their status from a sexual partner at least once, and 59% of that group also had unprotected sex without saying anything. Most of that is not malice. It is shame, timing, or the assumption that it will not matter. But it means that even well-intentioned self-reporting has a real gap between what people say and what is true.

A screenshot does not close that gap. It just adds a layer that feels more official without actually being verifiable. Asking someone to prove their status with a photo puts the burden on trust and editing software, not on an actual system.

Receipts, not promises

The fix is not asking better questions about a screenshot. It is removing the screenshot from the process entirely. Protecht does not have an upload button, because a result you can upload is a result you can edit. Instead, it connects directly to your healthcare provider through Apple Health and pulls your result straight from the source, read-only, with nothing for anyone to fake and nothing stored on Protecht’s servers beyond the coordination needed to make the share happen.

Sources

• 1 in 10 Americans Admit They Knowingly Gave a Partner an STD, Testing.com

Here’s a question worth asking about any app that touches your health data: where does it actually live?

For Protecht, the answer is simple: on your device, and nowhere else. When you connect your provider through Apple Health, your verified test results are pulled down and encrypted locally using AES-256, with the key in your iPhone’s Keychain. Protecht doesn’t store your results. There’s no central database of test results to breach, because there isn’t a central database at all.

A deliberate architecture choice

That’s a deliberate architecture choice, not a marketing line. A lot of health apps promise “bank-level security” while still holding a copy of everything you’ve ever told them, sitting on a server, one misconfiguration away from exposure. We didn’t want to make that promise and hope we kept it. We wanted to make it structurally impossible to break.

What happens when you share

When you choose to share a result with someone, that sharing happens directly, through a consent-controlled link, not through us. We coordinate the permission and the timing. Protecht doesn’t store the result.

A guarantee, not a promise

Privacy shouldn’t be something you have to trust a company to protect. It should be something the architecture guarantees.