I am developing an Android app that will potentially handle sensitive user data, and some of it may be even considered medical data (for example user height, weight, alergies, etc).
What would be the recommended security practices to protect the user's data both from the client-side perspective as well as the server-side?
I'm not talking about practices needed to get government certifications, but just strong, tested and recommended practices for good user info protection.
For example, on the client side, encrypting the database (with SQLCipher maybe?) at all times, and just decrypt the info when needed. If any of this information is to leave the device, then SSL would be a must. Never store a user's password. Authentication session handling, etc. Caching issues, should I cache frequently-accessed or decrypt it from db everytime it's needed?
On the server side, hashing and salting the passwords instead of storing plain-text passwords is also industry-standard.
Bonus points for references or explanations on how to correctly implement said practices.
Clarification: I'm not stating that the aforementioned example practices are indeed good practices, it's just to illustrate the kind of general practices I'm talking about.