Widely-used patient care app found to include hidden 'backdoor' access