According to an investigation by Consumer Reports, the GoodRx app, which provides patients with price comparisons and coupons to help them save money on prescription drugs, has been sending patients’ personal details to more than 20 internet-based companies, including Google, Facebook, and marketing firms.
Using a test phone and browser, Consumer Reports monitored traffic on the company’s Android mobile app and website and found that several of the company’s third-party business partners received the names of medications, the pharmacies where patients sought to fill prescriptions, ID numbers, and other personally identifiable information.
Google and Facebook deny using the prescription information to target individual users with ads. “We prohibit personalized advertising and advertising profiles based on sensitive information, including a user’s prescriptions,” a Google spokesperson said.
“We don’t want websites sharing people’s personal health information with us – it’s a violation of our policies. After an initial review, we think GoodRx’s use of our business tools requires a deeper investigation, and we’re reaching out to the company,” a Facebook spokesperson said.
“We observed sensitive information being passed along,” said Bill Fitzgerald, a privacy researcher in Consumer Reports’ Digital Lab who led the testing. “If Facebook doesn’t want this information, and GoodRx doesn’t want to send it, it shouldn’t be happening. The app and site don’t need to be designed this way.”
After Consumer Reports reported its findings, GoodRx posted a statement promising to stop sharing personal information with Facebook and to provide a way for users to delete their data.