GoodRx customers got their bubbles burst last week when Consumer Reports called out the 8 year-old startup for sharing sensitive information—medication names, pharmacies where prescriptions were filled, and unique ID numbers tracking consumer behavior—with 20 other internet-based companies, including Facebook and Google.

In a response statement Friday, several days after the article was published, GoodRx confirmed an internal review revealed it was “not living up to [its] own standards” of privacy.

Aly McDevitt is Data & Research Journalist at Compliance Week. She has a background in education and college consulting. Prior to teaching, she was an editor/author at Thomson Reuters, where she reported...