I asked that when I first heard about them, and I came to the same conclusion the FTC did, basically: https://www.ftc.gov/news-events/news/press-releases/2023/0

I asked that when I first heard about them, and I came to the same conclusion the FTC did, basically: https://www.ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising https://www.ftc.gov/news-events/news/press-releases/2023/02/... Their S-1 also stated, > In addition, HIPAA, which we believe does not currently apply to most of our business as currently operated (I should also say that I agree with the implicit message in your comment, too.)