Does anyone have any information on how Scruff handles that information? Also, does HIPAA say anything about technology companies outside of the medical field's data that may voluntarily collect HIV status?
The data that we share with our third-party ad providers is:
- Your location (so you can get those local car dealer ads)
- Your gender
- Your age
- The targeting keyword "gay"
We currently use AdMob and MoPub to provide our network advertising.
More broadly, this kind of information is never something we would share. We know the sensitivity of HIV status, and know that it has been used to discriminate against our community in the past. When we do take money from direct advertisers (full-screen ads shown at launch), we make sure that they are promoting relevant and beneficial products for our community, and the ads they place are serviced 100% in-app and come with no extra data nor api calls.
Ultimately, our business model is based on subscriptions, which means we are successful when we make software that people love to use. We don't spend our days trying to squeeze a marginal penny out of some remainder-bin ad unit by trading personal data of our users. Instead, we spend our time focused on how to make an excellent product, that works reliably, is free of spambots and harassment, and connects gay guys with each other and the global gay community.
That said, upon further reflection, a local advertiser could surely get enough targeting information with a much, much less precise value...we'll look into making this change in a future release.
There are other third party services we use that may see various pieces of information from free and paid members. Stripe, for example, manages some payment processing and collects some user data; ZenDesk manages support tickets for us and also collects various pieces of user data.
In the coming months we will be sharing more information about the third parties with whom we work and on whom our service is built, and how data is shared between them. When it comes to ad networks, however, our integration is limited to what I mentioned above.
No, HIPAA binds only covered entities, which are (basically) care providers, insurers, and certain other parties in certain business relationships with care providers and insurers.
If you give out your health information to a dating service, it's not protected by HIPAA.
Covered entities are specifically defined as: "(1) A health plan"; "(2) A health care clearinghouse"; or "(3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter" [1].
[1] https://www.gpo.gov/fdsys/pkg/CFR-2017-title45-vol1/xml/CFR-...
This is correct, though it's worth noting that HIV status is actually protected under more strict terms than just HIPAA, and that may in fact apply to Grindr.
There are a lot of laws at the state-level which restrict the ability to collect, record, or pass on information related to an individual's HIV status even when none of the parties involved are covered entities (or business associates of covered entities).
The whole thing seems pretty bad (privacy-wise) https://www.scruff.com/privacy/
http://www.aidslawpa.org/get-help/legal-information/confiden...
Its also available to anyone who sees the profile in their search results. As far as I can tell you cant have a profile that is active, use it and not show up in search results.