what privacy policy? I'm guessing any agreement included the standard "we may share your data with our partners" text. There aren't any laws stopping them sharing medical data.
The linked article explicitly states that part of the fine is because the data sharing violates GoodRx's own privacy policy.