What Data Do Discount Card Companies Collect?

Prescription discount card companies, especially app-based ones, typically collect your name, contact details, and information about the medications you search for or fill, and some have shared that data with advertising companies. In February 2023, the FTC took enforcement action against GoodRx for sharing users' medications and health conditions with companies like Facebook and Google for advertising purposes, without adequate consent (FTC). Comparing prescription prices does not require sharing more information than necessary, and it's worth knowing what any app collects before you use it.

What discount card apps typically collect

To generate a price or a discount code, a prescription discount card service generally needs to know:

• Your name and contact information, to create an account or issue a card.
• The medication and dosage you're searching for, to return an accurate price.
• Your location or pharmacy choice, to match you with nearby pricing.
• Payment or insurance information, in some cases, if the service also compares your copay.

Beyond this operational data, some apps also collect device identifiers, browsing behavior within the app, and analytics data that can be used for advertising or shared with third-party marketing platforms, depending on the company's specific practices and privacy policy.

The FTC's 2023 action against GoodRx

The most significant public example of a discount card company's data practices facing federal enforcement is the FTC's case against GoodRx. According to the FTC's press release, GoodRx shared personal health information, including which medications users searched for or purchased, along with health conditions, email addresses, phone numbers, and advertising identifiers, with companies including Facebook, Google, Criteo, and others, for advertising purposes (FTC).

The FTC's proposed order required GoodRx to:

• Stop sharing user health information with third parties for advertising, permanently.
• Get affirmative express consent before sharing health information with third parties for other purposes.
• Clearly disclose what categories of health information it shares.
• Stop using manipulative design ("dark patterns") to obtain consent.
• Direct third parties that received the data to delete it.
• Limit how long it retains personal and health data, and publish its retention schedule.
• Put a comprehensive privacy program in place.
• Pay a $1.5 million civil penalty (FTC).

This was the FTC's first enforcement action under its Health Breach Notification Rule, a rule that requires companies handling personal health records that are not covered by HIPAA to notify consumers, and in some cases the FTC and media, following a data breach involving that information (FTC). This case is a useful, factual example of the kind of privacy risk that can exist across the discount card and health app industry generally, not a claim that every discount card company handles data this way.

Why HIPAA might not apply

Many people assume any company touching health-related data is bound by HIPAA, the federal health privacy law. In reality, HIPAA generally applies to health care providers, health plans, and their business associates, not to every app or website that collects health-adjacent information. Discount card companies, depending on their structure, may fall outside HIPAA's direct scope. That gap is part of why the FTC has increasingly relied on other tools, including the Health Breach Notification Rule and its general consumer protection authority, to address health data practices (FTC).

What to check before you use a discount card app

Practical steps to protect your privacy

• Read the privacy policy before signing up, focusing on what is shared with third parties and for what purpose.
• Limit app permissions on your phone, particularly ad tracking and contact list access, unless the feature clearly requires it.
• Avoid linking social media accounts to a discount card app unless there's a specific reason to.
• Use the minimum information needed. If a service can generate a usable price without an account, that may be a lower-data-footprint option.
• Ask the company directly what data it collects and whether it shares data with advertisers, if the privacy policy is unclear.

Search your medication on BetterBuyRx to compare pharmacy prices, and review any service's privacy practices as part of deciding which tool to use.

This is a legitimacy question, not a reason to avoid all discount cards

Privacy concerns are a real, documented issue in this industry, but they don't mean every discount card or price comparison tool mishandles your data. The FTC's action against GoodRx focused on specific undisclosed advertising-sharing practices, not on the basic concept of a prescription discount card. For a broader look at how to evaluate whether a specific card is trustworthy overall, see our guide on whether prescription discount cards are legit.

Compare prescription prices on BetterBuyRx and review any service's privacy policy before you decide what personal information to share.