The gay dating app Grindr, used by about 3.6 million people worldwide, has been sharing the HIV status of its users with other companies, according to a report in Buzzfeed and confirmed by Norwegian nonprofit SINTEF.

Users of the app can input details such as when they last were tested for HIV, and also state if they are HIV-positive or negative or taking medicines for the condition. According to the report, because the data is shared with email addresses, GPS information and phone IDs, the identity of users is not hard to ascertain.

The two third-party companies involved are Localytics and Apptimize. The latter provides a service to optimize apps while the former provides analytics to do the same. Although Grindr is seen as a place where people can be open about their health status, James Krellenstein, a member of AIDS advocacy group ACT UP New York, told BuzzFeed that secretly sharing such information was an “extremely egregious breach of basic standards that we wouldn’t expect from a company that likes to brand itself as a supporter of the queer community.”

Grindr responded quickly to the news, telling Mashable that the information is protected by encryption and also data retention policies. “As an industry standard practice, Grindr does work with highly regarded vendors to test and optimize how we roll out our platform,” a company spokesperson said. “These vendors are under strict contractual terms that provide for the highest level of confidentiality, data security, and user privacy.”

The data is not sold, according to Grindr, but the fact that it is passed on has rankled privacy advocates. Such information is obviously sensitive and if leaked could cause a problem for people.

As your Congresswoman, one of my first official acts would be to introduce an Omnibus Privacy Bill that would make this indefensible breach of trust something you can sue over.

Self policing will never work with privacy. You need government officials that will fight for you. https://t.co/WHxATAQ3t1

— Brianna Wu (@Spacekatgal) April 2, 2018

Grindr has since stopped sharing this information with third parties, according to a report in Axios. Grindr security chief Bryce Case told Axios that because of the recent Cambridge Analytica scandal, the issue has been blown out of proportion.

“It’s conflating an issue and trying to put us in the same camp where we really don’t belong,” said Case. Nonetheless, the public outcry has compelled Grindr to change its policies regarding this sensitive data.

Image: James via Flickr