Gay dating app Grindr has defended itself after an outcry over how it shared data with two external companies.
On Monday it emerged the app had, among other things, provided information on HIV status, including date last tested.
Grindr said the data was shared in line with standard industry practices, and that it felt the app had been unfairly singled out.
The UK’s Information Commissioner’s Office (ICO) said it was investigating.
In a statement, it said it was working to “establish the scale of any impact on UK users”.
Grindr said the information was not shared with any advertisers.
The companies that did get the data – Apptimize and Localytics – are paid to monitor how users interact with the software to see what could be improved.
The most sensitive information was encrypted, Grindr said – though a Norwegian campaign group said the sharing of other unencrypted data amounted to a potential privacy intrusion.
“The HIV status is linked to all the other information. That’s the main issue,” said Antoine Pultier from the Foundation for Scientific and Industrial Research, in an interview with BuzzFeed.
“I think this is the incompetence of some developers that just send everything, including HIV status.”
‘We’ve been singled out’
However Grindr’s security boss Bryce Case later told US news site Axios that data sharing with third-party companies with the goal of improving the app, rather than selling data, was commonplace.
“I understand the news cycle right now is very focused on these issues,” Mr Case said.
“I think what’s happened to Grindr is, unfairly, we’ve been singled out.”
The BBC understands the Grindr had already stopped sharing information with Apptimize, and was in the process of winding down its work with Localytics.
Users on Grindr are given the option to share their HIV status along with the time they were last tested – an option backed, the company said, by LGBTQ groups and international health organisations.
The information is made available to potential suitors in the app. It is also used to power other features, such as reminders to be tested, and where to go.
“It is up to each user to determine what, if anything, to share about themselves in their profile,” Grindr said in a statement.
It added: “Grindr has never, nor will we ever sell personally identifiable user information – especially information regarding HIV status or last test date – to third parties or advertisers.”