5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 1 of 33 

UNITED STATES DISTRICT COURT 

NORTHERN DISTRICT OF CALIFORNIA 

UNITED STATES OF AMERICA, 

Plaintiff, 

v. 

GOODRX HOLDINGS, INC., a corporation, 

also d/b/a GoodRx, GoodRx Gold, GoodRx 

Care, HeyDoctor, and HeyDoctor by 

GoodRx; 

Defendant. 

Case No. 3:23-cv-460 

STIPULATED ORDER FOR 

PERMANENT INJUNCTION, 

CIVIL PENALTY JUDGMENT, 

AND OTHER RELIEF 

Plaintiff, the United States of America, acting upon notification and authorization to the 

Attorney General by the Federal Trade Commission (“Commission” or “FTC”), filed its 

Complaint for Permanent Injunction, Civil Penalties, and Other Relief (“Complaint”) in this 

matter, pursuant to Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade 

Commission Act (“FTC Act”), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and the 

Health Breach Notification Rule (“HBNR”), 16 C.F.R. § 318. Defendant has waived service of 

the summons and the Complaint. Plaintiff and Defendant stipulate to the entry of this Stipulated 

Order for Permanent Injunction, Civil Penalty Judgment, and Other Relief (“Order”) to resolve 

all matters in dispute in this action between them. 

THEREFORE, IT IS ORDERED as follows: 

FINDINGS 

1. This Court has jurisdiction over this matter. 

2. The Complaint charges that Defendant participated in deceptive and unfair acts or 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

1 
 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 2 of 33 

practices in violation of Section 5 of the FTC Act in the disclosure of health and personal 

information to third parties, the failure to limit third-party use of health information, the 

misrepresentation of compliance with the Digital Advertising Alliance principles, the 

misrepresentation that consumer’s health information was protected under the Health Insurance 

Portability and Accountability Act (“HIPAA”), the failure to implement sufficient policies or 

procedures to prevent the improper or unauthorized disclosure of health information, or to notify 

users of breaches of that information, and the failure to provide notice and obtain consent before 

the use and disclosure of health information for advertising. The Complaint also charges that 

Defendant violated the HBNR by failing to notify individuals and the Commission of a Breach 

of Security of Unsecured PHR Identifiable Health Information (as defined herein). 

3. Defendant neither admits nor denies any of the allegations in the Complaint, 

except as specifically stated in this Order. Only for purposes of this action, Defendant admits the 

facts necessary to establish jurisdiction. 

4. Defendant waives any claim that it may have under the Equal Access to Justice 

Act, 28 U.S.C. § 2412, concerning the prosecution of this action through the date of this Order, 

and agrees to bear its own costs and attorney fees. Defendant waives and releases any claims 

that it may have against Plaintiff that relate to this action. The parties agree that this Order 

resolves all allegations in the Complaint. 

5. Defendant and the Plaintiff waive all rights to appeal or otherwise challenge or 

contest the validity of this Order. 

DEFINITIONS 

For the purpose of this Order, the following definitions apply: 

A. “Affirmative Express Consent” means any freely given, specific, informed and 

unambiguous indication of an individual’s wishes demonstrating agreement by the individual, 

such as by a clear affirmative action, following a Clear and Conspicuous disclosure to the 

individual, apart from any “privacy policy,” “terms of service,” “terms of use,” or other similar 

document, of all information material to the provision of consent. Acceptance of a general or 

broad terms of use or similar document that contains descriptions of agreement by the individual 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

2 
 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 3 of 33 

along with other, unrelated information, does not constitute Affirmative Express Consent. 

Hovering over, muting, pausing, or closing a given piece of content does not constitute 

Affirmative Express Consent. Likewise, agreement obtained through use of user interface 

designed or manipulated with the substantial effect of subverting or impairing user autonomy, 

decision-making, or choice, does not constitute Affirmative Express Consent. 

B. “App Event” means any data disclosed to, or collected by, a Third Party via its 

Software Development Kit, application programing interface, pixel, or other method for tracking 

users’ interactions with Defendant’s services or products. 

C. “Breach of Security” means with respect to Unsecured PHR Identifiable Health 

Information of an individual in a Personal Health Record, acquisition of such information 

without the authorization of the individual. Unauthorized acquisition will be presumed to 

include unauthorized access to Unsecured PHR identifiable health information unless the vendor 

of personal health records, PHR related entity, or third party service provider that experienced 

the breach has reliable evidence showing that there has not been, or could not reasonably have 

been, unauthorized acquisition of such information. 

D. “Clear and Conspicuous” or “Clearly and Conspicuously” means that a 

required disclosure is difficult to miss (i.e., easily noticeable) and easily understandable by 

ordinary consumers, including in all of the following ways: 

1. In any communication that is solely visual or solely audible, the disclosure must 

be made through the same means through which the communication is presented. In any 

communication made through both visual and audible means, such as a television advertisement, 

the disclosure must be presented simultaneously in both the visual and audible portions of the 

communication even if the representation requiring the disclosure (“triggering representation”) is 

made through only one means. 

2. A visual disclosure, by its size, contrast, location, the length of time it appears, 

and other characteristics, must stand out from any accompanying text or other visual elements so 

that it is easily noticed, read, and understood. 

3. An audible disclosure, including by telephone or streaming video, must be 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

3 
 

 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 4 of 33 

delivered in a volume, speed, and cadence sufficient for ordinary consumers to hear it easily and 

understand it. 

4. In any communication using an interactive electronic medium, such as the 

Internet or software, the disclosure must be unavoidable. 

5. The disclosure must use diction and syntax understandable to ordinary consumers 

and must appear in each language in which the triggering representation appears. 

6. The disclosure must comply with these requirements in each medium through 

which it is received, including all electronic devices and face-to-face communications. 

7. The disclosure must not be contradicted or mitigated by, or inconsistent with, 

anything else in the communication. 

8. When the representation or sales practice targets a specific audience, such as 

children, the elderly, or the terminally ill, “ordinary consumers” includes reasonable members of 

that group. 

E. “Defendant” means GoodRx Holdings, Inc., doing business as GoodRx, GoodRx 

Gold, GoodRx Care, HeyDoctor, HeyDoctor by GoodRx, its successors and assigns, and its 

wholly or partially owned subsidiaries, including GoodRx Intermediate Holdings, Inc., GoodRx, 

Inc., Iodine, Inc., HeyDoctor, LLC, Lighthouse Acquisition Corp., Scriptcycle, LLC, 

HealthiNation, Inc., Buckeye Acquisition, LLC, RxSaver, Inc., flipMD, Inc., Pharmacy Services, 

LLC, and VitaCare Prescription Services, Inc. 

F. “Covered Business” means Defendant and any business that Defendant controls, 

directly or indirectly. 

G. “Covered Incident” means any instance of a violation of Section I, II, or III of 

this Order. 

H. “Covered Information” means information from or about an individual 

consumer, including but not limited to Personal Information, Health Information, or PHR 

Identifiable Health Information. 

I. “Covered User” means any individual who used Defendant’s websites or 

downloaded Defendant’s mobile applications between July 2017 through April 2020. 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

4 
 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 5 of 33 

J. “Delete” “Deleted” or “Deletion” means to remove information such that it is not 

maintained in retrievable form and cannot be retrieved in the normal course of business. 

K. “Health Care Provider” means a provider of services (as defined in 42 U.S.C. § 

1395x(u)), a provider of medical or other services (as defined in 42 U.S.C. § 1395x(s)), and any 

other person furnishing healthcare services or supplies. 

L. “Health Information” means individually identifiable information relating to the 

past, present, or future physical or mental health or conditions of an individual, the provision of 

health care to an individual, or the past, present, or future payment for the provision of health 

care to an individual; and any individually identifiable health information that is derived or 

extrapolated from information about an individual’s activities, or pattern of activities, from 

which a determination is made that the individual has a health condition or is taking a drug. 

M. “Individually Identifiable Health Information” means any information, 

including demographic information collected from an individual, that: (1) is created or received 

by a Health Care Provider, health plan, employer, or health care clearinghouse; and (2) relates to 

the past, present, or future physical or mental health or condition of an individual, the provision 

of health care to an individual, or the past, present, or future payment for the provision of health 

care to an individual, and: (a) identifies the individual; or (b) with respect to which there is a 

reasonable basis to believe that the information can be used to identify the individual. 

N. “Personal Health Record” means an electronic record of PHR Identifiable 

Health Information on an individual that can be drawn from multiple sources and that is 

managed, shared, and controlled by or primarily for the individual. 

O. “Personal Information” means any individually identifiable information about 

an individual collected online, including: (1) a first and last name; (2) home or other physical 

address including street name and name of a city or town; (3) online contact information, 

meaning an email address or any other substantially similar identifier that permits direct contact 

with a person online, including but not limited to an instant messaging user identifier, a voice 

over internet protocol (VOIP) identifier, or a video chat identifier; (4) a screen or user name 

where it functions in the same manner as online contact information; (5) a telephone number; (6) 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

5 
 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 6 of 33 

a Social Security number; (7) a persistent identifier that can be used to recognize a user over time 

and across different websites or online services, including but not limited to a customer number 

held in a “cookie,” an Internet Protocol (“IP”) address, a mobile device ID, a processor or device 

serial number, or unique identifier; (8) geolocation information sufficient to identify street name 

and name of a city or town; (9) a driver’s license or other government-issued identification 

number; (10) a financial institution account number; (11) credit or debit card information; or 

(12) any information combined with any of (1) through (11) above. 

P. “PHR Identifiable Health Information” means Individually Identifiable Health 

Information and, with respect to an individual, information: (1) that is provided by or on behalf 

of the individual; and (2) that identifies the individual or with respect to which there is a 

reasonable basis to believe that the information can be used to identify the individual. 

Q. “Third Party” or “Third Parties” means any individual or entity other than: (1) 

Defendant; (2) an entity with which Defendant has a business associate agreement complying 

with 45 C.F.R. Part 164.504(e)(2)(ii)(A); (3) a pharmacy facilitating the consumer obtaining a 

discount for a prescription or medical services; (4) a service provider or partner of Defendant 

that: (i) uses or receives Covered Information collected by or on behalf of Defendant for and at 

the direction of Defendant and no other individual or entity, or to process, provide access to, or 

facilitate transactions for prescriptions, treatments, or medical services; (ii) does not disclose the 

data, or any individually identifiable information derived from such data, to any individual or 

entity other than Defendant or a subcontractor to such service provider or partner bound to data 

processing terms no less restrictive than terms to which the service provider or partner is bound, 

unless for the specific purpose of performing the services specified in the contract; and (iii) does 

not use the data for any purpose other than the purposes in (Q)(4)(i) or for internal use to 

provide, maintain, improve, or secure the services provided to Defendant, provided that internal 

use does not include using Covered Information obtained from Defendant to build or modify 

household or consumer profiles to use in providing services to another business, or to correct or 

augment data acquired from another source; or (5) any entity that uses Covered Information only 

as reasonably necessary: (i) to comply with applicable law, regulation, or legal process, (ii) to 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

6 
 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 7 of 33 

enforce Defendant’s terms of use, or (iii) to detect, prevent, or mitigate fraud or security 

vulnerabilities. 

R. “Unsecured” means PHR Identifiable Health Information that is not protected 

through the use of a technology or methodology specified by the Secretary of Health and Human 

Services in the guidance issued under section 13402(h)(2) of the American Reinvestment and 

Recovery Act of 2009. 

ORDER 

I. BAN ON DISCLOSURE OF HEALTH INFORMATION FOR ADVERTISING 

PURPOSES 

IT IS ORDERED that: 

A. Defendant, Defendant’s officers, agents, employees, and attorneys who receive 

actual notice of this Order, whether acting directly or indirectly, are permanently restrained and 

enjoined from disclosing Health Information to Third Parties for Advertising Purposes. 

B. For purposes of this Section, “Advertising Purposes” means advertising, 

marketing, promoting, offering, offering for sale, or selling any products or services on, or 

through Third Party websites, mobile applications, or services. Advertising Purpose shall not 

include: (i) reporting and analytics related to understanding advertising and advertising 

effectiveness, such as statistical reporting, traffic analysis, understanding the number of and type 

of ads served, or conversion measurement; or (ii) communications, services, or products 

requested by a consumer that are sent or provided to the consumer; or (iii) contextual advertising, 

meaning non‐personalized advertising shown as part of a consumer’s current interaction with 

Defendant’s websites or mobile applications, provided that the consumer’s Covered Information 

is not disclosed to another Third Party and is not used to build a profile about the consumer or 

otherwise alter the consumer’s experience outside the current interaction with Defendant’s 

websites or mobile application. 

C. For purposes of this Section, Health Information shall not include (a) a pharmacy 

name (except for any specialty or other pharmacies that provide medications or services that are 

limited to treating a specific health condition); or (b) general engagement with or use of 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

7 
 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 8 of 33 

Defendant’s services or content, such as accessing general pricing information, provided that 

such engagement or use does not reveal an individual’s Personal Information combined with (i) 

information about a medication or class of medication(s) that an individual is prescribed, has 

purchased, or is taking steps to purchase or obtain by accessing, downloading, or requesting a 

coupon, or taking other steps to purchase or obtain such medication or class of medication(s), or 

(ii) information that reveals an individual’s health status, or that an individual has or is seeking 

treatment for a specific health condition or conditions. 

II. PROHIBITION AGAINST MISREPRESENTATIONS 

IT IS FURTHER ORDERED that Defendant, Defendant’s officers, agents, employees, 

and attorneys, and all other persons in active concert or participation with any of them, who 

receive actual notice of this Order, whether acting directly or indirectly, in connection with 

promoting or offering for sale any product or service are permanently restrained and enjoined 

from misrepresenting or assisting others in misrepresenting, expressly or by implication: 

A. the purposes for which Defendant or any entity to whom it discloses Covered 

Information collects, maintains, uses, or discloses Covered Information; 

B. the extent to which consumers may exercise control over Defendant’s collection, 

maintenance, use, disclosure, or Deletion of Covered Information, and the steps a consumer must 

take to implement such controls; 

C. the extent to which Defendant is a member of, adheres to, complies with, is 

certified by, is endorsed by, or otherwise participates in any privacy, security, or any other 

compliance program sponsored by a government or any self-regulatory or standard-setting 

organization, including the Digital Advertising Alliance, the Digital Advertising Accountability 

Program, or any entity that certifies compliance with HIPAA; 

D. the extent to which Defendant is a HIPAA-covered entity, and the extent that 

Defendant’s privacy and information practices are in compliance with HIPAA requirements; and 

E. the extent to which Defendant collects, maintains, uses, discloses, Deletes, or 

permits or denies access to any Covered Information, or the extent to which Defendant protects 

the availability, confidentiality, or integrity of any Covered Information. 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

8 
 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 9 of 33 

III. PROHIBITION AGAINST DISCLOSURE OF HEALTH INFORMATION 

WITHOUT AFFIRMATIVE EXPRESS CONSENT AND NOTICE 

IT IS FURTHER ORDERED that: 

A. Defendant, Defendant’s officers, agents, employees, and attorneys, and all other 

persons in active concert or participation with any of them who receive actual notice of this 

Order, whether acting directly or indirectly, in connection with the sale of any product or service, 

are permanently restrained and enjoined from disclosing Health Information to Third Parties for 

Non-Advertising Purposes without first obtaining Affirmative Express Consent. 

B. For purposes of this Section, Non-Advertising Purposes means all purposes other 

than: (i) Advertising Purposes as defined in Section I of this Order; (ii) communications, 

services, or products requested by a consumer that are sent or provided by Defendant directly to 

the consumer, such as Defendant texting, emailing, or mailing a consumer, or showing content 

on Defendant’s own properties to a consumer; and (iii) contextual advertising, meaning non‐

personalized advertising shown as part of a consumer’s current interaction with Defendant’s 

websites or mobile applications, including associated ad serving and response mechanisms, 

provided that the consumer’s Covered Information is not disclosed to another Third Party and is 

not used to build a profile about the consumer or otherwise alter the consumer’s experience 

outside the current interaction with Defendant’s websites or mobile applications. 

C. For purposes of this Section, Health Information shall not include (a) a pharmacy 

name (except for any specialty or other pharmacies that provide medications or services that are 

limited to treating a specific health condition); or (b) general engagement with or use of 

Defendant’s services or content, such as accessing general pricing information, provided that 

such engagement or use does not reveal an individual’s Personal Information combined with (i) 

information about a medication or class of medication(s) that an individual is prescribed, has 

purchased, or is taking steps to purchase or obtain by accessing, downloading, or requesting a 

coupon, or taking other steps to purchase or obtain such medication or class of medication(s), or 

(ii) information that reveals an individual’s health status, or that an individual has or is seeking 

treatment for a specific health condition or conditions. 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

9 
 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 10 of 33 

D. When obtaining Affirmative Express Consent required under this Section, 

Defendant must provide notice Clearly and Conspicuously that states the categories of Health 

Information that will be disclosed to Third Parties, the identities of such Third Parties (where a 

consumer is using a physical, non-electronic discount card, Defendant need only disclose the 

category of such Third Parties), and all purposes for Defendant’s disclosure of such Health 

Information, including how it may be used by each Third Party. 

E. It shall not be a violation of this Section if Defendant discloses Health 

Information to Third Parties for Non-Advertising Purposes without first obtaining Affirmative 

Express Consent, if Defendant proves that: (1) the information is “protected health information,” 

defined under 45 C.F.R. Section 160.103, and pursuant to the Health Insurance Portability and 

Accountability Act of 1996, as amended, including by the Health Information Technology for 

Economic and Clinical Health Act (“HITECH”) (collectively, “HIPAA”); (2) Defendant made 

such disclosure in its capacity as a covered entity or business associate, as defined under 45 

C.F.R. Section 160.103; and (3) any such disclosure was either required or permitted under 45 

C.F.R. Part 160 and Part 164, Subparts A and E (the “HIPAA Privacy Rule”). 

IV. HEALTH BREACH NOTIFICATIONS 

IT IS FURTHER ORDERED that: 

A. Defendant, for any Covered Business, following the discovery of a Breach of 

Security of Unsecured PHR Identifiable Health Information that is in a Personal Health Record 

maintained or offered by Defendant (including, but not limited to, the GoodRx, GoodRx Gold, 

GoodRx Care, and/or HeyDoctor websites or mobile applications), shall: 

1. notify each individual who is a citizen or resident of the United States whose 

Unsecured PHR Identifiable Health Information was acquired by an unauthorized person as a 

result of such Breach of Security; 

2. notify the Federal Trade Commission, in accordance with Subsection IV(E) 

below; or 

3. notify prominent media outlets in a state or jurisdiction, if the Unsecured PHR 

Identifiable Health Information of five hundred (500) or more residents of such state or 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

10 
 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 11 of 33 

jurisdiction is, or is reasonably believed to have been, acquired during such Breach of Security. 

B. For the purposes of this Section, a Breach of Security shall be treated as 

discovered as of the first day on which such breach is known or reasonably should have been 

known to Defendant. Defendant shall be deemed to have knowledge of a Breach of Security if 

such breach is known, or reasonably should have been known, to any person, other than the 

person committing the breach, who is an employee, officer, or other agent of Defendant. 

C. Except as otherwise provided, all notifications to individuals or the media 

required under this Section shall be sent without unreasonable delay and in no case later than 

sixty (60) calendar days after the discovery of the Breach of Security. If a law enforcement 

official determines that a notification, notice, or posting required under this Section would 

impede a criminal investigation or cause damage to national security, such notification, notice, or 

posting shall be delayed. This Subsection shall be implemented in the same manner as provided 

under 45 C.F.R. Section 164.528(a)(2), in the case of a disclosure covered under such section. 

D. If Defendant provides notice under Subsection IV(A)(1), it shall do so by 

providing it in the following form: 

1. Written notice, by first-class mail to the individual at the last known address of 

the individual, or by email or within-application messaging, if the individual is given a clear, 

conspicuous, and reasonable opportunity to receive notification by first-class mail, and the 

individual does not exercise that choice. If the individual is deceased, Defendant must provide 

such notice to the next of kin of the individual if the individual had provided contact information 

for his or her next of kin, along with authorization to contact them. The notice may be provided 

in one or more mailings as information is available. 

2. If, after making reasonable efforts to contact all individuals to whom notice is 

required under Subsection IV(A)(1), through the means provided in Subsection IV(D)(1), 

Defendant finds that contact information for ten (10) or more individuals is insufficient or out-ofdate, Defendant shall provide substitute notice, which shall be reasonably calculated to reach the 

individuals affected by the Breach of Security, in the following form: 

a. Through a conspicuous posting for a period of ninety (90) days on the 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

11 
 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 12 of 33 

home page of its website; or 

b. In major print or broadcast media, including major media in geographic 

areas where the individuals affected by the Breach of Security likely 

reside. Such a notice in media or web posting shall include a toll-free 

phone number, which shall remain active for at least ninety (90) days, 

where an individual can learn whether or not the individual’s PHR 

Identifiable Health Information may be included in the Breach of Security. 

3. In any case deemed by Defendant to require urgency because of possible 

imminent misuse of Unsecured PHR Identifiable Health Information, Defendant may provide 

information to individuals by telephone or other means, as appropriate, in addition to notice 

provided under Subsection IV(E)(1). 

E. Defendant shall, in accordance with Subsection IV(A)(2), provide notice to the 

Federal Trade Commission following the discovery of a Breach of Security. If the Breach of 

Security involves the Unsecured PHR Identifiable Health Information of five hundred (500) or 

more individuals, then such notice shall be provided as soon as possible and in no case later than 

ten (10) business days following the date of discovery of the Breach of Security. If the Breach of 

Security involves the Unsecured PHR Identifiable Health Information of fewer than five hundred 

(500) individuals, Defendant may maintain a log of any such Breach of Security, and submit 

such a log annually to the Federal Trade Commission no later than sixty (60) calendar days 

following the end of the calendar year, documenting Breaches of Security from the preceding 

calendar year. Unless otherwise directed by a Commission representative in writing, Defendant 

must submit all notices and logs required under this Section to: DEbrief@ftc.gov or sent by 

overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, Bureau of 

Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, 

DC 20580. The subject line must begin: “U.S. v. GoodRx Holdings, Inc.” 

F. Regardless of the method by which notice is provided to individuals, the Federal 

Trade Commission, or the media under this Section, notice of a Breach of Security shall be in 

plain language and include, to the extent possible, the following: 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

12 
 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 13 of 33 

1. A brief description of what happened, including the date of the Breach of Security 

and the date of the discovery of the Breach of Security, if known; 

2. A description of the types of PHR Identifiable Health Information that were 

involved in the Breach of Security (such as full name, Social Security number, date of birth, 

home address, account number, or disability code); 

3. Steps individuals should take to protect themselves from potential harm resulting 

from the Breach of Security; 

4. A brief description of what the entity that suffered the Breach of Security is doing 

to investigate the breach, to mitigate harm, and to protect against any further breaches; and 

5. Contact procedures for individuals to ask questions or learn additional 

information, which shall include a tollfree telephone number, an email address, website, or postal 

address. 

V. NOTICE TO USERS 

IT IS FURTHER ORDERED that, within fourteen (14) days of entry of this Order, 

Defendant shall post Clearly and Conspicuously on Defendant’s websites and mobile 

applications, including, www.GoodRx.com, www.gold.goodrx.com/login, 

www.Goodrx.com/care/login, the GoodRx Care mobile application, and the GoodRx 

prescription coupon mobile applications, a link to an exact copy of the notice attached hereto as 

Exhibit A (“Notice”) and email the Notice to all Covered Users for whom Defendant has email 

information. Defendant shall not include with the Notice any other information, documents, or 

attachments. Defendant shall keep the notice posted on the above-listed websites and mobile 

applications continuously for a period of one hundred and eighty (180) days following the date 

of entry of this Order. 

VI. DELETION OF COVERED INFORMATION 

IT IS FURTHER ORDERED that, within sixty (60) days of entry of this Order: 

A. Defendant must identify all Third Parties and all entities identified in the 

Complaint (“Complaint Entity” or “Complaint Entities”) that received Health Information, 

identify the Covered Information of Covered Users received by each such Third Party or 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

13 
 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 14 of 33 

Complaint Entities, provide a copy of the Complaint and Order to all Third Parties and 

Complaint Entities that received Health Information of Covered Users, notify all such Third 

Parties and Complaint Entities in writing that the Federal Trade Commission alleges that 

Defendant disclosed Covered Information of Covered Users to them in a manner that was unfair 

or deceptive and in violation of the FTC Act, instruct all such Third Parties and Complaint 

Entities to Delete all Covered Information of Covered Users received from Defendant, and 

demand written confirmation that all the identified Covered Information has been Deleted. 

Defendant’s instruction to each such Third Party and Complaint Entities shall include a 

description of the Covered Information of Covered Users shared with the Third Party or 

Complaint Entities. Defendant must provide all instructions sent to the Third Parties and 

Complaint Entities to: DEbrief@ftc.gov or sent by overnight courier (not the U.S. Postal 

Service) to: Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade 

Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The subject line must 

begin: “U.S. v. GoodRx Holdings, Inc.” 

B. Defendant shall not disclose any Covered Information in any form, including 

hashed or encrypted Covered Information, to any Third Party or Complaint Entities identified in 

Subsection A above until Defendant confirms each Third Party and Complaint Entity’s receipt of 

the instructions required by Subsection A above. Defendant must provide all receipts of 

confirmation and any responses from Third Parties or Complaint Entities within five (5) days of 

receipt to: DEbrief@ftc.gov or sent by overnight courier (not the U.S. Postal Service) to: 

Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade 

Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The subject line must 

begin: “U.S. v. GoodRx Holdings, Inc.” 

C. Defendant shall not use any Third Party or Complaint Entity identified in 

Subsection A above to advertise, market, promote, offer, offer for sale, or sell any product or 

service until Defendant confirms each Third Party and Complaint Entity’s receipt of the 

instructions required by Subsection A above. 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

14 
 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 15 of 33 

VII. MANDATED PRIVACY PROGRAM 

IT IS FURTHER ORDERED that any Covered Business, in connection with the 

collection, maintenance, use, disclosure of, or provision of access to, Covered Information, must, 

within one hundred eighty (180) days of entry of this Order, establish and implement, and 

thereafter maintain, a comprehensive privacy program (“Privacy Program”) that protects the 

privacy, security, availability, confidentiality, and integrity of such Covered Information. To 

satisfy this requirement, Defendant must, at a minimum: 

A. Document in writing the content, implementation, and maintenance of the Privacy 

Program; 

B. Provide the written program and any evaluations thereof or updates thereto to 

each Covered Business’s board of directors or governing body or, if no such board or equivalent 

governing body exists, to a senior officer of the Covered Business responsible for the Covered 

Business’s Privacy Program at least once every twelve (12) months and promptly (not to exceed 

thirty (30) days) after a Covered Incident; 

C. Designate a qualified employee or employees, who report(s) directly to the Chief 

Executive Officer(s) or, in the event a Chief Executive Officer role does not exist, a similarlysituated executive, to coordinate and be responsible for the Privacy Program; and keep the Chief 

Executive Officer(s) and Board of Directors informed of the Privacy Program, including all 

actions and procedures implemented to comply with the requirements of this Order, and any 

actions and procedures to be implemented to ensure continued compliance with this Order; 

D. Assess and document, at least once every twelve (12) months and promptly (not 

to exceed thirty (30) days) following a Covered Incident, internal and external risks in each area 

of the Covered Business’s operations to the privacy, security, availability, confidentiality, and 

integrity of Covered Information that could result in the unauthorized access, collection, use, 

destruction, or disclosure of, or provision of access to, Covered Information; 

E. Design, implement, maintain, and document safeguards that control for the 

internal and external risks to the privacy, security, availability, confidentiality, and integrity of 

Covered Information identified by each Covered Business in response to Subsection VII.D. 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

15 
 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 16 of 33 

Each safeguard must be based on the volume and sensitivity of the Covered Information that is at 

risk, and the likelihood that the risk could be realized and result in the unauthorized access, 

collection, use, destruction, disclosure of, or provision of access to, the Covered Information. 

Such safeguards must also include: 

1. policies, procedures, and technical measures to systematically inventory Covered 

Information in the Covered Business’s control and Delete Covered Information that is no longer 

necessary; 

2. policies, procedures, and technical measures to prevent the collection, 

maintenance, use, or disclosure of, or provision of access to, Covered Information inconsistent 

with the Covered Business’s representations to consumers; 

3. audits, assessments, and reviews of the contracts, privacy policies, and terms of 

service associated with any Third Party to which each Covered Business discloses, or provides 

access to Covered Information; 

4. policies, procedures, and controls to ensure that each Covered Business complies 

with Sections I-IV above; 

5. policies and technical measures that limit employee and contractor access to 

Covered Information to only those employees and contractors with a legitimate business need to 

access such Covered Information; 

6. mandatory privacy training programs for all employees on at least an annual 

basis, updated to address: the collection, use, and disclosure of Covered Information; any internal 

or external risks identified by each Covered Business in Subsection VII(D); and safeguards 

implemented pursuant to Subsection VII(E), that includes training on the requirements of this 

Order; 

7. a data retention policy that, at a minimum, includes: 

a. a retention schedule that limits the retention of Covered Information for 

only as long as is reasonably necessary to fulfill the purpose for which the 

Covered Information was collected; provided, however, that such Covered 

Information need not be destroyed, and may be disclosed, to the extent 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

16 
 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 17 of 33 

requested by a government agency or required by law, regulation, or court 

order; and 

b. a requirement that each Covered Business document, adhere to, and make 

publicly available in its terms of service or terms of use a retention 

schedule for Covered Information, setting forth: (1) the purposes for 

which such information is collected; (2) the specific business need for 

retaining each type of Covered Information; and (3) a set timeframe for 

Deletion of each type of Covered Information (absent any intervening 

Deletion requests from consumers) that precludes indefinite retention of 

any Covered Information; 

8. For each product or service, policies and procedures to document internally the 

decision to collect, use, disclose, or maintain each type of Covered Information. Such 

documentation should include: (a) the name or names of the person or people who made the 

decision; (b) for what purpose the type of Covered Information is being collected; (c) the data 

segmentation controls in place to ensure that the type of Covered Information collected is only 

used for the particular purpose for which it was collected; (d) the data retention limit set for each 

type of Covered Information and the technical means for achieving Deletion; (e) the safeguards 

in place to prevent disclosure or sale of each type of Covered Information; and (f) the access 

controls in place to ensure only authorized employees with a need-to-know have access to each 

type of Covered Information; 

9. audits, assessments, reviews, or testing of web pixels and Software Development 

Kits, and their associated Third Parties, to which each Covered Business discloses or provides 

access to Covered Information. 

F. Assess, at least once every twelve (12) months and promptly (not to exceed thirty 

(30) days) following a Covered Incident, the sufficiency of any safeguards in place to address the 

internal and external risks to the privacy, security, availability, confidentiality, and integrity of 

Covered Information, and modify the Privacy Program based on the results; 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

17 
 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 18 of 33 

G. Test and monitor the effectiveness of the safeguards at least once every twelve 

(12) months and promptly (not to exceed thirty (30) days) following a Covered Incident, and 

modify the Privacy Program based on the results; 

H. Select and retain service providers capable of safeguarding Covered Information 

they receive from the Covered Business, and contractually require service providers to 

implement and maintain safeguards for Covered Information; 

I. Evaluate and adjust the Privacy Program in light of any material changes to each 

Covered Business’s operations or business arrangements, the results of the testing and 

monitoring required by Subsection VII(F), a Covered Incident, new or more efficient 

technological or operational methods to control for the risks identified in Subsection VII(D), and 

any other circumstances that the Covered Business knows or has reason to believe may have a 

material impact on the effectiveness of the Privacy Program or any of its individual safeguards. 

The Covered Business may make this evaluation and adjustment to the Privacy Program at any 

time, but must, at a minimum, evaluate the Privacy Program at least once every twelve (12) 

months and modify the Program as necessary based on the results. 

VIII. PRIVACY ASSESSMENT BY A THIRD PARTY 

IT IS FURTHER ORDERED that, in connection with compliance with Section VII, for 

any Covered Business that collects, maintains, uses, discloses, or provides access to Covered 

Information, Defendant must obtain initial and biennial assessments (“Assessments”): 

A. The Assessments must be obtained from one or more qualified, objective, 

independent third-party professionals (“Assessor(s)”) who: (1) uses procedures and standards 

generally accepted in the profession; (2) conducts an independent review of the Privacy 

Program; (3) retains all documents relevant to each Assessment for five (5) years after 

completion of such Assessment; and (4) will provide such documents to the Commission within 

ten (10) days of receipt of a written request from a representative of the Commission. No 

documents may be withheld on the basis of a claim of confidentiality, proprietary or trade 

secrets, work product protection, attorney client privilege, statutory exemption, or any similar 

claim. The Assessor(s) must have a minimum of three (3) years of experience in the field of 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

18 
 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 19 of 33 

privacy and data protection. 

B. For each Assessment, Defendant must provide the Associate Director for 

Enforcement for the Bureau of Consumer Protection at the Federal Trade Commission with the 

name, affiliation, and qualifications of the proposed Assessor, whom the Associate Director shall 

have the authority to approve in his or her sole discretion. 

C. The reporting period for the Assessments must cover: (1) the first year after the 

entry of this Order for the initial Assessment; and (2) each two (2) year period thereafter for 

twenty (20) years after the entry of this Order for the biennial Assessments. 

D. Each Assessment must, for the entire assessment period: 

E. determine whether Defendant has implemented and maintained the Privacy 

Program required by Section VII; 

F. assess the effectiveness of Defendant’s implementation and maintenance of 

Subections VII(A)-(I); 

G. identify any gaps or weaknesses in the Privacy Program or instances of material 

noncompliance with Subsections VII(A)-(I); 

H. address the status of gaps or weaknesses in the Privacy Program, as well as any 

instances of material non-compliance with Subsections VII(A)-(I), that were identified in any 

prior Assessment required by this Order; and 

I. identify specific evidence (including, but not limited to, documents reviewed, 

sampling and testing performed, and interviews conducted) examined to make such 

determinations, assessments, and identifications, and explain why the evidence that the Assessor 

examined is: (a) appropriate for assessing an enterprise of Defendant’s size, complexity, and risk 

profile; and (b) sufficient to justify the Assessor’s findings. No finding of any Assessment shall 

rely solely on assertions or attestations by Defendant, Defendant’s management, or a Covered 

Business’s management. The Assessment must be signed by the Assessor, state that the 

Assessor conducted an independent review of the Privacy Program and did not rely solely on 

assertions or attestations by Defendant, Defendant’s management, or a Covered Business’s 

management and state the number of hours that each member of the Assessor’s assessment team 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

19 
 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 20 of 33 

worked on the Assessment. To the extent Defendant revises, updates, or adds one or more 

safeguards required under Subsection VII(E) in the middle of an Assessment period, the 

Assessment must assess the effectiveness of the revised, updated, or added safeguard(s) for the 

time period in which it was in effect, and provide a separate statement detailing the basis for each 

revised, updated, or additional safeguard. 

J. Each Assessment must be completed within sixty (60) days after the end of the 

reporting period to which the Assessment applies. Unless otherwise directed by a Commission 

representative in writing, Defendant must submit the initial Assessment to the Commission 

within ten (10) days after the Assessment has been completed via email to DEbrief@ftc.gov or 

by overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, 

Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, 

Washington, DC 20580. The subject line must begin, “U.S. v. GoodRx Holdings, Inc.” All 

subsequent biennial Assessments must be retained by Defendant until the Order is terminated 

and provided to the Associate Director for Enforcement within ten (10) days of request. 

IX. COOPERATION WITH ASSESSOR 

IT IS FURTHER ORDERED that Defendant, whether acting directly or indirectly, in 

connection with the Assessments required by Section VIII, must: 

A. provide or otherwise make available to the Assessor all information and material 

in their possession, custody, or control that is relevant to the Assessment for which there is no 

reasonable claim of privilege; 

B. provide or otherwise make available to the Assessor information about all 

Covered Information in Defendant’s custody or control so that the Assessor can determine the 

scope of the Assessment; and 

C. disclose all material facts to the Assessor, and not misrepresent in any manner, 

expressly or by implication, any fact material to the Assessor’s: (1) determination of whether 

Defendant has implemented and maintained the Privacy Program required by Section VII; (2) 

assessment of the effectiveness of the implementation and maintenance of Subsections VII(A)-

(I); or (3) identification of any gaps or weaknesses in, or instances of material noncompliance 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

20 
 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 21 of 33 

with, the Privacy Program required by Section VII. 

X. ANNUAL CERTIFICATION 

IT IS FURTHER ORDERED that Defendant must: 

A. One year after the entry of this Order, and each year thereafter, provide the 

Commission with a certification from a senior corporate manager, or, if no such senior corporate 

manager exists, a senior officer of each Covered Business that: (1) the Covered Business has 

established, implemented, and maintained the requirements of this Order; (2) the Covered 

Business is not aware of any material noncompliance that has not been: (a) corrected, or (b) 

disclosed to the Commission; and (3) includes a brief description of any Covered Incident. The 

certification must be based on the personal knowledge of the senior corporate manager, senior 

officer, or subject matter experts upon whom the senior corporate manager or senior officer 

reasonably relies in making the certification. 

B. Unless otherwise directed by a Commission representative in writing, submit all 

annual certifications to the Commission pursuant to this Order via email to DEbrief@ftc.gov or 

by overnight courier (not the U.S. Postal Service) to Associate Director for Enforcement, Bureau 

of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, 

Washington, D.C. 20580. The subject line must begin, “U.S. v. GoodRx Holdings, Inc.” 

XI. COVERED INCIDENT REPORTS 

IT IS FURTHER ORDERED that Defendant, within thirty (30) days after discovery of a 

Covered Incident, must submit a report to the Commission, unless the Covered Incident also 

constitutes a Breach of Security involving the Unsecured PHR Identifiable Health Information of 

500 or more individuals and therefore requiring notice under Section IV of this Order. The 

report must include, to the extent possible: 

A. the date, estimated date, or estimated date range when the Covered Incident 

occurred; 

B. a description of the facts relating to the Covered Incident, including the causes 

and scope of the Covered Incident, if known; 

C. the number of consumers whose information was affected; 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

21 
 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 22 of 33 

D. the acts that Defendant has taken to date to remediate the Covered Incident; 

protect Covered Information from further disclosure, exposure, or access; and protect affected 

individuals from identity theft or other harm that may result from the Covered Incident; and 

E. a representative copy of any materially different notice sent by Defendant to 

consumers or to any U.S. federal, state, or local government entity. 

Unless otherwise directed by a Commission representative in writing, all Covered 

Incident reports to the Commission pursuant to this Order must be emailed to DEbrief@ftc.gov 

or sent by overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, 

Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, 

Washington, DC 20580. The subject line must begin: “U.S. v. GoodRx Holdings, Inc.” 

XII. MONETARY JUDGMENT FOR CIVIL PENALTY 

IT IS FURTHER ORDERED that: 

A. Judgment in the amount of $1,500,000 is entered in favor of Plaintiff against 

Defendant as a civil penalty. 

B. Defendant is ordered to pay to Plaintiff, by making payment to the Treasurer of 

the United States, $1,500,000, which, as Defendant stipulates, their undersigned counsel holds in 

escrow for no purpose other than payment to Plaintiff. Such payment must be made within 7 

days of entry of this Order by electronic fund transfer in accordance with instructions previously 

provided by a representative of Plaintiff. 

XIII. ADDITIONAL MONETARY PROVISIONS 

IT IS FURTHER ORDERED that: 

A. Defendant relinquishes dominion and all legal and equitable right, title, and 

interest in all assets transferred pursuant to this Order and may not seek the return of any assets. 

B. The facts alleged in the Complaint will be taken as true, without further proof, in 

any subsequent civil litigation by or on behalf of the Commission, including in a proceeding to 

enforce its rights to any payment or monetary judgment pursuant to this Order. 

C. Defendant acknowledges that its Taxpayer Identification Numbers, or Employer 

Identification Numbers, which Defendant previously submitted to the Commission, may be used 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

22 
 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 23 of 33 

for collecting and reporting on any delinquent amount arising out of this Order, in accordance 

with 31 U.S.C. § 7701. 

XIV. ORDER ACKNOWLEDGMENTS 

IT IS FURTHER ORDERED that Defendant obtain acknowledgments of receipt of this 

Order: 

A. Defendant, within seven (7) days of entry of this Order, must submit to the 

Commission an acknowledgment of receipt of this Order sworn under penalty of perjury. 

B. For 20 years after entry of this Order, for any business that Defendant is the 

majority owner or controls directly or indirectly, Defendant must deliver a copy of this Order to: 

(1) all principals, officers, directors, and LLC managers and members; (2) all employees having 

managerial responsibilities for conduct related to the subject matter of the Order and all agents 

and representatives who participate in conduct related to the subject matter of the Order; and (3) 

any business entity resulting from any change in structure as set forth in the Section titled 

Compliance Reporting. Delivery must occur within seven (7) days of entry of this Order for 

current personnel. For all others, delivery must occur before they assume their responsibilities. 

C. From each individual or entity to which Defendant delivered a copy of this Order, 

Defendant must obtain, within thirty (30) days, a signed and dated acknowledgment of receipt of 

this Order. 

XV. COMPLIANCE REPORTING 

IT IS FURTHER ORDERED that Defendant make timely submissions to the 

Commission: 

A. One year after entry of this Order, Defendant must submit a compliance report, 

sworn under penalty of perjury: 

Defendant must: (a) identify the primary physical, postal, and email address and 

telephone number, as designated points of contact, which representatives of the 

Commission and Plaintiff may use to communicate with Defendant; (b) identify all of 

that Defendant’s businesses by all of their names, telephone numbers, and physical, 

postal, email, and Internet addresses; (c) describe the activities of each business, 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

23 
 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 24 of 33 

including the goods and services offered, and the means of advertising, marketing, and 

sales; (d) describe in detail whether and how Defendant is in compliance with each 

Section of this Order; and (e) provide a copy of each Order Acknowledgment obtained 

pursuant to this Order, unless previously submitted to the Commission. 

B. One year after entry of this Order and annually thereafter for 5 years, Defendant 

must submit a supplemental compliance report, sworn under penalty of perjury, explaining any 

disclosure of Health Information to Third Parties for Non-Advertising Purposes that was made 

without first obtaining Affirmative Express Consent in violation of Section III of this Order and 

not in reliance on Subsection III.E of this Order, including: the type of information disclosed; the 

purpose for each such disclosure; the part of the Covered Business that made the disclosure, the 

reason the disclosure was in compliance with the HIPAA Privacy Rule; and the dates of the 

disclosure. 

C. For 20 years after entry of this Order, Defendant must submit a compliance 

notice, sworn under penalty of perjury, within fourteen (14) days of any change in the following: 

(a) any designated point of contact; or (b) the structure of Defendant or any entity that 

Defendant has any ownership interest in or controls directly or indirectly that may affect 

compliance obligations arising under this Order, including: creation, merger, sale, or 

dissolution of the entity or any subsidiary, parent, or affiliate that engages in any acts or 

practices subject to this Order. 

D. Defendant must submit to the Commission notice of the filing of any bankruptcy 

petition, insolvency proceeding, or similar proceeding by or against Defendant within fourteen 

(14) days of its filing. 

E. Any submission to the Commission required by this Order to be sworn under 

penalty of perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by 

concluding: “I declare under penalty of perjury under the laws of the United States of America 

that the foregoing is true and correct. Executed on: _____” and supplying the date, signatory’s 

full name, title (if applicable), and signature. 

F. Unless otherwise directed by a Commission representative in writing, all 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

24 
 

 

 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 25 of 33 

submissions to the Commission pursuant to this Order must be emailed to DEbrief@ftc.gov or 

sent by overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, 

Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, 

Washington, DC 20580. The subject line must begin: “U.S. v. GoodRx Holdings, Inc.” 

XVI. RECORDKEEPING 

IT IS FURTHER ORDERED that Defendant must create certain records for twenty (20) 

years after entry of the Order, and retain each such record for five (5) years. Specifically, 

Defendant must create and retain the following records: 

A. accounting records showing the revenues from all goods or services sold; 

B. personnel records showing, for each person providing services, whether as an 

employee or otherwise, that person’s: name; addresses; telephone numbers; job title or position; 

dates of service; and (if applicable) the reason for termination; 

C. records of all consumer complaints and refund requests, whether received directly 

or indirectly, such as through a third party, and any response; 

D. records describing all disclosures of Health Information or PHR Identifiable 

Health Information to Third Parties; 

E. records describing all disclosures of App Events to Third Parties; 

F. all records necessary to demonstrate full compliance with each provision of this 

Order, including all submissions to the Commission; and 

G. a copy of each unique advertisement or other marketing material pertaining to a 

specific drug or medical condition, and any advertisement that makes claims about the privacy or 

security of consumers’ Health Information. 

H. every six months, a screen capture of Defendant’s website and mobile application 

flows relating to users inputting Covered Information. 

XVII. COMPLIANCE MONITORING 

IT IS FURTHER ORDERED that, for the purpose of monitoring Defendant’s compliance 

with this Order: 

A. Within fourteen (14) days of receipt of a written request from a representative of 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

25 
 

 

 

 

 5 

 10 

 15 

 20 

 25 

_______________________________ 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 26 of 33 

the Commission or Plaintiff, Defendant must: submit additional compliance reports or other 

requested information, which must be sworn under penalty of perjury; appear for depositions; 

and produce documents for inspection and copying. The Commission and Plaintiff are also 

authorized to obtain discovery, without further leave of court, using any of the procedures 

prescribed by Federal Rules of Civil Procedure 29, 30 (including telephonic depositions), 31, 33, 

34, 36, 45, and 69. 

B. For matters concerning this Order, the Commission and Plaintiff are authorized to 

communicate directly with Defendant. Defendant must permit representatives of the 

Commission and Plaintiff to interview any employee or other person affiliated with any 

Defendant who has agreed to such an interview. The person interviewed may have counsel 

present. 

C. The Commission and Plaintiff may use all other lawful means, including posing, 

through its representatives as consumers, suppliers, or other individuals or entities, to Defendant 

or any individual or entity affiliated with Defendant, without the necessity of identification or 

prior notice. Nothing in this Order limits the Commission’s lawful use of compulsory process, 

pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 57b-1. 

XVIII. RETENTION OF JURISDICTION 

IT IS FURTHER ORDERED that this Court retains jurisdiction of this matter for 

purposes of construction, modification, and enforcement of this Order. 

SO ORDERED this___day of_______________, 202__. 

UNITED STATES DISTRICT JUDGE 

STIPULATED ORDER FOR PERMANENT INJUNCTION, Case No. 3:23-cv-460 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

26 
 

 5 

 10 

 15 

 20 

 25 

 1 

2 

3 

4 

6 

7 

8 

9 

11 

12 

13 

14 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

STIPULATED ORDER FOR PERMANENT Case No. _______ 

INJUNCTION, CIVIL PENALTY JUDGMENT, AND 

OTHER RELIEF 27 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 27 of 33 

SO STIPULATED AND AGREED: 

FOR PLAINTIFF UNITED STATES OF AMERICA: 

BRIAN M. BOYNTON 

Principal Deputy Assistant Attorney General 

Civil Division 

ARUN G. RAO 

Deputy Assistant Attorney General, Consumer Protection Branch 

AMANDA N. LISKAMM 

Acting Director, Consumer Protection Branch 

LISA K. HSIAO 

Assistant Director, Consumer Protection Branch 

/s/ Sarah Williams Date: January 24, 2023 

SARAH WILLIAMS 

Trial Attorney 

Consumer Protection Branch 

450 5th St NW, Suite 6400-S 

Washington, D.C. 20530 

Telephone: (202) 616-4269 

sarah.williams@usdoj.gov 

STEPHANIE M. HINDS 

United States Attorney 

/s/ Sharanya Mohan 

SHARANYA MOHAN 

Assistant United States Attorney 

Northern District of California 

450 Golden Gate Avenue 

San Francisco, CA 94102 

Telephone: (415) 436-7198 

sharanya.mohan@usdoj.gov 

OF COUNSEL: 

RONNIE SOLOMON 

DENISE M. OKI 

Attorneys

Federal Trade Commission 

Western Region San Francisco 
5 

10 

15 

20 

25 

----

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 28 of 33 

1 

2 

3 

r 

Date: f o,tir ll ---+--- 4 Richard H. Cunningham 

Olivia Adendorff 

Rachael A. Rezabek 

6 

Kirkland & Ellis, LLP 

7 Counsel for GoodRx Holdings, Inc. 

1301 Pennsylvania Ave., N.W.Washington, D.C. 20004 

FOR DEFENDANT: 

8 (202) 425-5385

9 rich.cunningham@kirkland.com

olivia.adendorff@kirkland.com

rachael.rezabek@kirkland.com

11 

DEFENDANT: GoodRx Holdings, Inc. 12 

13 

14 

Senior Vice President and General Counsel 

16 

17 

18 

19 

21 

22 

23 

24 

26 

27 

28 

STIPULATED ORDER FOR PERMANENT INJUNCTION, 

CIVIL PENALTY JUDGMENT, AND OTHER RELIEF 

28 

Date: October 21 2022

Case No. ---
Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 29 of 33 

Exhibit A 

Website and Mobile Application Notice 

The Federal Trade Commission alleges that we shared identifiable information about people who 

visited our website or used our app between July 2017 and April 2020 without their permission. 

This information included details about drug and health conditions people searched and their 

prescription medications. We shared this information with third parties, including Facebook. In 

some cases, GoodRx used the information to target people with health-related ads. 

The Federal Trade Commission alleges we broke the law by sharing this health information 

without users’ permission. To resolve the case, we have agreed to an FTC order [notice will 

include a link to the FTC.gov page with Complaint and Order] requiring that: 

 We’ll tell applicable third parties (like Facebook) who received that information to delete 

it. 

 We’ll never share your health information with applicable third parties (like Facebook) 

for advertising purposes. 

 We won’t share your health information with applicable third parties (like Facebook) for 

other purposes, unless we get your permission first. 

 We’ll put in place a comprehensive privacy program with heightened procedures and 

controls to protect your personal and health information. An independent auditor will 

review our program to make sure we’re protecting your information. These audits will 

happen every two years for 20 years. 

If you have any questions, email us at privacy@goodrx.com. 

To learn more about the settlement, go to ftc.gov and search for “GoodRx”. 

For advice on protecting your health privacy, read the FTC’s Does your health app protect your 

sensitive info? 
Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 30 of 33 

Notice to Covered Users 

The Federal Trade Commission alleges that between July 2017 and April 2020, you visited 

GoodRx.com or used the GoodRx app. During this time, we shared identifiable information 

related to you, including health information, without your permission. This information included 

details about drug and health conditions you searched and your prescription medications. We 

shared this information with third parties, including Facebook. In some cases, GoodRx used the 

information to target you with health-related ads. 

The Federal Trade Commission alleges we broke the law by sharing your health information 

without your permission. To resolve the case, we have agreed to an FTC order [notice will 

include link to the FTC.gov page with Complaint and Order] requiring that: 

 We’ll tell applicable third parties (like Facebook) who received that information to delete 

it. 

 We’ll never share your health information with applicable third parties (like Facebook) 

for advertising purposes. 

 We won’t share your health information with applicable third parties (like Facebook) for 

other purposes, unless we get your permission first. 

 We’ll put in place a comprehensive privacy program with heightened procedures and 

controls to protect your personal and health information. An independent auditor will 

review our program to make sure we’re protecting your information. These audits will 

happen every two years for 20 years. 

If you have any questions, email us at privacy@goodrx.com. 

To learn more about the settlement, go to ftc.gov and search for “GoodRx”. 

For advice on protecting your health privacy, read the FTC’s Does your health app protect your 

sensitive info? 
 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 31 of 33 

IN THE UNITED STATES DISTRICT COURT 

FOR THE NORTHERN DISTRICT OF CALIFORNIA 

UNITED STATES OF AMERICA, 

Plaintiff, 

v. 

GOODRX HOLDINGS, INC., a corporation, 

also d/b/a GoodRx, GoodRx Gold, GoodRx 

Care, HeyDoctor, and HeyDoctor by 

GoodRx; 

Defendant. 

Case No. ________________ 

ACKNOWLEDGMENT BY 

AFFIDAVIT OF RECEIPT OF 

ORDER BY DEFENDANT [NAME] 

A. My name is __________________ , my job title is ___________, and I am 

authorized to accept service of process on GoodRx Holdings, Inc. I am [a U.S. citizen] over the 

age of eighteen, and I have personal knowledge of the facts set forth in this Acknowledgment. 

B. GoodRx Holdings, Inc., was a Defendant in U.S. v. GoodRx Holdings, Inc., et al., 

which is the court case listed near the top of this page. 

C. On [________, 202_], I received a copy of the Stipulated Order for Permanent 

Injunction, Civil Penalty Judgment, and Other Relief, which was signed by the Honorable 

[Judge’s name] and entered by the Court on [Month ___, 202_]. A true and correct copy of the 

Order that I received is attached to this Acknowledgment. 

D. On [Month ___, 202_], GoodRx Holdings, Inc., received a copy of the Stipulated 

Order for Permanent Injunction, Civil Penalty Judgment, and Other Relief, which was signed by 
___________________________________ 

_____________________________ 

_____________________________ 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 32 of 33 

the Honorable [Judge’s name] and entered by the Court on [Month ___, 202_]. The copy of the 

Order attached to this Acknowledgment is a true and correct copy of the Order it received. 

I declare under penalty of perjury under the laws of the United States of America that the 

foregoing is true and correct. Executed on [Month __, 202_]. 

[Full name] 

Officer of 

GoodRx Holdings, Inc. 

State of ____________________, City of ____________________ 

Subscribed and sworn to before me 

this _____ day of _________, 202__. 

Notary Public 

My commission expires: 
 

Case 3:23-cv-00460-DMR Document 3-1 Filed 02/01/23 Page 33 of 33 

IN THE UNITED STATES DISTRICT COURT 

FOR THE NORTHERN DISTRICT OF CALIFORNIA 

UNITED STATES OF AMERICA, 

Plaintiff, 

v. 

GOODRX HOLDINGS, INC., a corporation, 

also d/b/a GoodRx, GoodRx Gold, GoodRx 

Care, HeyDoctor, and HeyDoctor by 

GoodRx; 

Defendant. 

Case No. ____________ 

ACKNOWLEDGMENT BY 

DECLARATION OF RECEIPT OF 

ORDER BY A NON PARTY 

I, ___________________________________, received a copy of the Stipulated Order for 

Permanent Injunction, Civil Penalty Judgment, and Other Relief, in U.S. v. GoodRx Holdings, 

Inc., et al., on ______ __, 20___. 

I was not a Defendant in that court case. My title or relationship with Defendant 

is _____________________________________. 

I declare under penalty of perjury under the laws of the United States of America that the 

foregoing is true and correct. 

Executed on _______, 20__. 

Signed: ________________________