Actually no, Grindr is not a HIPAA covered entity (Such as a healthcare provider or clinic) or a "business associate" of a covered entity (Such as a Third-party to process and/or transmit medical data on behalf of a covered entity)

Now if Grindr had Grindr owned STD clinics that people got tested at and somehow that info got onto the app that would be a HIPAA violation.

An app asking you and you providing STD status freely, or any medical status for that matter, isn't. (Unless it's an app that bills itself as a medical something)

HIPAA only applies of its your doctor or a medical institution does it. it doesnt stop people you may know/businesses unrelated to the field from disclosing said info.

In the states, that’d be a Big Fucking HIPAA Violation

Is it though? If memory serves, users willfully providing medical info isn't a breach, unlike if they accessed that info directly from the doctor.

As people have said, it's actually perfectly legal in the US, horrifyingly.

But the UK has very strict data protection laws which we inherited from when we were in the EU, and medical data is explicitly considered sensitive. If they actually did sell medical information, they're in deep shit, legally.

Unfortunately it's not a HIPAA violation. That only covers medical providers. No one else is beholden to HIPAA.

Have you ever once heard of a company being fined out of existence?