Well, in the case of PA (as an example) i believe they have a `Subsequent disclosure prohibited` portion of their statute which covers anyone who has the data preventing them from further sharing it without consent.
For HIV status disclosed as part of medical services. In the case of Grindr, HIV status is voluntarily collected as demographic data for its social network.
Its also available to anyone who sees the profile in their search results. As far as I can tell you cant have a profile that is active, use it and not show up in search results.
