If this were true. This article would not be necessary.

I think its fair to say that privacy is a "priority" for GoodRX. But not "one of our most important".

The fact that this non-apology letter exists indicates that your legal liability concerns and investor relations issues are far more important than patient privacy.

If patient privacy were "one of our most important" priorities at GoodRX then this document would be a readout of a post-mortem on the mistakes made and the steps taken to address those mistakes.

The FTC compliant specifically states:

GoodRx also did not have any employee, manager, executive, or team formally dedicated to the management or oversight of GoodRx’s company-wide privacy and data sharing practices

GoodRX now has full-time privacy executives. But at the time, patient privacy was not so important that they could have someone attached to it. Not sure what "top priority" means, but this does not sound like it.