Should I "blow the whistle" on this online health care service? Or am I just making drama?

I’ve been trying one of those online therapy services. I’m not terribly impressed overall. One of the really annoying things is that their app stinks to high heaven. I was just now making a list of things for them that I hate about their app, and I discovered that one of those things could be exploited to get information about the other users of the service.

But how much does this particular information matter? It’s their “nickname”—not their “user name”, but a private nickname, because therapy is private, not a social network. It would be fairly easy (albeit tedious) to conjure private nicknames from this hole in their app. And presumably some private nicknames could be tied back to the actual person. Or maybe that’s too much of a stretch?

Or maybe no one else has seen this weakness? I don’t know. Should I just tell the operators of the service that they need to fix the hole, on the assumption that probably no one with malicious intent has ever found it or thought about how to exploit it? Or should I let the authorities make such determinations?

I’m not sure what to do. Is this just drama? Or do I need to do something?