PSA: More privacy fail

I'm registered as a potential bone marrow donor with the Anthony Nolan charity. They appear to have decided that a good way of keeping everybody's details up-to-date is to create websites for all the donors on their register, with URLs of the form www.[firstnamesurname].mydetails.org. When I went to this web-page, I was asked to input my date of birth and when I did so was shown my full home address!

I have just written the following email to Anthony Nolan:

Dear Anthony Nolan Trust,

I am registered as a bone marrow donor with the Anthony Nolan Trust. Today I received a post-card asking me to log in to a website at [fullname].mydetails.org. This website required me to input my date of birth and then gave me a page with my full home address. I do not find this to be at all appropriate! My date of birth is not secure information; I do not expect anyone on the internet to be able to access my full home address (and my status as a potential bone marrow donor, which is personal, medical information) based on knowing my name and date of birth.

I do appreciate the work that the Trust are doing, and I am happy to remain on the register. However, I would ask you to please remove this sensitive personal information from the internet. I have never granted permission to the Trust to publicize my address in this insecure manner, and I do not grant permission to you now to handle my data in this way. I am not willing to send you updated contact details until you have sorted out this serious security problem.

Regards,
[Full Name]

This probably won't affect as many people as the recent Etsy problem, but if you do happen to be on the bone marrow donors register, you might want to check up on this issue. Grr. I really assumed that people who maintain a national register for specifically medical purposes would be at least vaguely competent about confidentiality!