No ifs, no buts. Stuff like this deserves ruinous fines for its executives.

Cycle data in the hands of many country's authorities is outright dangerous. If you're storing healthcare data, it should require IN BIG RED LETTERS an explicit opt-in, every single time, when that data leaves your device.