As someone who works in medical I can say hospitals and other medical facilities absolutely can not sell your data without violating tons of hipaa regulations. I can say we can allow a company to come in and obfuscate data before selling it off. The big difference here would be there can not be any identifier that can link anyone (which happens with most companies that sell data), it’s mostly data on trends. If you can prove otherwise that would be a hell of an amazing lawsuit.