There’s little transparency about who has access to deeply personal medical data or how companies handle it.