I mean, that's just shoddy reasoning or laziness of the client. If you make a medical app like that, you clearly have a lawful basis for processing based on the "contract" lawful basis. So the only issue would be taking care how it's used, and having a policy in place for handling that data.