In the US, HIPAA allows your medical data to be shared without your express consent as long as certain conditions are met. Generally, they are that the data must be used to help your provider meet a legitimate medical or business need, and they have to have a contract with the entities they share with that constrains their use of that data.