Sure but what exactly is a malicious scenario in this case? That they'd use this data to probe which drug to do R&D on?

If this was an insurance company I wouldn't have asked this question.