Tough situation :D

In the way I see it, there will be x509 certificates representing each worker. Using that, we can define who can read, and who can write the data. Ideally, made it mostly automated. If you are not in the "list" of valid identities - Your request simply won't proceed. That's not enough to hack the password, you should hack the entire system, which makes task quite a lot harder (which I am also considering).

Is the data in the blockchain?

Yes, the most sensitive data will be stored in the blockchain.

And how do you revoque authorizatio to read it?

We can simply remove that identity from list, so it will not be able to read or write. I think we can also change permissions, to restrict reading/writing.