So while, in many jurisdictions, it's fine for companies to sell data collected on their employees, and it could be argued that those employees consented to this data sharing by working there, one could also easily argue for an employee protection law that prevents companies from requiring their employees to consent to this.
Edit: it is now some time since I studied the GDPR, so I'm actually unsure if, for healt-related data, it can be used any legal basis other than consent. The reason being that health, together with a few other categories, has special protections.
They're welcome to do what they want with that, but once it includes the ability to make inferences about me as an individual, more than the company, it becomes my data. I likely have to choose to share it to meet the terms of the emploment contract, but that doesn't change the appropriate ownership.
Try and apply whatever rules you want to IP the company claims to own? Surely the exact details of some trade secret process also belongs to me and I can do whatever I want with it because I need to know it to fulfill the terms of that same contract right? I can sell it to a 3rd party just 'cause right?