@reederm@infosec@PsychResearchBot CVS (and others, of course) get away with this because somewhere, at some time you probably didn't even notice and cannot recall, you checked a box or clicked a button attached to a few thousand words of scrollable legal language that gave them your permission to do so. And somewhere, buried in a labyrinth of menus, domain names, and subcontracted cloud-based CRM software, there is an option to un-check that box. A healthcare system, if we can keep it.