That's good to hear, but why does HM hide all this behind a wall of obfuscation? Why when I try to contact THEM for the T&C do they roundly ignore me? Why did I have to ask Redditors to get this information?

I've already mentioned my serious concerns with another such records system. I didn't mention that I ran into similar concerns back when I was first trying to get a COVID vaccination. RiteAid Pharmacy was giving them, but online registration was required and I could not get enough information where my personal information was being stored. The 3rd-party registrar gave no indication that it complied with HIPAA. (It may well have done, but I couldn't find that info.) Same problem with a surgical center -- that also used a 3rd party for communication.