"We understand this is a big responsibility and we work hard to protect your information, put you in control and give you transparency about your data," Alphabet (GOOG 1.25%) (GOOGL 1.27%) subsidiary Google said earlier this month when it announced it was planning to acquire wearable tech company Fitbit (FIT). "Similar to our other products, with wearables, we will be transparent about the data we collect and why."

"Fitbit will continue to put users in control of their data and will remain transparent about the data it collects and why," Fitbit similarly reassured consumers. "The company never sells personal information, and Fitbit health and wellness data will not be used for Google ads."

Consumers and regulators just got a good reason to be skeptical about those assurances.

Fitbit's digital health platform displayed on four smartphones

Fitbit collects user data for its platform. Image source: Fitbit.

Just because it's legal doesn't mean it's right

The Wall Street Journal reports that Google has been surreptitiously collecting health data on Americans as part of its broader push to develop a digital health platform. Tens of millions of patients in 21 states are affected, according to the paper.

Google partnered with Ascension last year for the effort, which is code-named Project Nightingale and includes many types of sensitive data such as lab test results, hospitalization records, and more. Most importantly, patients and their doctors were left in the dark about the partnership.

While the data collection may not directly run afoul of any laws, the practice is still sure to upset many consumers, as they have become increasingly cognizant of privacy considerations in recent years, particularly in the context of gigantic tech companies with advertising businesses. The search juggernaut is reportedly using the data as inputs for artificial intelligence (AI) and machine learning, hoping to develop software that can help inform patients in medical decisions.

Shortly after the revelations broke, Ascension conveniently put out a press release saying the companies were working to "deliver a comprehensive portfolio of digital capabilities that enhance the experience of Ascension consumers, patients and clinical providers across the continuum of care." Ascension notes that the program is fully complaint with the Health Insurance Portability and Accountability Act (HIPAA) and that the partnership is "underpinned by a robust data security and protection effort and adherence to Ascension's strict requirements for data handling."

Healthcare and the underlying user data has emerged as a new and critical battleground for tech companies, as Apple (AAPL 0.64%) continues to grow Apple Watch sales while CEO Tim Cook reiterates his belief that Apple's "greatest contribution will be to people's health." The Mac maker just this month partnered with the U.S. Department of Veterans Affairs to bring digital health records to the Health app for veterans.

Google and Fitbit need regulators to sign off on the proposed $2.1 billion acquisition, and some have already expressed skepticism due to the implications for user data. The European Commission's top competition official, Margrethe Vestager, said last week that antitrust regulators would "have a concern if companies merge because of data." Some lawmakers in the U.S. have voiced similar concerns.

Well, critics of the deal just got some major ammo for their arguments.