In many large companies with multiple divisions the divisions operate to a large extent like separate private companies even if the company as a whole is a public company.

Is Google like that? If so, then it is easy to square things. The parts of Google that handle health stuff could have completely different policies about handling private information than the parts that deal with smartphones.