Facebook Wants Your Medical Data, but Isn’t Legally Obligated to Protect It