I think the issue is moreso that you’re sending confidential health data to a 3rd party, which is where you lose control. You don’t know the intentions of people looking to steal that data, and you need to consider the worst possible outcome and guard against those. AI training is just one option. Get creative, what could you do with a doctor’s voice and their patient’s private medical history?
Simplest solution is to stop the arrangement until the company can prove data security on their end or implement an offline solution on local servers not connected to the internet.
I don’t have a lot of sympathy for any of the idiots that buy these idiotic things.