From the terms:

FormAPI is not PCI DSS Certified or HIPAA compliant.

You understand that the technical processing and transmission of the Service, including your Content, may be transferred unencrypted and involve (a) transmissions over various networks; and (b) changes to conform and adapt to technical requirements of connecting networks or devices.

Unfortunately, this is a service that sees the data being entered on the form. If it processed a blank PDF form and sent back something you ran locally to generate a filled-in form, that would be great. But as a service, it sees too much user data.