That seems reasonable, but can we also say, let's not send medically sensiive information to every employee at the first party?

You could not fill out that part of the profile.