I think free software really matters here. I really do not want companies storing the information from a BMI on their servers and I would actually take the time to audit any software to be certain of this.

Free software is a good enough requirement for read-only devices, but I would never use a read-write device that was not also formally verified. This is one of those things where "move fast and break things" means that your customers will break you.