>> [data] "will never be linked or associated with Google accounts, products or services"

> was true at the time but surely what people care about is data flowing between the medical app and existing Google services?

I would think people would care about the data flowing to any Google service. An understanding that it only applied to existing services like you're claiming would be meaningless. A hyperbolic example of this is Google/Deepmind would still be compliant if they came out with a brand new service, Google Privacy Destroyer 1.0, that puts all these people's private health data up for sale on the dark web.