You are absolutely right. What it comes down to, however, is consent by the individual. Data will not be shared without your permission. We will make sure our legal language is clearer here.
Without specific explanations, you could always weasel out of vague promises.
Sorry to sound negative. I'd love a service like this, but there's a very high bar for responsible implementation (in my opinion) and VC seems very unlikely to be compatible with responsibility.
Basically, what is your business model? Are you only making money from subscriptions, or through other means? What are the VC's expectations?
I think you need to stop for a bit and think about what ethical behavior is.