Opt-out 'consent' is not consent in any meaningful way, so simply treat all of this data as obtained without consent and, well, it's clear from existing healthcare legislation on how to handle such distribution of data without explicit consent by an informed patient.

IMHO the startup should be happy if this ends up with just a bankruptcy of their company, instead of criminal charges for the individual people involved.