Honestly borders to me on being de-facto undemocratic because I doubt a lot of British citizens are aware of this or that there has been any sort of meaningful consent given by patients to outsource their data to a foreign intelligence firm.
When it comes to how to solve this I really think we need to fundamentally rethink data ownership both on a legal as well at a technical level. I was recently reading up on Tim Berners-Lee's SOLID and I think something like that should be the default for all our data. We store our own healthcare data in something akin to a pod, when the NHS uses that data they get access to it granted by the patient in a way that puts formal limits on what they can do with it and how long they have access to it, and I as the patient have both the right and technical ability to revoke that access. We really need to push for data ownership and strong guarantees for data rather than this through the backdoor process of shoving private health data to unaccountable firms.
Maybe this is something where all these smart contract and decentralisation technologies can play a meaningful role rather than being primarily used for speculative currencies.