Re: Doesn't surprise me
It is not all bad. I was in a similar position, assessing some potential interventions indicated by modelling the effect of multiple stages of intervention. While we did work on real data (actually location and GP indicators were important and names were not remotely necessary to disambiguate) we were only allowed to use the analytics, including development, on site, on isolated machines, and asked to agree and sign strict NDAs. So someone was on the ball.