Health apps share your concerns with advertisers. HIPAA can’t stop it.