Because if I can say "you may use information I give you in the app to show me ads without disclosing who I am and any of my PHI" then there's a bright line. I

Because if I can say "you may use information I give you in the app to show me ads without disclosing who I am and any of my PHI" then there's a bright line. I only need to worry about company A mishandling the data. If I allow selling, I need to know about the myriad companies that A may deal with, not just B. I have no problem sharing information for services. I just want to have controls on that.