they use a combo of already available public datasets in addition to strategic partnership or licensings that give them accessibility to otherwise walled-off, yet potentially highly valuable data sources.

Regardless of where it comes from, everything is regulatory/HIPAA compliant prior to the data actually moving hands.