In giving Google access to the healthcare data of nearly 1.6 million patients, the NHS has used a loophole around "implied consent". It did not require patient consent for direct care, and the great unknown is how much Google is going to extend the definition of implied consent to fit its purpose.There's a sense of inevitability when it comes to patient privacy and the use of innovative technologies such as AI in healthcare. We also know that in order to realise the full potential of an information society, personal and confidential data must be used and must also — at times — be shared.The need for data to be shared across organisational boundaries in order to help a specific patient, or to design and pay for a service, is undeniable. But what is intriguing, and perhaps makes all of us uncomfortable about the relationship between Google-owned DeepMind and NHS, is the amount of personal data being shared without the knowledge of patients.