This is the story of two deals and the future of healthcare in the UK. The first was made in September 2015, under which three UK hospitals in the Royal Free NHS Trust handed the identifiable patient records of more than 2m Londoners to DeepMind, an artificial intelligence company wholly owned by Google.

With the company riding high on breakthroughs in the fields of game play and image recognition, DeepMind Health was launched in February. Strangely for an AI company with no healthcare experience, DeepMind Health’s inaugural project claimed it had nothing to do with AI. Rather, it involved developing Streams, a mobile app, to integrate data and co-ordinate push alerts concerning acute kidney injury, a serious condition affecting up to one in six National Health Service patients.

In April, an investigation by New Scientist revealed the scale of DeepMind’s data hoard — a five-year superset, covering almost every patient passing through Royal Free — as well as the commercial terms: essentially, that there were none. The claimed basis for sharing the data was implied consent for direct clinical care for kidney injury. The problem is that the data set extended well beyond those who will be monitored or treated for this condition: it extended hospital-wide, raising issues about proper compliance with data protection, privacy and medical confidentiality rules. Perhaps even more importantly, engaging with citizens about the deal and exploring the desirability of open, competitive, forward-looking service procurement beyond Google, seemed not to enter consideration.