What do the terms of use and privacy policies say? Who’s paying for the servers and what are they getting out of it? Also, since your data is federated, what happens when it hits a server with any different policies (or who may be in violation of the license of the software itself, but is getting no enforcement)?

If you are not paying for some service, you and your data are almost certainly the product. It was true then, it’s still true today.

Well, that’s something I’ll want to turn off, though all they’ll get from me is random appointment reminders and confirmation codes.