Enforced policies? I realize there is probably not a good way to judge this but I have become skeptical to most big business and their adherance to 'policies'.

Reputational risk is too high for this. And medical ad targetting is being regulated in many countries.

I don't think reputational risk applies much to big companies. From Equifax through Facebook and yes, Google - lots of companies have done things in the past years that should have killed or crippled them, and yet they're still chugging along, none worse for the wear.