All VPNs report data to government, when they don't actively sell it to them as part of the business model. I dealt for years with medical data and the first rule was to never use an off the shelf VPN...