Medical device?
Its a medical device (AI or not) as it affects patient treatment. That means ISO13485 and CE marking There are so many more risks involved in producing medical products, there is a clear risk based standard that every medical device producer in EU is required to follow. If you are not following this, you are by definition risking patient lives. No idea if google did this.
In terms of data collection and processing:
https://en.wikipedia.org/wiki/General_Data_Protection_Regulation will have real teeth (fines a max of 4% global turnover) when it comes into force next May. Probably one of the main reasons we have been told to leave EU...