I think caching people's sensitive medical history in a way that is publicly accessible is worth calling out; especially as it could be trivially fixed to maintain privacy.

True, it definitely shouldn't be accessible to others.

caching is temporary storage, and as shown elsewhere, they're serving up the site on http with other user's data visible through guessing.