One source of data used for medical and pharmaceutical research is anonymized health data, meaning that patient name and other identifying information is removed. A company sells this data to the pharmaceutical industry, after obtaining it from doctors and clinics. This is legal $--$ why?

Because physicians and clinics are giving permission.

The medical research world has state$-$of$-$the$-$art security, and thus no one could obtain the data.

Privacy laws do not apply to a clinic's data

Such anonymnized data does not reveal information that could trace it back to the actual patient.

Once data is colled by doctors, they own the data and not the patients.