NHS England said no company involved in the FDP would be able to access health and care data without the explicit permission of the NHS.

…

Earlier this year, one official likened it to using Microsoft Word online. The cloud has access to that Word document, but the user would not expect Microsoft to be looking at that document, they said.

Oh good - administrative controls, rather than actual technical ones, “preventing” misuse/abuse of sensitive data. What could possibly go wrong?