I came across this reporting from The Markup about Facebook collecting personal health information inside password-protected hospital websites.
When The Markup clicked the “Finish Booking” button on a Scripps Memorial
Hospital doctor’s page, the pixel sent Facebook not just the name of the
doctor and her field of medicine but also the first name, last name, email
address, phone number, zip code, and city of residence we entered into the
booking form.