Privacy activists ask if pharma firm is truly only getting publicly available information, decry lack of transparency and fear what will happen if records are de-anonymized