Some places delete things, and you'd think being medically related they should have a data retention policy.

The two reasons are they're a 'never delete anything's type of place that wants to hold onto everthing 'just in case'. The most organised version of this is they can still use your data to build a profile of their future ideal customer, even if you're not opted in.

The other option, and maybe more likely since they had a breach, is they're so disorganised with their customer data they don't know what to do with it.

Especially given they're 'direct to consumer' instead of 'business to business', even in the medical field. That's why Ashley Maddison had that massive breach years ago. Even though they were a dating website specifically for affairs, they weren't obligated to have good security because they dealt with individual's data instead of other businesses