In the United States, the main statute governing the use of health care information is HIPAA, the Health Insurance Portability and Accountability Act.
HIPAA and its related statutes and regulations detail what you can and can't do with medical information. You can't always collect it; if you do, you can't always share it, and you can't always delete it.
This is a complex field of law and it's easy to screw up in a way that would cause big, serious, company-destroying, job-ending problems for everyone involved.
To put this another way: this is absolutely, positively, not something you want to get advice on from strangers on the internet. You don't just need a lawyer; you need a HIPAA specialist--or the equivalent in whatever other countries you plan to operate in--before you push anything out to real-life patients, especially children.