Telehealth platform disclosed users' "most private" health info and locked consumers into subscriptions, regulators allege.