BGI Group could be violating patient data