There are a few counter-arguments to that. First, it's impossible to determine that the source on GitHub is the same as what is deployed to a server. Additionally, having to locally debug any given site in order to trace whether or not information is being transmitted is an unrealistic expectation.

I trust that your intentions are in the right place, just that when it comes to medical-related things it's worthwhile to err on the side of caution. If some information is not being used, it's best not to ask for it in the first place.