“[Curaleaf] is involved in an illicit scheme whereby it has surreptitiously integrated code into its website that discloses protected health information to third-party marketers and data brokers—which ...