Google’s AI subsidiary DeepMind has come under fire again for its partnership with the UK’s National Health Service (NHS). According to a leaked letter from the government’s top data advisor, the company’s deal to train a new medical app using health data from 1.6 million NHS patients was conducted on an "inappropriate legal basis.”

The letter, sent by the UK’s National Data Guardian (NDG), was published by Sky News this week, and will inform an ongoing investigation into the legality of the deal between the NHS and DeepMind. This investigation is currently being carried out by the UK government's data watchdog, the Information Commissioner's Office (ICO), with the ICO telling Sky News that it is “close to conclusion.”

The issue being debated is whether or not DeepMind had legal authority to handle the personally identifiable medical records of 1.6 million UK patients without asking each individual’s permission. UK law says such permission can be waived if the data is being used to provide “direct care,” which DeepMind argues it was doing. But the NDG says the company was using this information not to provide care, but to train and test the medical app it’s been building for the NHS.

The app, named Streams, is used by doctors and nurses to identify patients at risk from acute kidney injury or AKI. This condition is linked to 40,000 deaths a year in the UK, with the NHS estimating that a quarter of these are preventable. Streams has finished its testing phase and is currently in use in a number of hospitals run by London’s Royal Free NHS Trust. Both DeepMind and the Royal Free says feedback has been extremely positive, and neither the NDG nor the ICO are investigating its current deployment.

In a statement given to The Verge, the Royal Free said that the project was “one of the first of its kind in the NHS” and that “there are always lessons we can learn from pioneering work.” A spokesperson from DeepMind stressed that the data used to train the Streams app “has never been used for commercial purposes or combined with Google products, services or ads - and never will be.”

Update May 16th, 5AM ET: Updated with additional comment from DeepMind and the Royal Free.