Exclusive: NHS hospitals told to share patient data with US ‘spy-tech’ firm