HIPAA does not apply to as many entities as it probably should. These services likely avoid it by considering themselves wellness services, rather than healthcare.
I think this is the real answer. And when new tech is in a legal gray zone you go with what makes you money now, not what could be a legal battle later.
It's not. Anywhere. But the how and why it is illegal is not yet settled. It's new enough that an "entrepreneur" can throw up a bullshit smokescreen, make a pile of money, and scuttle them away before the world figures out how to apply the law correctly.