Telehealth firm Cerebral fined $7 million over “careless” privacy violations