A private medical company’s data breaches may have involved the personal information of up to 10,000 patients, according to an Information Commissioner’s Office report, leaked to the BBC.