What they currently do with the fitness data they collect is probably a pretty good guidepost for what they'll continue to do with fitness data they collect.
And this is why you have to carefully read privacy policies. Pebble had a clause in theirs saying they could sell any personal data about you to anyone, either as part of a company acquisition or for any other reason. Pebble got bought out by Fitbit. If that data is part of Fitbit's sale then Google will now have all data Pebble ever collected on anyone (which was, at least potentially, a lot).
Now, that is for data that has no special legal protections. Whereas medical data is, for good reasons, subject to pretty heavy handed laws. Differing quite dramatically across all the diverse jurisdictions Google runs in. Sure, I have no clue what my employer's grand plan is here, but it will surprise me very strongly if medical data starts finding its way to established products. And note this is "medical data" according to the conservative common denominator across all the jurisdictions Google has to care about.
It's just as likely they want to use fitbit brand to set the bar for android wearable portfolio, like they do with the Pixel for phones, than harvesting your daily steps for targeted advertising.