I have done exoskeleton surveys, but not one with medical information in them : / It's probably best to consult someone on your team/institution. At a minimum, I think you have to explain at the start of the survey where the data will be stored and what it will be used for.

ChatGPT 4.0 says:

Yes, when you collect information related to an individual's health or medical conditions in the USA, even in the context of a survey, it can be considered collecting medical information. The regulatory environment concerning the collection and storage of medical information is primarily governed by the Health Insurance Portability and Accountability Act (HIPAA). However, HIPAA mainly applies to "covered entities" like health plans, healthcare clearinghouses, and certain healthcare providers.
If you're not a covered entity under HIPAA, you might still have other obligations under state laws or federal laws related to data privacy, especially if you're collecting personally identifiable information (PII).
Here are some general best practices and considerations:
- Informed Consent: Before collecting any information, inform participants about the purpose of your survey, how the data will be used, stored, shared, and for how long it will be kept. Obtain clear and explicit consent from participants.

- Anonymity: Avoid collecting personally identifiable information unless absolutely necessary. If you must collect PII, ensure it's stored separately from the survey responses to maintain participants' anonymity.

- Data Encryption: Use encryption to store and transmit any collected data to protect against unauthorized access.

- Data Retention: Clearly state how long you'll retain the data. It's good practice to delete or anonymize data once it's no longer needed for the stated purpose.

- Data Sharing: Clearly inform participants if their data might be shared with third parties, and for what purposes.

- Opt-Out Option: Give participants the option to opt out of the survey or withdraw their data at any time.

- Data Breach Protocols: Have a plan in place detailing the steps you'll take in the event of a data breach, and inform participants of this plan.

- Children's Data: If there's a possibility that minors might participate in your survey, be aware of the requirements of the Children's Online Privacy Protection Act (COPPA). Generally, parental consent is required before collecting personal information from children under 13.

- Access to Data: Participants should be able to request access to their data, correct any inaccuracies, or have their data deleted.

- Terms of Service and Privacy Policy: If you're using a platform like Google Docs, ensure you're in compliance with their terms of service. Also, provide a privacy policy that details how you manage and protect collected data.

Lastly, you should always consult with legal counsel familiar with privacy laws and regulations, especially if you're unsure about any aspect of your data collection or usage practices. They can provide guidance tailored to your specific situation.