You can use an SSL proxy/snooper to find out. I use Charles to see what is actually happening at that level, you would be surprised (or not) at how much stuff is sent to third parties.
Is repackaging/injecting hard to do?
Thanks!
[0] https://andydavies.me/blog/2019/12/12/capturing-and-decrypti...
That being said I don't think it's nearly as common for certificate pinning to be present as people think- in fact it was deprecated in 2017 because it caused so many problems. Instead things like HSTS and transparency logs are used to prevent damage from malicious issuance of certificates, and organizations can typically override things with their own CA.
If your software is pinned to a specific certificate (even if that certificate is a root CA) your software won't work in many corporate environments. One of the exact reasons mentioned- medical data- is a big driver in this. My company has APIs used by medical companies, and they have to whitelist our service in their firewalls because many of them MITM all traffic to ensure that PHI isn't sent out over an unapproved service by mistake.
Still kinda salty that pinning was deprecated from HTTPS. It wasn't perfect (accidental/malicious pinning was far too easy seeing how it was merely controlled by an HTTP header), but the current alternatives (Certificate Transparency, CAA DNS records) aren't an adequate replacement. Sure Certificate Transparency helps to detect a misused certificate, but it doesn't actively prevent it from being used, and CAA requires that the CA isn't "lying" about the header through a "bug" or otherwise.