Sending data to Ninja Forms

Hi all,
I’m based in The Netherlands and so is my website / hosting provider.
Due to strict privacy laws I want to make sure that no data that is entered by a website user leaves the European Union.
Now, I understand that all form data entered by users is stored in the WP database (on my hosting provider which is in The Netherlands), or even since 3.0 that data is not stored.
Besides, I am using several forms that email the user and/or admin, I understand that Ninjaforms only relays this information to WordPress and that WordPress uses the host’s email system to send emails. So in that case, no data leaves The Netherlands (assuming a user is in The Netherlands when filling in the form). Correct so far? Is it possible that data entered by the user goes through different web servers (located in other non-EU countries)? My site is https so at least part of it is secured.

Now my main question, is any of the form data stored on Ninjaforms servers (or other servers located outside of my website host)? And if so is there something I can do about it? I am setting up a form asking clients for medical information and want to make sure that this sensitive data does not leave the country.

Another issue altogether is the emailing. I understand WordPress basically uses PHP which is not secure. And that I have to use a plugin (or do manual tweaks) to use SMTP with TLS, to make email secure?

Thanks for your replies.
Patrick