Consider implementing privacy check into the permission check

[sixcare]

Could save us some logic on the API endpoint functions

[sixcare]

#424