After reading the issues 8692 and 9027 it seems that push messages are first sent via the Rocket.Chat gateway and then sent to the clients via Google/Apple. From a data protection point of view, the question now arises whether the messages are sent in plain text or encrypted and whether the connection itself is encrypted.
nothing is encrypted at the moment, except TLS of course.
For android it would be possible to encrypt the message on the server and decrypt it on the client, on iOS it might work with UNNotificationServiceExtension