• 23andMe is facing a financial crisis and may be sold or privatized, putting the genetic information of more than 15 million people at risk.

• The Company may sell your data if a purchase occurs, as stated in its privacy policy, and the data is not protected by HIPAA.

• You still have time to download and delete your data via your web browser or app.

23andMe, the DNA genetic testing and ancestry company, is facing a financial crisis. There are talks of a potential sale, and CEO Anne Wojcicki seems undecided about her next move. What happens to your genetic information if the company is sold?

What we know so far

The company has a deadline to meet: If 23andMe doesn’t raise its stock price above $1 by November 4, the company will be delisted, making it likely that the company will either be sold or taken privately. This crisis comes after concerns about the company’s financial stability, recent privacy breachesand changes in leadership.

Data sent to 23andMe is not protected by HIPAA

Unfortunately, unlike your doctor’s office, 23andMes data is not protected by the Health Insurance Portability and Accountability Act (HIPAA), which is a US federal law that establishes privacy and data security to protect sensitive medical information. This means that healthcare providers must follow strict rules to protect medical data, but companies like 23andMe are not legally required to do so. Although genetic companies are still required to comply with other privacy laws, such as the Federal Trade Commission (FTC) Act, they are not subject to the strict scrutiny that doctors and hospitals are.

23andMe may sell your data

What is worrying is that 23andMes Privacy Policy states that it has permission to sell customer data in the event of a merger or acquisition. So if it ends up selling, guess what? Your data is gone, along with everything else.

23andMe currently offers you the option to opt out of research and advertising purposes. The company also says it does not knowingly share personal information with public databases, insurance companies, employers or law enforcement unless a search warrant, valid court order or subpoena is involved . However, if the company sells, there is no guarantee that the new owners will follow the same policies.

Who bought your DNA data?

DNA data is unique to you, not only can it identify you, but it can also be used to identify your relatives, predict the likelihood of certain diseases, and find out your ancestral history going back several generations. So while the data and genetic research has an enormous number of benefitsit also raises ethical concerns about misuse.

So who would want to buy all this information? Insurance companies, pharmaceutical firms and biomedical research firms are the most obvious candidates, although they are not alone. For example, insurers might want genetic data to see how likely individuals are to develop certain diseases, which could influence life or health insurance premiums. Several countries, including the US, have banned genetic discrimination in employment and health insurance. However, it doesn’t extend to other forms of insurance, and remember, just because something is prohibited doesn’t mean it never happens.

Can you delete your data?

If all of this makes you uneasy, you’re certainly not alone. The good news is that you can delete your data.

To delete your data from 23 and mesign in to your account in a browser or app and go to “Settings” via the gear icon:

Scroll down to the Clear data option. If you want to download the data before deleting it, select “Access data”:

Confirm your date of birth and click “Confirm”:

If you want a copy of your genetic data for your records, be sure to download it from your settings before hitting delete.

Once you confirm the deletion, 23andMe will begin the process. The company will even destroy your physical DNA sample if you initially chose to save it. Just know that once your data is gone, your account will be gone forever too.

There is big money in genetic data, and consumers should be aware. Whether or not it’s a worthwhile risk to give your genetic data to any company is still up for debate. I know I won’t be.