When you use 23andMe to explore your DNA, you also entrust us with important and personal information about you.
Securing and protecting that data is paramount to 23andMe. We’re committed to keeping our customers’ trust and providing a secure place where they can explore their DNA, knowing their privacy is protected. That starts with giving our customers a choice in whether their data is shared. We also want our customers to clearly understand how their data might be used if they choose to share it, and by whom.
This post, and the embedded video, is the first in a series of articles intended to give you an overview of how 23andMe protects and secures its customers’ data. We encourage you to learn even more by reviewing our privacy and security policies.
At 23andMe, we like to say that privacy is in our DNA. It’s part of everything we do, and in creating policies around privacy and security, we are guided by three fundamental principles:
- Meaningful & Informed Choice: You decide how your information is used and with whom it is shared.
- Setting the Standard for Strong Data Security: Genetic information deserves the highest level of security.
- Privacy & Transparency by Design: Protecting customer privacy is about more than just creating policies, it has to be baked into everything you do. Being clear and transparent about these policies is vital for customers to understand how their data is handled and protected.
Meaningful & Informed Choice
We start with choice because it gives our customers control over whether they share or not, and with whom. Customers control their data and choose how it is used.
23andMe customers have the choice of whether or not they want to participate — and have their de-identified data used — in our innovative research into conditions like Parkinson’s disease and cancer. They choose whether they want to connect with genetic relatives through our DNA Relatives tool, or whether they want to see their health reports. They can choose to have the lab biobank their saliva sample or discard it after it is tested. A customer can always download their data, close their account, have their sample discarded, and data deleted at any time.
All this starts at the beginning when a customer first registers. Customers get to decide what they want to share and what they want to see when they begin to explore their genetics using 23andMe. Customers can also change what they share at any time.
The impact of each choice has to be made clear. That’s why we say “meaningful choice”, because we want to ensure that customers understand what sharing means and that they are in control.
So, for example, 23andMe calls out the possibility of learning unexpected information when opting in to participate in DNA Relatives. 23andMe reminds customers before they elect to view their health reports, that while they might learn information they can use for their health, they might learn also something unexpected. Customers can download their data and share it with third parties, but they are warned about the possible consequences of exercising that choice as well. It’s their decision. Or if they change their minds, they can opt-out of sharing at any time. It’s up to them.
And it’s important to understand, there are certain types of sharing we just never do: We don’t share genetic and self-reported data with employers or insurance companies, or third-party marketers.
What about 23andMe’s research?
Participating in 23andMe’s research is optional, but a lot of customers — more than 80 percent — opt-in because of the potential this new kind of research has to uncover insights into disease and new treatments. Most of our customers want to participate in this kind of research. It has already led to the publication of more than 150 papers and powers ongoing studies into depression, Parkinson’s disease, IBD, and fertility. When we make a new finding or publish a paper, we share that information with our customers via blog posts, email, and our Research overview dashboard where customers can see what publications they have contributed to if they’ve consented to research. Most of our customers participate because they want to power the kind of research that could lead to the discovery of new treatments or cures for conditions that affect them or someone they love.
We’ll have a separate post that goes into more detail about our research program, but if you choose to participate in research here’s what happens with your data:
First, 23andMe de-identifies your genetic data. That means that any personally identifiable information — such as your name, email, and shipping address — are stripped from your genetic information. That means if you opt into research this de-identified data is pooled together with a bigger set of de-identified data from other research participants. Second, access to our research environment is restricted to a select group of authorized personnel. In addition, our scientists look at the data set as a whole, reducing any risk of participant re-identification. You don’t have to participate in research if you don’t want to. Regardless of your participation in 23andMe Research, 23andMe never uses your genetic or individual-level data or shares it without your consent. Those who do opt-in to participate can decide to opt-out at any time. All the research we do is also overseen by an external independent third-party ethical review board (an “IRB”).
See more about our research here, including the more than 150 papers we’ve published.
Setting the Standard for Strong Data Security
23andMe employs software, hardware, and physical security measures to protect our customers’ data. Our customer’s personally identifiable information is stored separately from genetic data, and with the leading industry standards for security.
We’re proud of what we are doing to protect our customers’ data. That work is being recognized. For example, after an extensive security audit, our information security management system received certification under the recognized ISO/IEC 27001:2013 standard. Some of the protections we have in place include:
- the encryption of all sensitive information
- limits on access to information based on job function and role
- multi-factor authentication
- strict least-privileged authorization policies
There are many layers to 23andMe robust security systems, but one of the most important is being ever-vigilant. That means having a top-notch security team and keeping employees up-to-date in their security training. It also means conducting ongoing third-party security audits and assessments to ensure we never let our guard down.
The intent is to create a secure place for our customers to explore their DNA because without security, you can’t have privacy.
Privacy & Transparency by Design
Protecting customers’ privacy is about more than just creating policies. It is baked into everything we do.
Since 23andMe’s founding, the privacy of our customers’ data has been central to what we do. We strive to be transparent so that customers clearly understand how their data is handled. That meant very early on engaging with ethicists, and critics of direct-to-consumer testing. In creating an entirely new research model, 23andMe voluntarily approached a third-party institutional review board (IRB) to ensure our research participants provided informed consent. That requires that we present to customers both the benefits, and risks, of participating in research.
As a pioneer in direct-to-consumer genetic testing, 23andMe created what are now industry standards for handling customers’ genetic information, and obtaining consent. All of the industry-wide best practices for consumer genetic testing services published in July 2018 were already part of 23andMe’s bedrock principles. It’s why 23andMe was the first consumer genetic testing company to publish a “transparency report.” The report records all requests we’ve ever received from law enforcement for individual customer information.
23andMe has been a pioneer for privacy in genetic testing. We will continue to lead the way to keep the privacy and security of your genetic information paramount.
