Here’s what kind of data genetics testing companies can share

It’s natural to want to scratch at the itch of identity—and these days you can, for about $99. Mail a little tube full of spit, or a cheek swab, to a laboratory, and they’ll tell you about who you are on a genetic level. Companies like Living DNA, AncestryDNA, and 23andMe offer this service: a chance to learn more about your ethnicity and ancestry.

But in a time of the Facebook and Cambridge Analytica scandal, other data breaches, and the GDPR, it’s also natural to wonder: What happens when I share my genetic information—a biological sample—with companies?

Here’s the short answer: With the three companies we spoke with, none of them will share your genetic data with others for research purposes unless you explicitly opt in, and even then, that data will be de-identified—meaning any outside organization that sees it, in any form, won’t know it came from you. And in all cases, if you are an existing customer, you can contact the company and ask them to delete your account, your genetic data, and even throw out the sample you mailed them.

Curious to know more about each company—what they share with others, and how to delete your data? Here’s a breakdown.

Living DNA

Living DNA, a company based in Frome, England, offers a genetics testing service that they advertise as highly detailed while at the same time putting an emphasis on privacy. Of the three companies we spoke with, it is the only one that does not share research data with at least one separate, for-profit company.

“We do not sell your data,” says David Nicholson, Living DNA’s cofounder. “We do not work with pharmaceutical companies.”

Customers can choose to opt into a research project run by the company, though, and if they do, their data could be included in it. In that case, the information would be de-identified and aggregated with other information from other people. That investigation is focused on “mapping of the world DNA” and involves “working with academic institutions,” Nicholson says. Any customer who opts into that research can subsequently choose to remove themselves from future study later, but data that the company has already folded into the research cannot be extracted. Anyone who wants to know more about this study can read more here.

Living DNA is a for-profit company (like the others in this story), so their page describing their research does contain this disclaimer: “This may result in patents and other intellectual property for Living DNA.”

Like other companies, Living DNA says that they will erase all the data they have, including the physical sample you sent them. “You have full rights to destroy all info that we hold upon you, including all your genetic data,” Nicholson says. The only exceptions to this are the internal financial records Living DNA has—they can’t just delete the fact that someone paid them for a test.

Nicholson also notes that while the laboratory they work with only sees DNA samples with a barcode on them, and not customers’ names or other information, the lab does keep the records they need to for regulatory reasons. “For some parts of the lab process, there is an aggregative bit of information that’s needed as part of our regulatory approval,” he says. “We have to actually prove that each sample has been run accurately.”

If you are a customer of Living DNA, and you want them to delete everything they have on you that they are capable of erasing, email privacy@livingdna.com or help@livingdna.com. Nicholson says that in the future customers will be able to do this through their account settings.

AncestryDNA

In its privacy policy, Ancestry says they value transparency, simplicity, and control. Anyone who has had their ethnicity tested through them (and it’s a service that I personally have tried) can have their account and genetic data deleted, and their physical DNA sample as well.

Like Living DNA, Ancestry conducts research with the genetic information it has, but only for customers who have explicitly opted into participating in it. The information they share with their collaborators is de-identified. Of the organizations they work with, one is a separate, for-profit company: Calico Life Sciences LLC, which according to a statement, focuses on “on longevity research and therapeutics.”

Customers can opt-out of the research if they’ve previously opted in, but any information that’s already been shared with their partners can’t be unshared. (And as always, that genetic info is anonymized.)

Ancestry also owns other brands, like newspapers.com, so someone who signs up for Ancestry DNA could receive emails advertising those products. Finally, an Ancestry spokesperson says that in the past, they have worked with other vendors to market products to customers. That means that an Ancestry user could receive an email from the company with an offer for a product that involves a third-party company, but the spokesperson says they don’t currently make those types of offers now. If you wanted something like your family tree on a mug, they worked with a third-party to make that happen.

In short, the Ancestry spokesperson says that they don’t sell data (like a customer list) for marketing purposes, but they do use third parties to help them do their own marketing, like hawking their newspaper.com-type services.

If you are an Ancestry customer and want your data deleted, and your DNA sample thrown out, you can do so by navigating to this address.

23andMe

Each person has 23 pairs of chromosomes in their cells, a fact that gives 23andMe its name. When someone signs up for a genetic test through the company, they can choose whether to have them hold onto their sample if, in the future, 23andMe has more services to offer and thus can re-test the sample. Someone who chooses to have their sample bio-banked can later change their mind and have it discarded.

Like with the other companies, customers can opt into research or not. The privacy officer for 23andMe, Kate Black, says that about 80 percent of their customers do opt-in, and that when they do, their de-identified data is shared with their partners in an aggregated way. “For example,” Black says, “if one of our partners was interested in understanding more about Parkinson’s, we would be able to tell them that about 30 percent of the individuals in our database have a specific gene associated with Parkinson’s.”

In addition, 23andMe customers can choose to have their data shared on a more specific level—an option called the “individual data sharing consent.” That would include genetic information about a specific person, but the person would not be identified by name nor would the researchers see any contact information for them.

Someone who opts into being a part of research for 23andMe, on either level, and later opts out, can’t have what’s already shared with outsiders removed (the same is true with the other two companies). But Black says that if someone does say they no longer want to be a part of the research, the company will stop sharing their data with their partners 30 days from when that request is made.

If you want to know more about the organizations that 23andMe shares data with, this page lists some of them, which include the University of Chicago, and the Lupus Research Institute. Some of the organizations they work with are for-profit, like Pfizer, but 23andMe does not publicly name all of them. “We don’t make a full list available, but the information on the website is completely representative,” Black says.

In short: if you sign up for 23andMe and don’t like the idea of your data—in any form—being shared with companies like Biogen or Pfizer, simply do not consent to that option. It’s not required.

Anyone who wants to delete the information that 23andMe has can do so through the “23andMe Data” section in their account settings, and can read their full privacy policy here.