23andMe Privacy Statement

This Privacy Statement, published by 23andMe Research Institute, governs the collection, use, storage, processing, and transfer of personal information across all 23andMe websites, the mobile app, and related services, including genetic testing and optional telehealth services for which a separate Medical Record Privacy Notice applies. The agreement states that 23andMe collects genetic information, self-reported health and demographic data, web and app usage data, device identifiers, and payment information; the terms authorize use of this data for product improvement, research (with separate consent), and sharing with service providers, business partners, and successors in interest. The policy discloses that genetic and health data contributed to Research may be shared with third-party research partners in de-identified or aggregated form, and that in a business transfer scenario such as a merger or bankruptcy, personal and genetic data may be transferred to an acquiring entity, creating operationally distinct exposure given the sensitivity of genomic information; the agreement asserts that users retain certain deletion rights but notes that data already incorporated into research or shared with third parties prior to deletion may not be fully recoverable. This document engages GDPR for EU/EEA users, CCPA and California Genetic Information Privacy Act for California residents, HIPAA considerations arise at the margins given the health-related nature of data though 23andMe is not a covered entity for its primary DTC service, and the FTC has authority over unfair or deceptive privacy practices applicable to this document. Given 23andMe's pending bankruptcy proceedings and the sensitivity of genomic data held at scale, compliance teams should evaluate data transfer obligations, successor entity consent requirements, and the adequacy of de-identification standards used prior to third-party research sharing.