The agreement states that users of Telehealth Services coordinated through 23andMe are subject to a separate Medical Record Privacy Notice governing medical information, distinct from this general Privacy Statement.
This analysis describes what 23andMe's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that Telehealth users operate under a layered notice architecture, where medical information is governed by a separate document not fully incorporated into this Privacy Statement. Compliance assessment of medical data handling requires review of both documents.
Interpretive note: The document does not clarify whether 23andMe acts as a covered entity, business associate, or data controller in the Telehealth context, which affects the applicable regulatory framework and compliance obligations.
Previous version had empty excerpt; current version now provides detailed language specifying that telehealth involves licensed healthcare providers and references separate Medical Record Privacy Notice.
View full change record →Under this provision, users who access Telehealth Services through 23andMe have their medical information governed by a separate Medical Record Privacy Notice, not solely by this Privacy Statement. Users should review both documents to understand how their genetic and medical information are each handled.
How other platforms handle this
When you use them, we'll validate your request by verifying your identity (for example, by confirming that you're signed in to your Google Account).
Client will not... (ii) interfere with any independent efforts by Plaid to provide End User notice or obtain End User consent
Not be Discriminated Against by us for exercising your privacy rights.
"Should you choose to receive Telehealth Services coordinated through 23andMe, with clinical services provided through licensed healthcare providers, there is a separate Medical Record Privacy Notice that describes how your medical information is used, disclosed, and maintained.Excerpt from 23andMe's Privacy Statement
(1) REGULATORY LANDSCAPE: This provision engages HIPAA Privacy Rule requirements as applied to medical records maintained by or on behalf of licensed healthcare providers coordinating Telehealth services.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that Telehealth users operate under a layered notice architecture, where medical information is governed by a separate document not fully incorporated into this Privacy Statement. Compliance assessment of medical data handling requires review of both documents.
Under this provision, users who access Telehealth Services through 23andMe have their medical information governed by a separate Medical Record Privacy Notice, not solely by this Privacy Statement. Users should review both documents to understand how their genetic and medical information are each handled.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by 23andMe.