San FranciscoPost-bankruptcy 23andMe merges DNA with medical records.
The company acquired from bankruptcy is launching an AI-generated Health Summary combining genome data with imported medical records via HealthEx.
The new product merges 2 of the most sensitive data categories; the consent users gave the pre-bankruptcy company may not cover the expanded use.
Sources: STAT
WHY DNA IS DIFFERENT
A leaked password can be rotated; a leaked genome cannot. It also implicates relatives who never consented — a sibling shares ~50% of your sequence, a first cousin ~12.5%. One person's submission discloses a probabilistic dossier on an entire family tree.
THE GINA GAP
The Genetic Information Nondiscrimination Act (2008) bars health insurers and employers from using genetic data — but explicitly excludes life insurance, disability insurance, and long-term care insurance. The three policies most sensitive to genetic risk are the three GINA does not touch.
THE BANKRUPTCY LOOPHOLE
Consent given to one corporate entity does not bind a successor in bankruptcy the same way. Under Section 363 of the US Bankruptcy Code, assets — including customer data — can be sold to satisfy creditors. Courts have repeatedly allowed data transfers that violate the original privacy policy, with the FTC negotiating only partial restrictions.
THE TOYSMART PRECEDENT
When toy retailer Toysmart went bankrupt in 2000, its attempt to sell customer data triggered an FTC settlement that birthed the modern doctrine: a buyer must honor the original privacy policy or get explicit re-consent. The doctrine has been eroded steadily since — most data sales now proceed with notice rather than consent.
WHY AI SUMMARIES CHANGE THE STAKES
Raw genome data is unreadable to non-specialists. An AI-generated health narrative converts the same data into actionable predictions — disease risk percentages, drug response, ancestry inference — that an insurer's underwriting model or an employer's wellness program can consume directly. The interpretation layer is where genomic data becomes economically dangerous.
THE FAMILIAL DRAGNET
Investigators identified the Golden State Killer in 2018 by uploading crime-scene DNA to GEDmatch and finding distant cousins. Roughly 60% of Americans of European descent can already be identified through a third-cousin match in existing databases, even if they never submitted DNA themselves. The threshold for universal identifiability is a database covering ~2% of a population.