10 ms·

I also regret giving them my data. At work, we bought one of their first kits. We were doing genetics research and my boss got some for Christmas and gifted the

by nextos 3y ago

I also regret giving them my data. At work, we bought one of their first kits. We were doing genetics research and my boss got some for Christmas and gifted them to everyone in the group. Technically, 23andme is also pretty bad, which is hard to understand given that they employ very competent people and they are well funded. Seems like a space ripe for disruption. Their biggest competitor, DecodeME, never really aimed at B2C and just used customers to harvest data, then sold to a pharma. 23andme genetic risk scores are mediocre at best. Promethease makes better predictions. For example, in my case I have a high risk MHC allele, which is both trivial to predict and well understood since the 1980s. Never popped up on their reports, yet it is the first item you see if you feed your 23andme raw data to Promethease, or if you analyze the data yourself.

lawlessone 3y ago
> yet it is the first item you see if you feed your 23andme raw data to Promethease, or if you analyze the data yourself. If you had not mentioned this i would have thought they weren't testing people at all.
ezfe 3y ago
Have you deleted your data? They provide a clear button to do so...
- nextos 3y ago
  I eventually did, and also opted out from trials and sharing with pharmas prior to that.
- npongratz 3y ago
  Do you trust that your data, that they fully control on their system, is actually deleted? Including their backups that reside elsewhere? I just assume they set your record's "delete" field to "true" when you press that button. No way for us plebs to be certain about what they do.
  - gwright 3y ago
    I'd be surprised to hear about anybody deleting records on backup systems (i.e., backups that exist for disaster recovery purposes). It would be pretty difficult to do that in a commercially viable way (but I'm open to hearing about some creative ideas).
    - bombcar 3y ago
      There are methods of doing it, but it is complex. Basically you either have hot backups you can delete from (this is bad for obvious reasons), or your backups expire in a given time (this is most common), or you have each record encrypted with an encryption key that is saved in other ways so you only have to destroy those to make the data irretrievable. Of course, that system has to be backed up, etc, etc.
    - plagiarist 3y ago
      If user data in backups is encrypted with a key kept in warm/hot storage, you can delete the key and effectively delete data in cold storage because it is unrecoverable. This obviously must be per-user keys and set up in advance so I doubt they have it available, but that's one potential method.
      - starttoaster 3y ago
        Where do the keys get backed up to? If nowhere: If the key system fails, do you just accept the loss of _all_ of your customer data? If somewhere: by what mechanism do you delete the key in a backup?
        caconym_ 3y ago
        The keys dataset is going to be much smaller than everything else, and possibly immutable per customer. This in principle makes it much simpler and cheaper to handle, so it's easy to imagine how---depending on the scales and technologies involved---one could isolate it and achieve the desired redundancies and retention periods in ways that would be impractical with the full customer dataset.
- chaostheory 3y ago
  23andme doesn’t delete your data. By law, they have to keep it for several more years before deletion
  - ezfe 3y ago
    So you're saying they are lying? > Delete your 23andMe account and personal data, including your personal information, genetic data, and other information collected through your use of the Service. > Upon receiving your confirmation we will process your request to delete your data, and you will no longer be able to sign-in to your account. Please keep in mind it may take up to 30 days to fulfill your request. What's your basis for your claim?
    - chaostheory 3y ago
      https://www.bnnbloomberg.ca/deleting-your-online-dna-data-is-brutally-difficult-1.1093531.amp.html https://www.bnnbloomberg.ca/deleting-your-online-dna-data-is... “The federal Clinical Laboratory Improvement Amendments (CLIA) of 1988 and California laboratory regulations require the lab store your de-identified genotyping test results and to keep a minimal amount of test result or analysis information,” an email from 23andMe said. “Our laboratory will retain your genetic information and a randomized identifier on their secure servers for a limited period of time, 10 years pursuant to CLIA regulations.” I was friends with a former exec. At a party I remember him callously mentioning that you can’t delete data off their platform. I inquired a bit more and he pointed me to one of the laws referenced above 23andme is not lying in a legal sense. They seem to be deceptive though
      - ezfe 3y ago
        Thank you for filling in the gaps, So they delete everything they have under your name and the lab retains a copy of your sample and the sample results? On paper, this is sufficient because a sample + results is no more useful to someone nefarious then a piece of hair found on the ground... It only becomes a problem if they fail to delete any identifying information that could connect it to you...
- anjel 3y ago
  Facebook has this same feature!
murphyslab 3y ago
This seems to be more a consequence of being FDA regulated. Promethease is just providing a lookup service, cross-referencing a genotype file with SNPedia, which offers no direct prediction claims IIRC. https://www.snpedia.com/ https://www.snpedia.com/
tremere 3y ago
From a decision-making standpoint it seems difficult to argue that you made the wrong choice. At the time when the $99 kits were ubiquitous, 23andme seemed like a solid, reputable company. Back then, few people had the mindset of, "if they own my data, they own me." But we're starting to see it take hold.
- fsckboy 3y ago
  From a decision-making standpoint it seems difficult to argue that you made the wrong choice. At the time when the $99 kits were ubiquitous, 23andme seemed like a solid, reputable company. I am interested in genetics, but I didn't trust google, and I trusted a google spouse company even less (it's like John Lennon's Google, and Yoko Ono's 23andMe, when I didn't trust Lennon to begin with) and my data hasn't been spilled. Half of you are thinking of all sorts of epithets to call me, but fact is, I was right about 23andMe. From a decision-making standpoint, slam dunk for me and anybody who listened to me. It was not an unusual position to take. "What. Could. Go. Wrong?" (I'm fully aware they probably already have my data from numerous blood tests I've taken from normal medical checkups, etc. but what could I have done about that?)
  - wayfinder 3y ago
    I don’t know. I trust Google the most. They’re basically an aimless company with the strongest technically secure infrastructure I’ve seen with the strongest privacy policies implemented (just read about their infra). I think people give in to what people say versus say what they do. Just because Google runs an ad company doesn’t mean shit. What they’ve done with your data (their “actions”) for the past 25 years means way more (they absolutely do nothing with your data — in fact, they seem to completely waste it). The link between 23andme and Google is tangential at best. Anne Wojcicki and Sergey Brin were married and that’s it, but they are completely two different people. I have no idea how you’d ever consider 23andme a reputable company. Reputation comes from 20+ years of history — your actions, not what you say. 23andme is not even 20 years old yet — how can you trust something that young?
- devjab 3y ago
  I forgot which company I used, but part of their deal was that you had the ability to delete your DNA data. Which I guess would’ve come in handy for a lot of people with 23andme. If you had chosen to do so of course.
autoexec 3y ago
> Seems like a space ripe for disruption. I think there's plenty of room for a new competitor to make money, but you can bet that any similar service is going to be just as bad for people's piracy and security. Nobody is going to collect and store that kind of data without either selling it or being forced to turn it over.

by nextos 3y ago

lawlessone 3y ago

> yet it is the first item you see if you feed your 23andme raw data to Promethease, or if you analyze the data yourself. If you had not mentioned this i would have thought they weren't testing people at all.

ezfe 3y ago

Have you deleted your data? They provide a clear button to do so...

nextos 3y ago
I eventually did, and also opted out from trials and sharing with pharmas prior to that.
npongratz 3y ago
Do you trust that your data, that they fully control on their system, is actually deleted? Including their backups that reside elsewhere? I just assume they set your record's "delete" field to "true" when you press that button. No way for us plebs to be certain about what they do.
- gwright 3y ago
  I'd be surprised to hear about anybody deleting records on backup systems (i.e., backups that exist for disaster recovery purposes). It would be pretty difficult to do that in a commercially viable way (but I'm open to hearing about some creative ideas).
  - bombcar 3y ago
    There are methods of doing it, but it is complex. Basically you either have hot backups you can delete from (this is bad for obvious reasons), or your backups expire in a given time (this is most common), or you have each record encrypted with an encryption key that is saved in other ways so you only have to destroy those to make the data irretrievable. Of course, that system has to be backed up, etc, etc.
  - plagiarist 3y ago
    If user data in backups is encrypted with a key kept in warm/hot storage, you can delete the key and effectively delete data in cold storage because it is unrecoverable. This obviously must be per-user keys and set up in advance so I doubt they have it available, but that's one potential method.
    - starttoaster 3y ago
      Where do the keys get backed up to? If nowhere: If the key system fails, do you just accept the loss of _all_ of your customer data? If somewhere: by what mechanism do you delete the key in a backup?
      - caconym_ 3y ago
        The keys dataset is going to be much smaller than everything else, and possibly immutable per customer. This in principle makes it much simpler and cheaper to handle, so it's easy to imagine how---depending on the scales and technologies involved---one could isolate it and achieve the desired redundancies and retention periods in ways that would be impractical with the full customer dataset.
chaostheory 3y ago
23andme doesn’t delete your data. By law, they have to keep it for several more years before deletion
- ezfe 3y ago
  So you're saying they are lying? > Delete your 23andMe account and personal data, including your personal information, genetic data, and other information collected through your use of the Service. > Upon receiving your confirmation we will process your request to delete your data, and you will no longer be able to sign-in to your account. Please keep in mind it may take up to 30 days to fulfill your request. What's your basis for your claim?
  - chaostheory 3y ago
    https://www.bnnbloomberg.ca/deleting-your-online-dna-data-is-brutally-difficult-1.1093531.amp.html https://www.bnnbloomberg.ca/deleting-your-online-dna-data-is... “The federal Clinical Laboratory Improvement Amendments (CLIA) of 1988 and California laboratory regulations require the lab store your de-identified genotyping test results and to keep a minimal amount of test result or analysis information,” an email from 23andMe said. “Our laboratory will retain your genetic information and a randomized identifier on their secure servers for a limited period of time, 10 years pursuant to CLIA regulations.” I was friends with a former exec. At a party I remember him callously mentioning that you can’t delete data off their platform. I inquired a bit more and he pointed me to one of the laws referenced above 23andme is not lying in a legal sense. They seem to be deceptive though
    - ezfe 3y ago
      Thank you for filling in the gaps, So they delete everything they have under your name and the lab retains a copy of your sample and the sample results? On paper, this is sufficient because a sample + results is no more useful to someone nefarious then a piece of hair found on the ground... It only becomes a problem if they fail to delete any identifying information that could connect it to you...
anjel 3y ago
Facebook has this same feature!

murphyslab 3y ago

This seems to be more a consequence of being FDA regulated. Promethease is just providing a lookup service, cross-referencing a genotype file with SNPedia, which offers no direct prediction claims IIRC. https://www.snpedia.com/ https://www.snpedia.com/

tremere 3y ago

From a decision-making standpoint it seems difficult to argue that you made the wrong choice. At the time when the $99 kits were ubiquitous, 23andme seemed like a solid, reputable company. Back then, few people had the mindset of, "if they own my data, they own me." But we're starting to see it take hold.

fsckboy 3y ago
From a decision-making standpoint it seems difficult to argue that you made the wrong choice. At the time when the $99 kits were ubiquitous, 23andme seemed like a solid, reputable company. I am interested in genetics, but I didn't trust google, and I trusted a google spouse company even less (it's like John Lennon's Google, and Yoko Ono's 23andMe, when I didn't trust Lennon to begin with) and my data hasn't been spilled. Half of you are thinking of all sorts of epithets to call me, but fact is, I was right about 23andMe. From a decision-making standpoint, slam dunk for me and anybody who listened to me. It was not an unusual position to take. "What. Could. Go. Wrong?" (I'm fully aware they probably already have my data from numerous blood tests I've taken from normal medical checkups, etc. but what could I have done about that?)
- wayfinder 3y ago
  I don’t know. I trust Google the most. They’re basically an aimless company with the strongest technically secure infrastructure I’ve seen with the strongest privacy policies implemented (just read about their infra). I think people give in to what people say versus say what they do. Just because Google runs an ad company doesn’t mean shit. What they’ve done with your data (their “actions”) for the past 25 years means way more (they absolutely do nothing with your data — in fact, they seem to completely waste it). The link between 23andme and Google is tangential at best. Anne Wojcicki and Sergey Brin were married and that’s it, but they are completely two different people. I have no idea how you’d ever consider 23andme a reputable company. Reputation comes from 20+ years of history — your actions, not what you say. 23andme is not even 20 years old yet — how can you trust something that young?
devjab 3y ago
I forgot which company I used, but part of their deal was that you had the ability to delete your DNA data. Which I guess would’ve come in handy for a lot of people with 23andme. If you had chosen to do so of course.

autoexec 3y ago

> Seems like a space ripe for disruption. I think there's plenty of room for a new competitor to make money, but you can bet that any similar service is going to be just as bad for people's piracy and security. Nobody is going to collect and store that kind of data without either selling it or being forced to turn it over.