Is your genetic data safe? How to protect your DNA information

Everyone wants to keep their health information private and secure. Data breaches at banks, laboratories and genetic testing companies regularly make the news, and genetic testing is now easier to access than ever. This article explains why genetic data needs special protection, what Canadian law says, what to ask a testing company before you buy a test, how Pillcheck protects your data, and what you can do to keep your own account safe.

Why does genetic data need special protection?

Most personal information can be changed after a breach. You can cancel a credit card or reset a password, but you cannot change your DNA. Genetic data can also reveal information about your parents, siblings, children and more distant relatives, who never agreed to be tested.

Even when genetic data is shared without names, it can sometimes be traced back to a person. In a 2018 study, researchers estimated that a genealogy database covering only about 2% of a population would be enough to identify a relative of almost anyone in that population, and from there the person themselves. This is why broad genetic data, such as the raw files produced by ancestry tests, should be shared with care.

What can go wrong? A real example

In 2023, a large direct-to-consumer genetic testing company confirmed a data breach that affected almost 7 million customers worldwide, including almost 320,000 people in Canada. According to a 2025 joint investigation by the Privacy Commissioner of Canada and the UK Information Commissioner:

• The attacker did not break into the company's systems directly. Instead, they used usernames and passwords stolen in earlier breaches of other websites and tried them on the company's login page until some worked, an attack known as credential stuffing.
• Over five months, the attacker got into more than 18,000 customer accounts.
• Through a feature that let customers share information with genetic relatives, those accounts exposed information about millions of other people, including health information, ethnicity, year of birth and location.
• The commissioners found that the company did not have appropriate safeguards for this highly sensitive information and did not report the breach properly.

Two lessons stand out. First, the security of a genetic testing company matters. Second, your own password habits matter: reusing a password from another website was enough to open the door.

What does Canadian law say about genetic testing?

The federal Genetic Non-Discrimination Act became law in 2017, and in 2020 the Supreme Court of Canada upheld it. No one can require you to take a genetic test, or to disclose the results of a genetic test, as a condition of providing goods or services or of entering into a contract, including an insurance contract.

As the Privacy Commissioner of Canada notes, Parliament has made clear that Canadians should not have to choose between potential discrimination and taking a genetic test, especially if the test could improve their health and well-being. Federal and provincial privacy laws also govern how companies collect, use and disclose personal information, including genetic information.

What should you ask a genetic testing company?

The Privacy Commissioner of Canada provides a checklist of questions to ask before you buy a direct-to-consumer genetic test. In essence, a company should only ask for personal information that it needs to deliver the service. Good questions to ask include:

• What is the purpose of the test (health, ancestry, paternity), and is it what you expect?
• What personal information will the company collect in addition to your sample, and how will it process and protect that information?
• With whom does the company propose to share your results, such as researchers, pharmaceutical companies, marketers or affiliated companies? Have you been asked to consent to this voluntarily and in writing? You have the right to refuse such disclosures.
• What happens to your DNA sample after testing?
• Does the company update your results as science changes, and does it charge for updates?

Can pharmacogenetic results be used to identify you?

Ancestry tests analyze hundreds of thousands of genetic markers spread across the whole genome. That breadth is needed to estimate ancestry and find relatives, but it also creates a unique genetic fingerprint for every person tested.

A clinical pharmacogenetic test is very different. Pillcheck analyzes only a defined set of well-established variants in 24 genes involved in how your body responds to medications. This is not enough genetic information to identify you or to find your relatives, and it does not assess your risk of disease.

How does Pillcheck protect your data?

Privacy by Design has been a core principle at GeneYouIn, the company behind Pillcheck, from the start. Our systems were designed to:

• keep different types of data in separate locations, with genetic data stored separately from your personal information;
• apply strong encryption;
• share your results with your health care providers only with your consent;
• require two-factor authentication (2FA) for every customer account, so a stolen password alone is not enough to get into your account.

Your sample is labelled with a unique barcode, so no personal information is on the sample, and the laboratory that analyzes it does not hold your identifying information. Only the drug-response variants on the Pillcheck panel are analyzed; the rest of your DNA is not examined, and the remaining sample is destroyed once testing is complete. We also test and monitor our systems regularly.

Your genes do not change, so your Pillcheck report stays relevant for life. As new guidelines become available, your report is updated free of charge, and Pillcheck notifies you when an updated report is posted to the secure Pillcheck Portal. Each report carries a version identifier, so you and your health care providers can tell which version you are looking at.

How can you protect your own account?

As with any account that holds sensitive health information, stay alert to attempts to get into your Pillcheck account. Phishing emails and text messages can look convincing and may appear to come from a service you use. They try to get you to open an attachment, click a link to a fake website, or send personal information.

• Use a strong, unique password for your Pillcheck account, and never reuse a password from another website. A password manager can help.
• Keep your second factor safe. Pillcheck requires two-factor authentication on every account. Never share a verification code with anyone, including someone who says they are from Pillcheck, and contact us if you receive a code you did not request.
• Don't open unexpected attachments. Your Pillcheck report is available only in the Pillcheck Portal after you log in. It is never sent as an email attachment.
• Go to the portal yourself. Bookmark the Pillcheck Portal login page (portal.pillcheck.net) and use your bookmark instead of links in emails. Check the exact web address before you sign in. A padlock or "https" alone does not prove a website is genuine, because many phishing sites use them too.
• Store downloaded copies securely. If you download your report to share it with your doctor or pharmacist, keep it in a secure place. The portal always has the latest version.
• Contact us if something looks suspicious, for example a message that creates false urgency, threatens immediate consequences, or asks you to email back personal information.

How can Pillcheck help you?

Pharmacogenetic testing helps your doctor and pharmacist choose the medications and doses most likely to work for you, with fewer side effects. Pillcheck combines a simple cheek swab test with a personalized report that you control and can share with your health care providers.

Pillcheck testing is performed in CAP- and COLA-accredited clinical genetic laboratories located in Canada. Pillcheck reports on 24 genes, increasing coverage with new guidelines and drug labels (see the genes tab), and covers 355 medications, which account for over 70% of dispensed prescriptions. The Pillcheck test panel ensures high accuracy for people of non-European and admixed ancestries. Your results last a lifetime, and report updates are free of charge.

Read also: Can I use my ancestry genetic test results to get a Pillcheck report?

Summary

• Genetic data is permanent and can reveal information about your relatives, so it needs special protection.
• A 2023 breach at a consumer genetics company exposed information on almost 7 million people, starting with reused passwords.
• Canada's Genetic Non-Discrimination Act protects you from being required to take or disclose a genetic test.
• Before you buy a test, ask what the company collects, who it shares results with, and what happens to your sample.
• Pillcheck analyzes only a small set of drug-response variants, keeps genetic and personal data separate, destroys the remaining sample after testing, and requires two-factor authentication on every account.
• Protect your own account with a unique password, never share verification codes, and go to the portal through your own bookmark.

Frequently asked questions

Can my employer or insurer require me to share my genetic test results?

No. Under Canada's Genetic Non-Discrimination Act, no one can require you to take a genetic test or disclose your results as a condition of a contract, including an insurance contract, or of providing goods or services.

Can my Pillcheck results be used to find my relatives?

No. Pillcheck analyzes only a small set of variants in genes involved in medication response. This is far too little information to identify you or find relatives, unlike the broad data produced by ancestry tests.

What happens to my DNA sample after testing?

Only the drug-response variants on the Pillcheck panel are analyzed. The rest of your DNA is not examined, and the remaining sample is destroyed once testing is complete.

How is my Pillcheck account protected?

Every Pillcheck Portal account requires two-factor authentication. Besides your password, you need a one-time verification code to sign in, so a stolen or guessed password alone is not enough. Your data is also encrypted, and genetic data is stored separately from your personal information.

Will Pillcheck ever email me my report as an attachment?

No. Your report is available only in the secure Pillcheck Portal after you log in. If you receive an email with an attachment that claims to be your report, don't open it, and contact us.

References

1. Office of the Privacy Commissioner of Canada. PIPEDA Findings #2025-001: Joint investigation into a data breach at 23andMe by the Privacy Commissioner of Canada and the UK Information Commissioner. June 2025. priv.gc.ca
2. Erlich Y, Shor T, Pe'er I, Carmi S. Identity inference of genomic data using long-range familial searches. Science. 2018;362(6415):690-694. doi:10.1126/science.aau4832
3. Genetic Non-Discrimination Act, S.C. 2017, c. 3. laws-lois.justice.gc.ca
4. Reference re Genetic Non-Discrimination Act, 2020 SCC 17.
5. Office of the Privacy Commissioner of Canada. Policy statement on the collection, use and disclosure of genetic test results. priv.gc.ca
6. Office of the Privacy Commissioner of Canada. Direct-to-consumer genetic testing and privacy. priv.gc.ca