According to a customer rep, the 3rd party company, LabCorp, that actually processes the genotype testing will keep all the data for up to two years regardless of a deletion request.
"Account Closure
When closing an account, we remove all Genetic Information within your account (or profile) within thirty (30) days of our receipt of your request. As stated in the applicable Consent Document, however, Genetic Information and/or Self-Reported Information that you have previously provided and for which you have given consent to use in 23andWe Research will not be removed from ongoing or completed studies that use the information. Our contracted genotyping laboratory may also retain your Genetic Information as required by local law and we may retain backup copies for a limited period of time pursuant to our data protection policies. In addition, we retain limited Registration Information related to your order history (e.g., name, contact, and transaction data) for accounting and compliance purposes.
In our TOS it states, 'Our contracted genotyping laboratory may also retain your Genetic Information as required by local law and we may retain backup copies for a limited period of time pursuant to our data protection policies.'
What this means is the data file generated from the processing is stored, though the sample is discarded shortly after the processing of the sample is complete (if biostorage is declined). This data file is stored for up to two years. National Genetics Institute (NGI), our contracted laboratory, is required to keep the results of the analysis for up to two years as required by CLIA. Under HIPAA, LabCorp (this includes NGI) is required by law to maintain the privacy of our customers. You can read LabCorp's privacy statement here
EDIT: According to someone who currently works at 23andme, they never delete data - ever. On multiple occassions when I bring data deletion up, there's a puzzled look and a quick denial that they ever delete data regardless of customer requests. Which is accurate if you read the above TOS... they only delete data that ties you to your submitted genotype data:
"however, Genetic Information and/or Self-Reported Information that you have previously provided and for which you have given consent to use in 23andWe Research will not be removed from ongoing or completed studies that use the information"
"Account Closure
When closing an account, we remove all Genetic Information within your account (or profile) within thirty (30) days of our receipt of your request. As stated in the applicable Consent Document, however, Genetic Information and/or Self-Reported Information that you have previously provided and for which you have given consent to use in 23andWe Research will not be removed from ongoing or completed studies that use the information. Our contracted genotyping laboratory may also retain your Genetic Information as required by local law and we may retain backup copies for a limited period of time pursuant to our data protection policies. In addition, we retain limited Registration Information related to your order history (e.g., name, contact, and transaction data) for accounting and compliance purposes.
You are able to read both documents in full at: https://www.23andme.com/about/tos/ https://www.23andme.com/about/privacy/
In our TOS it states, 'Our contracted genotyping laboratory may also retain your Genetic Information as required by local law and we may retain backup copies for a limited period of time pursuant to our data protection policies.'
What this means is the data file generated from the processing is stored, though the sample is discarded shortly after the processing of the sample is complete (if biostorage is declined). This data file is stored for up to two years. National Genetics Institute (NGI), our contracted laboratory, is required to keep the results of the analysis for up to two years as required by CLIA. Under HIPAA, LabCorp (this includes NGI) is required by law to maintain the privacy of our customers. You can read LabCorp's privacy statement here
https://www.labcorp.com/wps/portal/!ut/p/c0/04_SB8K8xLLM9MSS...
EDIT: According to someone who currently works at 23andme, they never delete data - ever. On multiple occassions when I bring data deletion up, there's a puzzled look and a quick denial that they ever delete data regardless of customer requests. Which is accurate if you read the above TOS... they only delete data that ties you to your submitted genotype data:
"however, Genetic Information and/or Self-Reported Information that you have previously provided and for which you have given consent to use in 23andWe Research will not be removed from ongoing or completed studies that use the information"