The omics of our lives: practices and policies of direct-to-consumer epigenetic and microbiomic testing companies

Abstract

While much attention has gone towards ethical, legal, and social implications of direct-to-consumer genetic testing over the past decades, the rise of new forms of consumer omics has largely escaped scrutiny. In this paper, we analyze the product descriptions, promotional messages, terms of service, and privacy policies of five epigenetic and seven microbiomic testing companies. The advent of such tests online represents a significant shift in consumer omics, from a focus on inherited molecules with genetic tests, to broader interest for information about the lives of individuals, such as chronological and biological age, exposures, and lifestyle. Building on previous literature about direct-to-consumer genetic testing, and taking this shift into account, we identify limitations, gaps and inconsistencies in current practices and policies of the new companies. Best practice standards and regulations applicable across different omic sample and data types is a necessary first step in the promotion of responsible consumer omics.

Keywords:

• epigenetics
• microbiomics
• direct-to-consumer
• data governance
• policy
• scientific validity

Introduction

For the past two decades, private companies have been offering direct-to-consumer genetic testing (DTC-GT) services online. These tests appeal to consumers in that they can be ordered, received, prepared, and reviewed from the comfort of their homes. The most popular genetic tests provide information on ancestry, familial relationships, and health (Gregory 2019; Majumder, Guerrini, and McGuire 2021; Phillips 2016). Recently, companies have also been making forays into more fringe territories such as child-talent, matchmaking, and infidelity. DTC-GT holds a unique position at the intersection of innovation in technology, diagnosis, and test delivery models (Hogarth and Saukko 2017). This unique position has led to considerable media attention as well as studies examining the ethical, legal, and social implications (ELSI) of both the practices of these companies and of their products.

In the editorial of a 2017 special edition of New Genetics and Society on the past, present, and future of direct-to-consumer genomics, Hogarth and Saukko noted that the geneticization of healthcare remained limited and contested. They observed that the utility of genomic markers was increasingly being seen as conditional to the integration of other biological variants and predicted growing attention to other forms of omics. This predicted future has now arrived (Dupras, Beauchamp, and Joly 2020; Dupras and Bunnik 2021). Over the past few years, online DTC companies have emerged offering new types of biological tests that are substantially different than traditional DTC-GT, including DTC epigenetic testing (DTC-ET) and DTC microbiomic testing (DTC-MT). Unlike DTC-GT which looks at stable information about an individual’s family history and genes, these new tests access broader information about the dynamic nature of the lives of individuals (e.g. age, exposures, diet, and lifestyle) and advertise the possibility of effecting and monitoring change over time and thus, improvement in test results. Taking this shift into account, and building on the ELSI of consumer genomics, this paper examines the practices and policies of twelve of these novel epigenetic and microbiomic testing companies, considering limitations, gaps, and inconsistencies as well as how an “omics of our lives” breaks new ground.

Background: the ELSI of consumer genomics

Ethical, legal and social concerns surrounding health-related DTC-GT touch upon principles of transparency, informed consent, non-discrimination, privacy, regulation, and governance, among others. Misgivings have been raised regarding the clinical validity and medical utility of DTC-GT, misleading marketing, and the lack of counseling through a healthcare professional (Caulfield and McGuire 2012; Goldsmith et al. 2013; Hazel and Slobogin 2018; Hennen, Sauter, and Cruyce 2010; Hogarth, Javitt, and Melzer 2008; Saukko 2013; Schleit, Naylor, and Hisama 2019). There are worries that consumers may interpret their test results erroneously, suffer psychological consequences, and/or have inappropriate behavioral responses if they over or under-estimate the significance of results (CMA 2017; Goldsmith et al. 2013; Hawkins and Ho 2012; Hennen, Sauter, and Cruyce 2010; Rafiq et al. 2015). It has also been observed that many DTC-GT companies’ policies do little to advise consumers of the privacy risks associated with genetic information, that there is significant variation in the ways DTC-GT companies treat genetic information, and that few companies have comprehensive and accessible privacy policies (Caulfield and McGuire 2012; Christofides and O’Doherty 2016; Hazel and Slobogin 2018; Hendricks-Sturrup and Lu 2019; Phillips 2017). Concerns have also emerged regarding unconsented research use and/or the for-profit commercialization of genomic data acquired through DTC-GT (Hendricks-Sturrup and Lu 2019; Niemiec, Kalokairinou, and Howard 2017; Thiebes et al. 2020).

From a regulatory perspective, there is no consensus regarding the best policy approach to take in response to ELSI concerns. In Europe, for example, some countries have essentially banned any form of DTC-GT, while others have regulated DTC-GT through broad laws, such as healthcare, advertising, privacy, and consumer or patient protection laws (Borry et al. 2012; Kalokairinou et al. 2018). Regulations include measures requiring medical supervision and provisions regarding informed consent processes (Kalokairinou et al. 2018). However, some critics have insisted that jurisdictions adopting such legislation are paternalistic and that they undermine both consumer autonomy and the growth of the biotech sector (Skirton et al. 2012; Vayena 2015). The high heterogeneity of available online genetic testing and the global nature of the market accentuate tensions regarding the most appropriate and achievable level of regulation (Christofides and O’Doherty 2015; Hazel and Slobogin 2018; Hogarth and Saukko 2017; Huang and Bashir 2015; Wright, Hall, and Zimmern 2011).

A significant move towards industry self-regulation was the 2018 release of “Privacy Best Practices for Consumer Genetic Testing Services” on the part of The Future of Privacy Forum and leading DTC-GT companies, including 23and Me, Helix, MyHeritage, Habit and Ancestry, (Hendricks-Sturrup and Lu 2019; Martinez 2018; Majumder, Guerrini, and McGuire 2021). The Best Practices cover transparency regarding data collection, use, retention, and sharing, consumer education and access rights, a ban on sharing data with third parties without consent unless required by law, marketing restrictions, data security and privacy protection and company accountability (Martinez 2018). They represent voluntary common standards for the industry and an attempt to rebuild consumer trust. Overall, consumer, media, industry, and ELSI discussions have shifted the industry towards what scholars call DTC genomics 2.0: increased involvement by regulatory and medical parties, scientific validation standards, a stronger separation between medical and recreational tests, improved support and protection for consumers, and a diversified business landscape reflecting all of the above (Allyse et al. 2018; Thiebes et al. 2020).

New ground: consumer epigenetics and microbiomics

The twelve companies discussed in this paper emerged on the market in the context of innovations in and rising profiles of the fields of epigenetics and microbiomics. Epigenetics is the study of changes in gene function that do not entail a change in the underlying DNA sequence (Wu and Morris 2001). Epigenetic modifications include DNA methylation, the chemical modification of histones, and interactions of regulatory molecules at the RNA level. These modifications have been shown to be impacted by environmental exposures and lifestyle, have an effect on gene expression, and contribute to variability in risk to some diseases across individuals and groups. Epigenetics has gained traction for its potential to help better understand the developmental origins of health and disease and the social determinants of health disparities (Bianco-Miotto et al. 2017; Chadwick and O’Connor 2013; Dupras, Ravitsky, and Williams-Jones 2014; M’hamdi et al. 2018; Meloni 2015). Thus, it may shed new light regarding how to improve prevention, diagnosis, and treatment. Direct-to-consumer epigenetic testing includes various measures of health and wellness, for instance, the assessment of DNA methylation levels using saliva samples in order to evaluate someone’s “true” biological age or exposure to smoke or alcohol.

Microbiomics is a discipline that considers the role that the microorganisms that live in and on human bodies play in physiology, health, and disease (Rajendhran and Gunasekaran 2010). As is the case of epigenetic variants, the composition of microbiota varies across individuals and groups depending on their exposures or lifestyle. Human microbiome research has captured the public imagination because it appears to recast our relationship with microbes to one that is interdependent and is now paving the road for identifying “natural” cures to ailments and disease (Kling 2019; Nerlich and Hellsten 2009; Rhodes 2016). Direct-to-consumer microbiomic testing is based on the assessment of “all of the genetic material within a microbiota” (Nature 2020) to characterize the composition of microorganisms (bacteria, archaea, fungi, and viruses) that live at the surface and within the human body. The most common DTC-MT application is the study of the health of gut microbiota via a stool sample (NIH 2019).

Similarities and differences between epigenetics, microbiomics and genomics impact the ELSI considerations that arise in each of these respective fields (Dupras and Bunnik 2021). Epigenetics and microbiomics are both are closely related to human genomics. However, they differ significantly in their relation to it. Human epigenetics is the study of biochemical and biophysical modifications “above” or in the periphery of human genes, which may impact their expression. In contrast, human microbiomics is the study of non-human genes impacting human biology and health. Epigenetic and microbiomic profiles are influenced by an individual genome, but they are also in part externally modulated i.e. their state is influenced by environmental and social exposures. The biological products of this influence can persist and thus have long-lasting implications for a person’s health. In contrast to genetic variants, some epigenetic and microbiomic variants are also relatively “plastic” and may change over time. Thus, epigenetic and microbiomic risks to disease may be thought of as preventable or reversible in some circumstances, pending targeted individual or social interventions on causal factors. Therefore, both fields can provide the public with a sense of increased self-determination over health and wellbeing (Dubois et al. 2019; Harvey 2010).

In this paper, we present the results of a content analysis of the websites (product descriptions, promotional messages) and policy documents (terms and conditions, privacy policies) of twelve international DTC-ET and DTC-MT companies, and discuss four areas of concern. First, we raise questions about inconsistencies in how companies present the scientific validity and medical relevance of their tests, with a focus on recommendations to repeat testing over short periods of time to track progress. Second, we point to issues related to the poor accessibility of policy documents, in terms of their length and level of readability. Third, we highlight the lack of clarity regarding whether DTC-ET and DTC-MT companies consider epigenetic or microbiomic data as personal data and explore data governance provisions related to privacy protection, data sharing, retention, and disposal strategies. Fourth, we discuss the risks of misuse or secondary use of the data collected by these companies, in light of the current ambiguity surrounding the applicability to this data of policies against genetic discrimination – adopted by many countries over the past twenty years. Drawing on experiences and lessons learned from the DTC-GT industry, we suggest recommendations for the development of best practice standards and regulation of DTC-ET and DTC-MT. We conclude with some broader observations and questions regarding the rapidly changing DTC market for epigenetics and microbiomics and call for greater scholarly attention to the rise of multi-omic DTC products.

Methods

In July 2019, we conducted a Google search using a combination of keywords such as “direct-to-consumer”, “epigenetic”, “microbiomic” and “test”, and compiled a list of companies offering DTC epigenetic or microbiomic tests online around the world. For the purposes of our content analysis of publicly available documents, companies had to have an active website, including a privacy policy and terms of service accessible online. Companies that offered consumer-ordered and physician-ordered testing were included: we considered that these two models raise important questions related to data governance and privacy protection. Companies that offered DTC-ET or DTC-MT as well as DTC-GT were also included. Because of the relatively small number of companies identified and the exploratory nature of this study, we chose to continue to include in our results a company (uBiome) that was forced to cease its operation in controversy in October 2019 (Farr 2019; Hale 2019). Five DTC-ET and seven DTC-MT companies were ultimately selected for the study (see Table 1).

Table 1. Test types, results, and recommendations from company websites (March 2020).

	Company	Omic data type	Test results	Recommendations
Epigenetics	Chronomics* UK chronomics.com	DNA sequence & methylation levels	Biological age, disease risk levels, alcohol and/or smoke exposure	Repeat testing (annual), personalized health and lifestyle improvement plan
	epigenCare USA epigencare.com	DNA methylation levels	Current skin quality	Skin product use
	Muhdo* UK muhdo.com	Not available	Biological age, eye, hearing, and memory age, inflammation rating	Repeat testing (‘periodic’), personalized health and nutrition advice
	myDNAge USA mydnage.com	DNA methylation levels	Biological age, comparison to the general population and to people the same age	Repeat testing (after 6–12 months)
	TruMe USA trumelabs.com	DNA methylation levels	Biological age and rate of aging	Repeat testing (1–2 times a year)
Microbiomics	Atlas Biomed* UK atlasbiomed.com	Not available	Microbiome rating, bacteria, diversity, nationality, and disease protection	Repeat testing (every three months), personalized disease risk evaluation and diet advice
	Carbiotix Sweden carbiotix.com	Not available	Gut microbiome sequence and various gut health metrics	Repeat testing (subscription involves three samples to be sent in monthly), general diet and lifestyle advice, white-label product suggestions
	Ixcela USA ixcela.com	Levels of 11 metabolites (note: this a downstream product rather than the DNA of microbiota)	Overall internal fitness score, ‘Gastrointestinal Fitness, Immuno Fitness, Emotional Balance, Cognitive Acuity, and Energetic Efficiency’	Retesting (after a few months), personalized diet, exercise, and lifestyle advice, supplements
	Thryve USA thryveinside.com	Not available	Gut microbes, wellness, and diversity. Likelihood of tendency to worry and/or have fatigue, poor sleep, itchy/dry skin, and difficulty maintaining a healthy weight	Repeat testing (2 or 4 times a year), personalized diet advice, supplements
	uBioDiscovery Canada ubiodiscovery.com	16S RNA	Gut microbiome sequence	Repeat testing (test involves two samples), personalized diet advice, supplements
	uBiome USA website defunct	Not available	Gut microbe information, diversity rating and wellness match score	Repeat testing (three sample kit option), personalized diet, exercise and lifestyle advice
	Viome USA viome.com	Metatranscriptomics	Information on gut bacteria, viruses, eukaryotes, archaea, yeast, and fungi and their health functions	Repeat testing (after a few months), personalized diet advice

*companies where genetic tests are also performed.

Content analysis of these 12 companies’ websites, privacy policies, and terms of service policies was performed separately by two investigators: Beauchamp performed an initial analysis from July to November 2019, and Knoppers validated and updated the findings from January to March 2020. Research questions were based on previous research regarding ELSI of genetic testing, themes that have emerged in the existing literature on epigenetics and microbiomics, and concerns that arose while viewing company websites and reading their policies (Caulfield and McGuire 2012; Christofides and O’Doherty 2015; Hazel and Slobogin 2018; Huang and Bashir 2015). First, we looked at the type of omic tests offered by each company and type of data the results were said to be drawn from. We did not order or perform any of the tests reviewed, and therefore did not have access to the end products that companies directly provide to their consumers. Instead, we conducted an analysis of how the science is presented to consumers (e.g. product description, promotional message), with a focus on the stated medical relevance of the test, and the type of results and recommendations advertised. Second, we assessed the level of accessibility of companies’ privacy policies and terms of service. Accessibility was assessed via two online calculators: the first evaluates readability according to a series of established indexes (Readability Calculator) and the second estimates the reading time of texts based on the average reading speed of 200 words per minute (Read-O-Meter) (Adamovic 2009; Azeez 2015). As the readability formulas utilized by the online tools are considered equivalent in quality and privacy policy research has not adopted a consistent measure, we opted to use the Flesch Reading Ease measure for its straightforward scale (1–100) and corresponding education equivalence categories (Fabian, Ermakova, and Lentz 2017). Third, we searched these documents for mentions of data governance practices with regard to whether companies define the collected omic data as personal information, how long they retain the samples and data, and third parties who may be granted access. Fourth, we searched for any mentions of risks of misuse or secondary use of epigenetic or microbiomic information garnered from the tests.

Results and discussion

Presentation of the tests

Table 1 presents our findings with regard to the type of data (biological variants) under scrutiny and the type of information claimed to be provided to customers. Except for EpigenCare, which specializes in skin type epigenetic profiling, DTC-ET companies (Chronomics, Muhdo, myDNAge, TruMe) generally offer consumers tests for their “true” biological age (i.e. as revealed by some of their molecules rather than their ID card) using epigenetic clock technologies. In addition to this test, Chronomics also advertises epigenetic tests that can provide information about a person’s level of exposure to smoke and alcohol. All DTC-MT companies provide consumers with an overview of the composition of their intestinal microbiome (or “gut microbiome”), with one of them (Atlas), also venturing into offering a microbiome nationality test. Most of the DTC-ET and DTC-MT companies advertise that test data will enable them to give personalized health recommendations such as nutrition, exercise, and lifestyle changes. In addition to epigenetic or microbiomic testing, three of the twelve selected companies also perform genetic testing (Atlas, Chronomics, Muhdo).

Divergences from DTC genetic testing

With the rise of consumer epigenetics and microbiomics, tests of inherited biological variants are now accompanied by tests of long-lasting biomarkers of past and/or current exposures. The advertised products focus on lifestyle and exposure information and include various related metrics. Examples include ratings and scores related to aging, stress, cognition, and emotional balance, smoke and/or alcohol, and microbiome nationality, among others (see Table 1). While the research is in early stages, epigenetic and microbiomic variants have been associated with information such as trauma, stress, and violence exposure, tobacco, alcohol and drug consumption, socioeconomic status and geographical location (Hawkins and O’Doherty 2011; Hillemacher et al. 2018; Jovanovic et al. 2017; Kennedy et al. 2016; Marzi et al. 2018; McCartney et al. 2018; Nielsen et al. 2012; NIH 2019; Rook, Raison, and Lowry 2014; Shabani et al. 2018; Starkman, Sakharkar, and Pandey 2012; Youssef et al. 2018). Such new possibilities mark a significant transition in online omic testing from a focus on information about molecules we are born with and which remain stable, to a focus on information about the course of our lives, including events that may occur during development, growth, and aging. DTC companies themselves underscore this new terrain in their marketing, contextualizing the value of their products in relationship to the insights provided by DTC-GT. For instance, one company writes: “We’re at a new frontier in DNA testing. Where DNA-based insights are no longer static and fixed from birth but dynamic” and further that “genetic tests miss the impact of lifestyle and environmental factors, which we know can have a profound impact on our health” (Chronomics).

The focus on health improvement via ‘the omics of our lives’ echoes current sociopolitical and market discourses individuating responsibility for health (Dupras and Ravitsky 2016b; Harvey 2010; Saukko et al. 2010) and lands these companies more squarely in the lifestyle health market than their genetic counterparts. It is likely that this will help them gain traction with consumers. At the same time, the products being offered by these new companies – insights into the biological consequences of individual histories and behaviors – may carry higher sensitivity than innate biological traits because they may be associated with individual ‘choices’ and therefore to moral responsibility (Dupras and Ravitsky 2016a; Dupras et al. 2019). In other words, while people are not responsible for their genetic profile, they may be perceived as responsible, at least to some extent, for their epigenetic and microbiomic profiles, and this could have discriminatory ramifications in areas such as insurance and employment. Such an association with individual responsibility will only be compounded by company marketing centered on self-improvement.

In line with their focus on the “omics of our lives”, DTC-ET and DTC-MT companies are also different than DTC-GT in that, as per March 2020, ten of the eleven companies still active recommended that consumers repeat testing over time in order to track progress. Companies vary from encouraging the periodic purchase of new tests, to offering multiple test kit options, to rolling subscriptions. For example, one company writes: “Track your progress with the most accurate and reliable DNA Age Test. Did you change your diet? Did you change your lifestyle? Or did you start a new age management routine? We recommend retesting every 6–12 months” (myDNAge). Repeat testing to monitor the positive biological and health impact of life changes over time is thus sold as an incentive to adopt a healthy lifestyle and, more generally, to empower individuals. While tracking lifestyle and exposures (sleep, eating habits, activity) in the name of health improvement is not new, monitoring both behaviours/exposures and their biological impacts at a molecular level is novel territory. These products represent a marriage of sorts between the worlds of direct-to-consumer omic testing and digital health tracking platforms. Recurrent monitoring strengthens the development of a sustainable business model in a traditionally volatile biotechnology sector and arguably constitutes a fun motivator for consumers to adopt habits and routines that appear to echo general health recommendations (Hogarth 2017; Saukko 2017). However, the emphasis on repeat testing may also increase the impression of medical relevance of these products, the sensitivity of the data they generate, and the total price tag of the service.

Scientific validity and medical relevance

It is difficult for consumers – as well as researchers and clinicians – to assess the scientific validity of the tests offered because companies tend to only provide broad scientific information concerning their testing such as that they perform DNA methylation tests or metatranscriptomics. Companies do not typically report on the specifics of what they are testing- i.e. the exact epigenetic variant(s) at what loci on the genome or which genomic markers of which species of microbes contained in the gut microbiota- or on the lab kits and types of arrays used to perform their tests. Further, the current medical relevance and clinical utility of the tests being offered are questionable. Researchers are concerned with the “hype” of both epigenetics and microbiomics outpacing evidence (Juengst et al. 2014; Kling 2019; Ma et al. 2018). For example, in the case of epigenetics, it appears that most programming may occur either before birth or in early childhood and thus the extent to which any epigenetic findings can even be attributed to adulthood lifestyle choices/exposures and/or changed by different ones is unclear (Dupras and Ravitsky 2016a). Similarly, while it is possible to generate a ‘field guide’ of the species present in a given gut microbiome, it is challenging to distinguish a ‘healthy’ microbiome from an unhealthy one and evidence suggests that this measure likely varies from person to person (Eisenstein 2020; Ma et al. 2018). The potential of longer-term interventions to have a durable impact on the gut microbiota by inducing a new ecological homeostasis that improves health is also currently unknown due to the small number of studies on the subject (Leeming et al. 2019).

Issues pertaining to scientific validity and actionability most powerfully coalesce in the recommendation to repeat testing periodically. This recommendation must be questioned given the current state of research in epigenetics and microbiomics. As mentioned above, we found that most companies suggest sending in a new sample for testing within a timeframe of just a few months – with some even suggesting a few weeks – implying this would allow consumers to assess the rapid beneficial impact of changes in their diet or lifestyle. But to date, the accuracy and precision of epigenetic and microbiomic tests are insufficient for such a comparison. For instance, epigenetic tests used to assess biological age currently have a margin of error of about 2 years, making the monitoring of modification in epigenetic aging between periods of time apart from less than 4 years scientifically impracticable, and thus irrelevant (McEwen et al. 2018; Monseur et al. 2020). Similarly, while the gut microbiota has been found to respond rapidly to dietary interventions, changes appear to be superficial and temporary: i.e. the overall composition of gut microbiota would tend to remain fairly stable over time (David et al. 2014; Wu et al. 2011). Consumers should be aware of the scientific limitations of the products commercialized by DTC-ET and DTC-MT companies, and the financial motivations that may drive recommendations such as repeat testing over short periods of time.

At the same time, we found that the products and services offered were portrayed as scientifically validated and medically relevant, albeit to varying degrees. This included taglines such as: “we're scientists and we do data, not speculation” (Chronomics), “would you like to reverse the aging process with an epigenetics test?” (Muhdo), “clear results, actionable recommendations” (Ixcela), and “clinically proven health benefits” (Thryve). Websites contain ‘behind the science’ sections, references to media acclaim, testimonies by satisfied customers, various charts and figures, and the inclusion of prominently displayed scientific and medical experts affiliated with the companies. The fact that several companies also sell their product through healthcare providers (Carbiotix, Chronomics, uBiome) and have billed health insurance companies for their tests (uBiome) also contributed to impressions of medical relevance. In the case of the now defunct uBiome, it’s co-CEOs were charged with health care fraud (among other offenses), partly because of these latter two practices with tests that “were not validated and not medically necessary” (U.S. v. Apte). While some companies include disclaimers that their tests are for ‘research, informational, and educational purposes only’ within their terms of service documents and/or website footers, mixed messaging can be misleading. Accurate and comprehensive information regarding products in the consumer health market are vital for informed consent, result interpretation, and consumer autonomy.

Even as the companies visually and textually associate themselves with science and medicine, most of their marketing walks the regulatory line between general wellness and medical devices (Lucivero and Prainsack 2015; Saukko et al. 2010). While specific definitions of medical devices vary by regional regulatory body, they are generally understood to be products that diagnose, alleviate, prevent, treat or cure disease (FDA 2019; Health Canada 2018; MHRA 2020). Wellness or lifestyle products on the other hand, encourage the optimization of health or a state of health activity. They are deemed to be low risk and receive far less oversight regarding their accuracy, safety, and effectiveness. Thus, market entry is much easier, faster, and requires less capital. Indeed, of the twelve companies considered, only Atlas Biomed was found to be registered as a Medical Device, with the UK’s Medical and Healthcare products Regulatory Agency (MHRA), and we did not find any evidence of other companies seeking accreditation for their microbiomic or epigenetic testing as of March 2020. Interestingly, this is the same path taken by many second-wave DTC-GT companies after the initial controversy and regulatory crackdowns surrounding the validity and marketing of genetic medical tests led many first-wave firms to go out of business (Allyse et al. 2018; Majumder, Guerrini, and McGuire 2021). DTC-ET and MT tests push the regulatory gray zone between lifestyle and medical products further because they are premised on evaluating and tracking the biological impacts of lifestyle.

Accessibility of the policies

Table 2 presents our findings with regards to the accessibility of the privacy policies and terms and conditions documents of DTC-ET and DTC-MT companies. The Flesch Reading Ease considers the average length of sentences (the number of words) and the average number of syllables per word (Flesch 1979). Higher scores indicate greater readability. On a scale of 1–100, the standard reading comprehension of the general public is 60–70, or the equivalent of a grade 8 or 9 reading level (Flesch 1979). Most companies scored around 30, and no single document came close to the 60–70 target. Instead, all documents require at least a college reading level and most require a college graduate level. For comparison purposes, we performed the analysis on our manuscript, and found that it scores 25 (college graduate level) on the Flesh Reading Ease scale. This means that most of companies’ policies, which are legal contracts intended for a general audience, are written using vocabulary and syntax similar to that employed in specialized scholarly literature.

Table 2. Readability of privacy policy and terms of service documents (March 2020).

	Company	Flesch Reading Ease Level (1–100, higher scores = easier)	Cumulative Reading Time (rounded to the minute)	Additional Notes
Epigenetics	Chronomics	College – 41.8	47 min	Privacy policy has the option to jump to specific sections
	epigenCare	College graduate – 29.3	35 min
	Muhdo	College graduate – 13.6	58 min	Information is divided into three documents
	myDNAge	College – 32.8	22 min
	TruMe	College graduate – 21.3	58 min
Microbiomics	Atlas Biomed	College – 39.3	1 h 22 min	Both documents have menus with the option to jump to specific sections
	Carbiotix	College graduate – 29.2	1 h
	Ixcela	College – 30.1	40 min
	Thryve	College – 30.4	33 min
	uBioDiscovery	College graduate – 24.9	1 h 11 min	Both documents have menus with the option to jump to specific sections
	uBiome	College graduate – 27.8	54 min
	Viome	College graduate – 22	1 h 27 min
		Mean - 28.5	Mean – 54 min

The writing style employed varied from concise plain language to long dry inscrutable sentences filled with legal jargon. In one privacy policy, the average sentence was 48 words long (Muhdo). To illustrate how much this can impact readability, consider the difference in how these companies explain what happens if consumers want to terminate their membership/contract. One company writes: “You may terminate your membership and/or subscription at any time”; but then continues with: “Even after your membership or subscription is terminated, this Agreement will remain in effect. All terms that by their nature may survive termination of this Agreement shall be deemed to survive such termination” (Ixcela). It is unclear what this means in practice for the consumer.

Vague confusing language can serve a dual function of both obscuring a company’s operations and protecting the company legally by creating a range of interpretations (Litman-Navarro 2019). This can be seen in the volume and variety of terms used by the companies in their contracts to describe the third parties with whom they may share information. These terms include, among others: vendors, affiliates, service providers, improvement providers, partners, private parties, associates, analytics, referral marketing, commercial partners, employees, contractors, and agents. Some of these categories are distinct, some indistinct, and some overlap. Arguably, the differences between these parties will not be clear or obvious to consumers. Some companies do share data for various purposes including and beyond the provision of the service purchased. As has been the case for DTC-GT, this can include profiting off user data by selling it to private companies (Brodwin 2018; Pitts 2017). The lack of clear and accessible language around sample and data sharing practices may impede both consumer consent and trust in the long term (Fabian, Ermakova, and Lentz 2017). It can also serve to disguise unfair terms that are likely in breach of consumer legislation (Phillips 2017).

The length of these documents further compounds their accessibility issues: the average cumulative time required to read the two documents was nearly an hour. A study by McDonald and Cranor (2008) found that with an average reading time of 10 min, it would take a person 244 h per year to read the privacy policies of all the websites they visit. The use of websites via computers (and now mobile devices) has only increased since then and it is reasonable to consider a time commitment of an hour to be unrealistic. As studies have shown that difficult texts with substantive time commitments discourage and/or prevent consumers from reading policy documents, it can be argued that these important documents are not truly accessible to most consumers (Fabian, Ermakova, and Lentz 2017; Hendricks-Sturrup and Lu 2019; Robillard et al. 2019).

While people may not read and/or understand these policy documents, they remain binding contractual relationships between companies and consumers as most of the companies deem consent by website use (Phillips 2017). The contracts have implications for informed decision-making, privacy and redress if the consumer feels something went wrong. Further most companies reserve the right to change their policies at any time, without notice, leaving the onus on consumers to regularly monitor company documents. These problems have been observed previously, leading to stipulations within existing privacy laws such as Europe’s General Data Protection Regulation (GDPR) and Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) that privacy policies be clear, concise, and easily accessible. As highlighted by the Office of the Privacy Commissioner of Canada: “consumers find privacy policies are difficult to understand, yet they feel compelled to give their consent in order to obtain the goods and services they want. Individuals should not be expected to decipher complex legal language in order to make informed decisions on whether or not to provide consent” (OPC 2017).

DTC-ET and DTC-MT companies should work to improve their policy and terms of service documents in that regard. This may entail adjusting their policy formats to the digital era of fast-paced online purchasing in which their products circulate (Phillips 2017). Companies could develop short summaries highlighting key information in these documents that is most crucial for consumers to know and understand about the products, company practices, and the contract itself. These summaries could then be presented somewhere in the main body of company websites, in plain everyday language, in document or even short video form.

Data governance

Omic data as protected personal information

Another aspect of current practices which makes it difficult to interpret privacy policies and the terms and conditions related to data governance, is that for some companies, it is nearly impossible to know whether biological information is considered as personal information. Five companies indicated that they consider the epigenetic or microbiomic data they collect to be personal information (Chronomics, Muhdo, uBioDiscovery, uBiome, Viome). For the other six companies active in March 2020, it was unclear whether epigenetic or microbiomic information provided by consumers is treated as protected under privacy regulations. One company provides contradictory information in their terms of service when compared with their privacy policies, mentioning at the same time that microbiomic data is personal information, and that it is not individually identifiable protected health information (Carbiotix). Such ambiguity is omnipresent in the policies of the companies we studied. Ixcela, for example, mentions that it collects personal information such as your name, contact information, IP address, and “other personal information” – without explicitly listing what they consider as such – and then state that “non personally identifiable or aggregate information may be used by us for any purposes permitted by law”. Thus, it is unclear whether this extends to information gleaned from their microbiomic tests.

Many common law jurisdictions’ privacy statutes use a classificatory approach that distinguishes personal information from non-personal information, privacy protection being awarded to the former. The line between personal and non-personal information is drawn by whether it is possible to identify individuals based on the information with reasonable efforts (Ho and Kaan 2013). Genetic information is usually considered personal data because it is unique to everyone (except for monozygotic twins), and therefore, it may be seen as identifying information. It can be more challenging to draw this line in the context of epigenetics and microbiomics. While there is considerable evidence that DNA methylation patterns could be used to (re)identify individuals, other types of epigenetic information – or different combinations of epigenetic variants – such as data about histone variants, may not be identifying (Philibert et al. 2014). This raises the question of whether DTC-ET companies should always (by default) treat epigenetic data they collect as personal information, or whether this should be assessed on a case-by-case basis, depending on the precise (combination of) epigenetic variants they test for. It is likely that practical considerations will lead to recommendations towards the former. Even further, the samples often used for epigenetic analyses also contain host nuclear DNA and are potentially available to determine the genetic identity of the individual.

The situation may be even more complex in the case of microbiomic information. While some evidence suggests that microbiomic data could be used to identify individuals, there is an ongoing debate about whether microbiomic data should be treated as such. Some researchers have found features of the human microbiome (particularly that of the gut) sufficiently stable to associate with individuals over substantial periods of time, and others assert that microbiome stability is still not well understood (Coyte, Schluter, and Foster 2015; Dickson 2019; Faith et al. 2013; Franzosa et al. 2015; Hawkins and O’Doherty 2011; Jayasinghe et al. 2017). Moreover, it is worth noting that, in contrast to human genomic or epigenomic information, microbiomic data is obtained by the analysis of the genomic composition of non-human cells, and as such, it may not be conceptualized as belonging to individuals. However, the microbiome samples used to garner microbiomic data will contain human DNA and the data may or may not reveal host genomic sequences depending on the test used (Fricker, Podlesney, and Fricke 2019). Consequently, there is ambiguity on several counts with regards to whether the microbiomic data collected by DTC companies should be seen as personal data and be covered by privacy statues. Since the type of data collected by DTC-ET and DTC-MT companies does not enjoy explicit regulatory protection, companies should work to strengthen their own privacy policies with clear statements regarding how they will treat epigenetic and microbiomic information, in a way that addresses consumer concerns that arise in light of their potentially identifying and sensitive nature.

Retention practices

Most of the DTC-ET and DTC-MT companies that we studied do not specify an endpoint to the retention of customers’ biological samples and/or personal data. Some companies do mention a maximum period for retention but this is often contradicted by other provisions stating that companies reserve themselves the right to keep samples and/or data for longer. We also found that while most companies state that they retain personal samples and data in order to provide services to consumers or for quality control purposes, some companies grant themselves extensive rights over the use of personal samples and data – in terms of use for research purposes, for instance. The method used by some companies is in essence ‘blanket consent’, that permits various uses of donated material or information without the need to recontact consumers to request consent (Matsui 2013). (Table 3).

Table 3. Retention information (March 2020).

	Company	Duration	Purpose
Epigenetics	Chronomics	Sample: no information Personal data: “all of this information is kept for as long as your account remains open and then up to 6 years thereafter” ^3	“We may want to keep part of your data for research purposes, in which case we will ask you for your explicit consent to retain it” ^3
	epigenCare	Sample: no information Personal data: “all information generated from any DNA-sourced testing shall never be disclosed or associated with personally identifiable information on a permanent basis”^3	Service provision^3
	Muhdo	Sample: no information Personal data: “information held until the person requests for the information about themselves to be deleted” ^4	Service provision, research and development^2
	myDNAge	Sample: no information Personal data: “for a reasonable time and at least as long as required by applicable law, and for periods of time needed for Epimorphy to pursue our obligation to meet your needs and other business needs … , legal obligations, dispute resolution or enforcing agreements” ^3	“By ordering the service you agree that we own and may use the sample material (DNA, RNA, or protein) and data generated therefrom for any reason including but not limited to our internal uses which include sharing with our research laboratory for improving the service as well as making new services”^3
	TruMe	No information	No information
Microbiomics	Atlas Biomed	Sample: “1 year, although we retain the right to store the samples for an indefinite period”^3 Personal data: “only for as long as necessary for the purposes set out in the privacy policy”^3	Service provision, research, and development^3
	Carbiotix	Sample: “for a period of at least 12 months and up to 10 years” ^3 Personal data: “for as long as your account is open or as needed to provide you services” ^3	Service provision, research, and development^3
	Ixcela	No information	No information
	Thryve	No information	“Thryve and its licensors exclusively own all right, title and interest in and to the services, content, samples, and sample data, including all associated intellectual property rights” ^2
	uBioDiscovery	Sample: indefinite unless the consumer asks for disposal^3 Personal data: “for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements” ^3	Service provision, research, and development^3
	uBiome	Sample: no information Personal data: “for as long as your account is active or as needed to provide you our Service” ^3	Service provision, research, and development^2
	Viome	Sample and personal data: “for at least ten (10) years, but may, in its sole discretion, retain such Samples and data for a longer period of time” ^2	“By submitting a sample to Viome, you agree to, and hereby do, transfer and assign to Viome and its assigns and successors all right, title, and interest in and to the sample, self-reported information, analysis, test data, and other data derived therefrom”^2

¹ Website; ² Terms of service; ³Privacy policy; ⁴Data retention policy.

Existing privacy regulations such as the GDPR and PIPEDA as well as the best practice standards observed by some DTC-GT companies all call for specific timeframes and purposes for sample and data retention to be named (Martinez 2018). While the use of personal samples and data for service optimization, internal research, and development is standard practice in the industry, uses “outside of the primary purpose of the purchased service and the inherent contextual uses” are generally considered incompatible by existing privacy regulations and best practices (European Union 2016; Martinez 2018). Consumers should be asked for a separate ‘express’ consent – rather than being imposed blanket or ‘implicit’ consent – for any incompatible uses of their samples or data (Majumder, Guerrini, and McGuire 2021).

These regulations and best practices came about due to privacy concerns as well as unease regarding the research use and commercialization of consumer genomic information on the part of DTC-GT companies, including the selling of data for profit (Niemiec, Kalokairinou, and Howard 2017). The aforementioned ‘blanket consent’ over retention and use of consumer samples and data used by some companies in the study raises concerns that DTC-ET and DTC-MT companies may sell or pass data onto third parties the way DTC-GT companies have. DTC-ET and MT companies have several features that compound such concerns. First, there is the aforementioned sensitivity of the lifestyle and exposure information garnered by these new tests. Secondly, as several of these companies also perform genetic tests, samples and data may end up in multi-omic repositories even if this was not the case when the test was originally purchased, via company product expansion (as is currently happening with Viome) or sale (as is now the case for uBiome’s former repositories) (GenomeWeb 2019; Yerak 2020). Genetic data reveals additional sensitive information about consumers and multiomic data in repositories substantially increases the risk that an individual may be re-identified (Erlich and Narayanan 2014; Rumbold and Pierscionek 2018; Zaaijer et al. 2017; Zook et al. 2017).

Finally, epigenetics and microbiomics research are still in their early days. As new findings emerge, the potential of omic data to reveal sensitive information about people will increase. In fact, several companies build on this idea to highlight both the current and potential value of their tests. Carbiotix, for example, writes that microbiomic information “could have greater meaning in the future as new discoveries are made.” With samples and data held onto for unspecified timelines – or retention periods of up to 10 years and more – and many companies doubling as research facilities, it is indeed likely that additional information about an individual could be revealed by the same sample or data in the future.

Risk of secondary uses

After reviewing the policies of the twelve DTC companies, we found that only three of them – all DTC-MT companies (Carbiotix, uBioDiscovery, uBiome) – mentioned possible secondary uses of test results, including the risk of discrimination based on the information revealed. More specifically, they inform consumers in their terms of service that microbiomic information could be used against their interests by employers, insurance companies, family, and friends and then advise consumers to remain careful about disclosure. They also warn that nondisclosure of test results could eventually be considered fraud on the part of insurance companies because it would fail to provide relevant information about individual risks to some diseases. UBiome, for instance, writes that “you may want to consult a lawyer to understand the extent of the legal protection of your microbiome information before you share it with anybody”. As in the case of genetic test results, there exists a risk that secondary uses of epigenetic and microbiomic test results will be attempted by third parties in the future (Dupras et al. 2019).

An example of possible unforeseen uses of the data collected in the context of DTC testing activities is a potential request by law enforcement agents for access to – or compelled disclosure of – the databases hosted by DTC-ET and DTC-MT companies. Most companies stipulate that they will share personal information with government and/or law enforcement agencies where required by law, yet, only two of them explicitly mention that they will notify consumers if this is the case (Muhdo, Viome). The level of discretion some companies grant themselves regarding disclosure is also questionable, and it may raise concerns among some consumers. For example, one company states: “ … we may disclose any information about you to the government or law enforcement officials or private parties as we, in our sole discretion, believe necessary or appropriate”, including when necessary “to stop any activity that we consider illegal, unethical or legally actionable” (Thryve).

The potential secondary use of DTC-GT databases by third parties such as insurers, employers, and law enforcement spurred a public backlash that led to increased regulation of this potentiality (Hendricks-Sturrup, Prince, and Lu 2019; Majumder, Guerrini, and McGuire 2021; Zhang 2019). Best Practices ban sharing genetic data with such third parties without separate express consent or as required by law (Martinez 2018). They further state that companies should notify consumers when they are required to disclose personal information by law and provide regular transparency reports to the public regarding any such requests. Only three companies in the present study appear to recognize the issue of risk of secondary uses in their policy documents. Companies should name this issue and develop standards as to how they manage requests for secondary use of their collected information. It is important that the standards they develop are not only ethical best practices but that they comply with existing laws and national regulations already in place in the jurisdictions in which they sell their products and collect data.

There is a further issue however, wherein studies have noted that current genetic anti-discrimination policies are framed in a narrow, gene-centric manner and generally do not provide ethical or legal oversight for the use of epigenetic or microbiomic information (Dupras et al. 2018; Rothstein 2013). Because in contrast to their genetic profile, individuals may be perceived to have some degree of control over their epigenetic profile, there may be some debate over whether the rationale underlying the adoption of genetic anti-discrimination laws should apply to epigenetic information (Dupras et al. 2018). The case against inclusion could be even stronger in the case of microbiomic information, as it does not take its source in human cells, but in those of microorganisms. At the same time, the fact that this biological information can be conceived of as resulting from one’s ‘choice’ or ‘lifestyle’ may make it particularly vulnerable to discrimination (Dupras et al. 2018, 2019). Interestingly, cultural and research emphasis on individual responsibility in health and the eclipsing of socio-environmental health determinants is due in part, to the influence of the lifestyle health industry in the first place (Saukko 2017). The absence of explicit protection against discrimination based on information about one’s epigenome or microbiome should prompt DTC companies to provide consumers with clear information about the limitations of the current regulatory context.

Conclusion

In this paper, we described some issues arising with the advent of consumer epigenetics and microbiomics and offered some suggestions as to how DTC-ET and MT companies could harmonize their practices and clarify the policy documents they publish on their websites. First, companies should be more specific about the tests they perform, biological and computational databases they use, and types of biological variants they detect, as well as about the limitations of the results and recommendations they make (e.g. repeat testing, change of diet) in terms of scientific validity and medical relevance. Second, privacy and terms of service policies should be written for the reading level of the general public, easily navigable, and reasonable in length. Third, provisions that are most relevant to the protection of the privacy of consumers and their informed consent – e.g. Is my epigenetic or microbiomic data treated as personal information? Who will or could have access to the data? What is the data retention period? Is it possible for someone to have their data completely deleted upon request? – should be summarized, highlighted, and made easily accessible. A clearly separate consent process should be put in place for secondary uses other than quality controls and service optimization (e.g. external research, law enforcement). Consumers should have a way to express their right to refuse such secondary uses while still purchasing the service. DTC-ET and DTC-MT companies should also mention that current anti-discrimination policies tailored specifically to the context of genetics may not provide legal protection against potential misuses of individual epigenetic or microbiomic information.

Arguably, the ethical and legal issues raised by the emergence of DTC-ET and DTC-MT companies call for the development of best practice guidelines that are more encompassing (i.e. that do not apply solely to DTC-GT) and include, not only epigenetic and microbiomic testing, but any other type of DTC testing. Stronger incentives to comply with common standards should be put in place. That these companies are new, and yet our observations and recommendations echo those made regarding DTC-GT companies over the past two decades, raises broader questions regarding the practical incentives for companies in the DTC health-related market to implement best practices in their product design and execution. Similarly, we believe the rationale behind regulations of genetic data extends to multiple types of biological data and feel that it would be appropriate to make regulations originally developed for genetics more comprehensive. This may entail a hybrid regulatory category that encompasses and works with the gray-zone between wellness products and medical devices. The March 2021 indictment against uBiome is instructive both to an extreme scenario what can happen on the part of companies (charges of conspiracy to commit health care fraud, health care fraud, conspiracy to commit securities fraud, money laundering, and related offenses) and to protective factors in the health industry towards compliance and accountability (Department of Justice 2021). It will be interesting to see how (or if) the fallout around uBiome impacts other companies in the market.

The advent of epigenetic and microbiomic DTC tests mark a significant transition towards an ‘omics of our lives’: tests that reveal and root their recommendations in our ongoing lifestyle and environmental exposure information. DTC-ET and DTC-MT companies have only existed for a few years and it remains to be seen what types of information about the lives of individuals they will be able to provide, and with what level of precision and accuracy. There is little doubt, however, that the DTC industry will continue to expand as further scientific developments are made in omic fields complementary to genetics and as those fields offer opportunities for more sustainable business models. In that regard, it is worth noting that in the time that elapsed since the beginning of our research, we observed that the number of online DTC epigenetic and microbiomic companies had more than doubled¹ and that nearly all companies under analysis diversified their products and/or changed their practice, at least to some extent. For example, as of June 2020, all companies were recommending consumers repeat testing over short periods of time to assess the effects of changes in lifestyle or diet; one DTC-MT company (Viome) had decided to add epigenetic testing services to their microbiomic testing services; and another company (Chronomics) was offering DTC testing for COVID-19. It is also foreseeable that this expanding industry will not remain focused on biological monitoring but will also attempt to offer medical interventions to their consumers. Supplements have been a feature of the DTC-GT industry since the beginning and are logical territory to branch into for these new omic tests (Saukko 2017). Four microbiomic companies in this study were already marketing their own supplements as of September 2020. Inspired by the market potential and by research in the field, companies may think about further expanding into, for instance, pharmacological products to reverse epigenetic aging, or fecal transplants to change a person’s gut microbiota. In addition to the issues identified in this paper, this would raise important safety and public health concerns. The rapidly changing landscape of the DTC market complexifies the assessment of emerging practices, and it calls for continuous scientific and ethical scrutiny on the part of researchers, as well as greater consistency, transparency, and accountability on the part of all DTC companies. The rise of multi-omic DTC products has significant implications and it is time to pay greater attention.

Disclosure statement

No potential conflict of interest was reported by the author(s).

Additional information

Funding

This work was supported by Genome Canada [grant number EpiShare]; Institute of Genetics [grant number Postdoctoral Fellowship MFE-152574]; National Institute for Health Research [grant number Biomedical Research Centre #BRC369/CN/SB/1013]; Office of the Privacy Commissioner of Canada [Contributions Program 2019-2020].

Notes

1 New online DTC-ET companies include EpiAge (epigenexperts.ca), Elysium Health (elysiumhealth.com), My Toolbox Genomics (mytoolboxgenomics.com), and TruAge (trudiagnostic.com). Emerging DTC-MT companies include Biohm (biohm.myshopify.com), Biomes (biomes.world), BiomeSight (biomesight.com), DayTwo (daytwo.com), Floré (sungenomics.com), Gutbio (onegevity.com), Join Zoe (joinzoe.com), and Psomagen (mypsomagen.com).