If You Ever Used Promethease, Your DNA Data Might Be On MyHeritage Now

When it comes to ways to learn about your DNA, Promethease’s service seemed like one of the safest. They promised anonymity, and to delete your report after 45 days. But now that MyHeritage has bought the company, users are being notified that their DNA data is now on MyHeritage. Wait, what?

It turns out that even though Promethease deleted reports as promised after 45 days, if you created an account, the service held onto your raw data. You now have a MyHeritage account, which you can delete if you like. Check your email. That’s how I found out about mine.

What Promethease does

A while back, I downloaded my raw data from 23andme and gave it to Promethease to find out what interesting things might be in my DNA. Ever since 23andme stopped providing detailed health-related results in 2013, Promethease was a sensible alternative. They used to charge $US5 ($7) (now up to $US12 ($18), but that’s still a steal) and they didn’t attempt to explain your results to you. Instead, you could just see what SNPs you had—those are spots where your DNA differs from other people’s—and read on SNPedia, a sort of genetics wikipedia, about what those SNPs might mean.

So this means Promethease had access to the raw file you gave it (which you would have gotten from 23andme, Ancestry, or another service), and to the report of SNPs that it created for you. You had the option of paying your fee, downloading your report, and never dealing with the company again; or you could create an account so that you could “regenerate” your report in the future without having to pay again. That means they stored your raw DNA file. Here’s what their privacy policy says:

If you choose not to create an account, Promethease deletes your DNA Data file after 24 hours. All DNA Data Files uploaded before August 28, 2017 were deleted. If you create an account, Promethease will store your DNA Data File, until such time that you delete it from Promethease. You can log into your account at any time, and for as long as your DNA Data File is stored on Promethease, you can re-generate a Report for free, gaining the most up-to-date data from SNPedia, or delete your DNA Data File permanently.

I’m willing to bet that plenty of Promethease users, like myself, saw the service as a one-off that we could forget about later. If that was your intention, but you created an account, you’ll need to go to Promethease and/or MyHeritage and delete your data.

How to delete your account

In classic 2020 digital data hell fashion, you have to create your MyHeritage account to be able to delete it. Here’s how Promethease’s privacy policy describes it:

Once an account for you is created on MyHeritage in accordance with the above [European users’ data is not copied over], you will receive a notification email. You will then be able manage your copied DNA Data File(s) on the MyHeritage website in a secure private account (created using the email address associated with your Promethease account) accessible only to you, and receive free value-add services (free DNA Matching for relatives and free Ethnicity Estimates). You will at all times retain ownership of your DNA Data File (MyHeritage asserts no ownership rights over the DNA Data File). Your account on Promethease will remain active and you can continue to use it. You will be able to delete your DNA Data File and/or account on MyHeritage at any time (while still continuing to use Promethease if you wish). MyHeritage will de-duplicate the DNA Data File, so that DNA Data Files that have already been uploaded separately to MyHeritage by the same users will not be copied over to MyHeritage again.

I got an email from MyHeritage and clicked the link. Here’s what greeted me:

Promethease was anonymous, but this wants your name (I entered “no” on both lines) and consent to new terms and privacy policy. Ugh. Then it takes you to an ethnicity estimate animation. Click “Skip” in the upper right if you don’t want to see; the estimates aren’t necessarily accurate, but there can be a lot of complicated feelings if you don’t get the results you’re expecting (people have discovered upsetting family secrets through something as simple as DNA ethnicity results, so consider yourself warned).

From there, click the MyHeritage logo to get to a dashboard (it tells me my DNA partially matches 6,033 other users, great, I didn’t ask for this) and then click your profile in the top right to get to the privacy settings. Among other things I didn’t ask for: DNA matches are enabled, and people who match me are allowed to view my ethnicity estimate.

I disabled everything I could find, but I couldn’t figure out whether my data had been available for other people to match and search, or if it only became available a minute earlier when I created the account. I tried calling customer support, but got a message that only paid customers are entitled to phone support. I submitted a request through the website, and will update if they answer. In the meantime, at least I was able to delete my account, as promised.

Here’s how to delete what you can:

1. Go to My Profile on MyHerittge, and you’ll see your DNA “kit” (which represents your raw data file). Click “manage” and then you can delete the kit.

2. Go to Account Settings, and at the bottom of the page you can delete your account.

3. If you also want to delete your Promethease account, log in to Promethease and click the three-dots menu next to your kit. Select “Delete DNA Files.”

For what it’s worth, MyHeritage does not allow searches by law enforcement or in an attempt to solve crimes, unless required by court order. They do not offer a transparency report with information about court orders.