It is until they prove it isn’t, which they might not be able to do. Many trusted 23andme only to see private data stolen. Make the company prove the security in place and the methods ensuring privacy, because you’ll essentially be liable for any failures of the system from a lack of due diligence.
I recall a story of a pedophile being caught because they posted pictures using a radial warp on the face. It wasn’t too hard for enforcement to code a filter that undoes the radial warp, and instantly saw the original photo to identify and lock away the creep.
It is until they prove it isn’t, which they might not be able to do. Many trusted 23andme only to see private data stolen. Make the company prove the security in place and the methods ensuring privacy, because you’ll essentially be liable for any failures of the system from a lack of due diligence.