The thing is, if 23andMe ever goes bankrupt and/or gets sold to another company, that privacy policy won't mean squat. This isn't a theoretical concern either: data aggregators like Experian are constantly vacuuming up the corpses of failed startups for their data. Considering that once your generic profile is compromised, it's forever (not just for you, but for all your relatives and descendants) and there's nothing you can do, do you want to risk that 23andMe will exist, with no management changes that might undo the policy, indefinitely?