Even startup companies are in the crosshairs of the FTC for breaches of their promises to consumers concerning the use, disclosure and security of consumer health data. The FTC has entered into a proposed settlement with a genetic testing company that has fewer than 20 employees for the company’s failure to adequately notify consumers of its retroactive changes to its privacy policy, failure to uphold its promise to delete consumer health and genetic data held by laboratories, and failure to properly secure the data through encryption and restrictions to access, as well as failure to log or monitor access to the health data it stored.