DNA testing service 23andMe filed for bankruptcy protection in March, sparking concerns about what could happen to the genetic data of the company’s 15 million customers.

Pharmaceutical giant Regeneron announced in May that it was buying the genetic testing company for $256 million following a bankruptcy auction. While the company has said it will maintain 23andMe’s privacy practices, it also stated that it would use the 23andMe data to aid the discovery of new drugs.

When 23andMe filed for bankruptcy, security experts and lawmakers cautioned customers to take action to protect their data. This week, 23andMe’s interim chief executive Joseph Selsavage told lawmakers that 1.9 million people, or about 15% of its customer base, have requested to delete their genetic data. Selsavage shared the number during a House Oversight Committee hearing where lawmakers scrutinized the company’s sale.

Also this week, more than two dozen states sued 23andMe to challenge the sale of its customers’ private data. The states argue the company must obtain explicit consent from its customers before selling their data.

If you’re one of the 15 million people who shared their DNA with 23andMe, we’ve outlined the steps you can take to protect yourself. While you can’t delete all your 23andMe data, there are some things you can control.

How to delete your 23andMe data

To delete your data from 23andMe, you need to log in to your account and then follow these steps:

Navigate to the Settings section of your profile.
Scroll down to the selection labeled 23andMe Data.
Click the View option and scroll to the Delete Data section.
Select the Permanently Delete Data button.

You will then receive an email from 23andMe with a link that will allow you to confirm your deletion request.

You can choose to download a copy of your data before deleting it.

There is an important caveat, as 23andMe’s privacy policy states that the company and its labs “will retain your Genetic Information, date of birth, and sex as required for compliance with applicable legal obligations.”

The policy continues: “23andMe will also retain limited information related to your account and data deletion request, including but not limited to, your email address, account deletion request identifier, communications related to inquiries or complaints and legal agreements for a limited period of time as required by law, contractual obligations, and/or as necessary for the establishment, exercise or defense of legal claims and for audit and compliance purposes.”

This essentially means that 23andMe may keep some of your information for an unspecified amount of time.

How to destroy your 23andMe test sample and revoke permission for your data to be used for research

If you previously opted to have your saliva sample and DNA stored by 23andMe, you can change this setting.

To revoke your permission, go into your 23andMe account settings page and then navigate to Preferences.

In addition, if you previously agreed to 23andMe and third-party researchers using your genetic data and sample for research, you can withdraw consent from the Research and Product Consents section in your account settings.

While you can reverse that consent, there’s no way for you to delete that information.

Check in with your family members

Once you have requested the deletion of your data, it’s important to check in with your family members and encourage them to do the same because it’s not just their DNA that’s at risk of sale — it also affects people they are related to.

And while you’re at it, it’s worth checking in with your friends to ensure that all of your loved ones are taking steps to protect their data.

This story originally published on March 25 and was updated June 11 with new information.

Whole Foods tells staff cyberattack at its primary distributor UNFI will affect product availability