Who owns your medical data? Now it has a price per record. Your diagnosis now has a list price, and you are not on the invoice. If you have ever asked who owns your medical data, a securities filing from last week gives a blunt answer: whoever holds the copy. On October 23, Tempus AI disclosed that it will license up to 500,000 de-identified records of patients with Alzheimer's disease and other neurological conditions to Pathos AI at $100 per delivered record, inside a $55 million order. The same filing puts the full package with Pathos and Bristol Myers Squibb at up to $192.5 million over about five years. What the Tempus filing actually says. The deal is legal, disclosed and aimed at real disease. Pathos says it will use the dataset to study how neurological conditions progress and to design more targeted clinical trials. On the same day, Reuters reported that Pathos raised a $237 million Series E led by Bristol Myers. Separately, Bristol Myers will license oncology data from Tempus through 2031 and train AI models inside a dedicated Tempus environment. Read the filing for parties and you find three companies. The people behind the records appear only as units to be delivered, 100,000 a year. That is not a scandal. It is the market telling you what this data is worth, in plain numbers anyone can read. The failure of de-identified consent. Under United States health privacy law, records stripped of a set list of identifiers can be shared without asking the patient. A peer-reviewed study of HIPAA re-identification risk notes that data de-identified under the HIPAA Safe Harbor rule carries no further restrictions on its use. Removing your name removes you from the deal. It does not always remove you from the data: researchers writing in Technology Science matched names from local news stories to hospital records in Maine, and estimated that some matches would survive even Safe Harbor redaction. The deeper problem is that the terms belong to whoever holds the copy, and holders change. California alleged that 23andMe sold genetic data and samples without consent during its bankruptcy, in a case now headed for a settlement that awaits court approval. Montana's attorney general alleges that General Motors sold drivers' data to brokers who resold it to insurers. Different industries, same shape: a copy left your hands, and your say left with it. The honest complication. Research on records like these is how medicine learns what a disease does over a decade. A system where every patient haggles over every file would starve it, and most people do not want to negotiate with a drug company at all. So the question is not whether this data should be used. It is where the terms live: in a contract between two companies, or with the data itself, set by the person it describes and checked every time someone uses it. The Elacity solution: records as property, terms at the key. Elacity is building the ownership layer for that second answer. The idea is simple to state: data you generate should be property you control, with your terms attached, rather than raw material someone else prices. 1. Package the data as a Wealth Capsule. Elacity dDRM is designed to turn a dataset into a Wealth Capsule: encrypted, programmable, with its terms written into an on-chain rights token instead of a side letter. Research use, commercial use and exclusivity become different rights, priced or granted free by the owner. 2. Check the terms at the key, every time. In Elacity's design, the key that opens a capsule is split into shares held on separate machines, so no single machine can open it alone. The aim is that a buyer holds a right that is checked each time the data is opened, rather than a file that is theirs to keep. That key-splitting is built but not switched on yet. 3. Bring the code to the data. Beneath it sits ElastOS, the open-source (MIT) runtime from the Elastos project, which Elacity helps build. It is designed so data stays in the owner's space and code comes to the data: apps and agents get only the access the owner grants, and the owner's runtime decides. It is designed around capabilities, not access control lists: the owner signs a narrow permission, and any lab holding it can use exactly that, without the owner keeping a list of every lab in advance. ElastOS is pre-release. Notice that the industry already half agrees. Bristol Myers trains inside a dedicated Tempus environment rather than taking the oncology data away. The model came to the data. The open question is whose space the data lives in. For why this market is real and not hypothetical, read AI training data licensing is a real market now. For what happens after a copy escapes, see why data broker deletion starts after the copy. More analysis lives under Market Intelligence. Your record, your terms. A hundred dollars per record is not a judgment on any one company. It is a price signal, and price signals end arguments about whether data is an asset. The remaining argument is who gets to hold it and set its terms. You were the product. Now you own the asset class. Follow Elacity on X for the next piece on owning the data AI is built on.

Written communications pursuant to Rule 425 under the Securities Act (17 CFR 230.425)

23andMe went bankrupt. Its founder bought it back for $305 million. 23andMe fell from a $6 billion market cap to Chapter 11. Anne Wojcicki won it back at a bankruptcy auction for $305 million through a nonprofit she formed. In June 2025, Anne Wojcicki won a bankruptcy auction for a company she already ran. Four years earlier, that same company - 23andMe, the DNA-testing business she co-founded in 2006 - had gone public at a $3.5 billion valuation and briefly traded at a $6 billion market cap. By the time she bid on it, it was a defendant in Chapter 11, and she was bidding against a pharmaceutical giant that had already won the first auction outright. She won the second one. The buyer of record wasn't Anne Wojcicki, private citizen, or a fund with her name on it - it was TTAM Research Institute, a nonprofit she had formed for exactly this purpose, weeks earlier. The founder didn't just get her company back. She had to invent a new kind of entity to do it. A bet that only worked if millions of strangers trusted her with their DNA. 23andMe's premise, when Wojcicki, Linda Avey and Paul Cusenza launched it in 2006, was that a $99 spit kit could tell ordinary people what a genetics lab used to tell only patients and researchers - and that enough of them would opt in to build something like a real-time genetic research database in the process. It worked well enough, well before it worked commercially: by 2013 the FDA had ordered the company to stop marketing its health-risk reports altogether, unconvinced that consumers could parse a genetic risk score without a doctor in the room. 23andMe spent roughly two years rebuilding its regulatory case before the FDA let health reports back on the market. The company's real asset was never really the test. It was the database the tests built - millions of customers' genetic and survey data, the majority of whom had opted into research use, which underwrote a $300 million equity investment and multi-year drug-discovery partnership from GlaxoSmithKline in 2018. That data business, not the one-time $99 kits, was the pitch behind 23andMe's 2021 debut on the Nasdaq via a SPAC merger with Richard Branson's VG Acquisition Corp., a deal that valued the company at $3.5 billion and briefly made Wojcicki a self-made billionaire on paper as the stock popped toward a $6 billion market cap on its first trading days. The single event that broke the trust the business was built on. The database that was 23andMe's whole thesis was also its single point of failure, and in October 2023 that failure arrived: hackers used credential stuffing - reusing passwords leaked from other breaches - to access accounts belonging to 6.9 million customers, including genetic ancestry data that in some cases named living relatives who had never used the service themselves. It became one of the largest genetic-privacy breaches on record. A coalition of 42 state attorneys general eventually reached a settlement valued at $150 million over the company's security practices - though bankruptcy's limited funds mean only about $18 million will actually be distributed among the states - and a separate consumer class action produced a $46.75 million settlement that a bankruptcy court approved in July 2026, nearly three years after the breach and well after the company that caused it had already ceased to exist in its original form. Revenue never recovered alongside the reputational damage. 23andMe cut its workforce five separate times between 2023 and late 2024, including a round that eliminated roughly 40% of remaining staff and shut down its therapeutics division entirely, taking headcount from over 800 employees to roughly 300. The board said no, and then there was no board left. By 2024, Wojcicki's response to the collapsing stock price was to try to take the company private, off the public markets entirely. Her board's seven independent directors rejected the terms of her proposal as insufficiently financed and not in the interest of outside shareholders - and on September 17, 2024, all seven resigned at once rather than keep negotiating with her, an extraordinary rebuke given that Wojcicki controlled roughly 49% of the company's voting power through a dual-class share structure. She called the walkout surprising and disappointing in a memo to staff. It did not change the trajectory: six months later, on March 23, 2025, 23andMe filed for Chapter 11 bankruptcy, and Wojcicki resigned as CEO the same day, explicitly to free herself to bid on the company's assets as an outside party rather than run a sale process she was also trying to win. Losing the first auction, and refusing to accept it. The bankruptcy court's first sale process produced a winner in May 2025: Regeneron Pharmaceuticals, the pharmaceutical company, agreed to buy substantially all of 23andMe's assets - its consumer genetics business, biobank and research operations - for $256 million. Wojcicki had bid too, through a newly formed nonprofit called TTAM Research Institute (an acronym for the company's own name), and lost. She did not let the result stand. Represented by the law firm Quinn Emanuel, Wojcicki's side pushed to reopen the closed auction, then out-bid Regeneron directly: on June 13, 2025, the bankruptcy court confirmed TTAM's $305 million offer as the winning bid, covering 23andMe's Personal Genome Service, its research division and its Lemonaid Health telehealth subsidiary. Regeneron, given the chance to counter, declined. The sale closed on July 14, 2025, and 23andMe - the consumer product, the brand, the millions of genetic profiles - became the property of a nonprofit medical research organization that Wojcicki had founded specifically to make that outcome possible, and now runs. Enjoying this? Get more weekly. Weekly. No spam. Unsubscribe anytime. "I am thrilled that TTAM Research Institute will be able to continue the mission of 23andMe to help people access, understand and benefit from the human genome," Wojcicki said in a statement announcing the deal. What founders should actually take from it. The instinct is to read this as a story about a founder's stubborn loyalty to her own company - nice, but not a strategy anyone else can copy. What's more specifically useful is what the two auctions reveal about control. Wojcicki's roughly 49% voting stake wasn't enough to force a private buyout past an independent board that didn't trust her price; the board would rather dissolve itself than approve it. But that same conviction, redirected into a bankruptcy court's asset sale - a process that runs on cash bids and legal standing, not board votes - was enough to beat a company with a market cap thousands of times larger than what she was raising to bid. The nonprofit structure did real work here too, beyond the optics of "protecting user data from a drugmaker." A public-benefit nonprofit can commit, in writing, to things a for-profit acquirer structurally can't promise as credibly - that the genetic data of 15 million-plus customers won't get sold again to the next distressed buyer down the line. That commitment was plausibly worth real money in a courtroom full of state attorneys general watching the sale for exactly that risk. The harder lesson is the one before the rescue: none of this was recoverable by better execution once the 2023 breach happened. A trust-based data business survives a security failure only as well as its response to it, and 23andMe's stock had lost effectively all its value within eighteen months of the breach, board revolt and bankruptcy that followed. Winning the company back was a legal and financial feat. It was not a fix for what broke it in the first place - and the $46.75 million settlement customers are still collecting in 2026 is the reminder that the bill for that failure outlived the company that ran up the tab. Featured on Future Sharks entrepreneurs · September 2026 Proud of this one? Share it. Put the badge on your site Future Sharks is the founder publication for the people building what comes next - covering 2,000+ entrepreneurs, operators, and investors since 2017. Join the inside track. Founder stories, capital moves, and the signals shaping the next era of business - weekly. No spam. Unsubscribe anytime.