I had the same thought when considering sending DNA to 23andme, which is a US company. Having your processed DNA in some database exposes you to a lot of potential risks with little upside.
Is it not possible to ask them to delete all my DNA data? My subscription will end soon, can I just ask them to delete it completely in a clear worded email to make sure there is no misunderstanding as to what I mean by "deleted"? Will EU laws protect me from this or are they irrelevant since they are a US company?
If you do business in the EU, you must comply to EU laws. And to remove doubt, a person physically located in EU counts as being in the EU. At least that was what I was advised, but IANAL, this is not financial advice etc.