This is to certify that the Information Security Management System of: CERTIFICATE OF REGISTRATION ISO/IEC 27001: 2013 Information Security Management System 23andMe 899 West Evelyn Avenue Mountain View, California 94041 U.S.A. Issued by: This certificate was issued electronically and is bound by the terms and conditions set forth in the agreement. Further clarification regarding the scope of this certificate and applicability to the ISO/IEC 27001: 2013 standard may be obtained at www.a-lign.com. A-LIGN Headquarters: 400 N. Ashley Dr. Suite 1325 Tampa, Florida 33602 Tel: 888-702-5446 Issue Date: 8/20/2019 Certificate Number: SEC1787 v1.0 Statement of Applicability: 2.0 (6/11/2019) Expiry Date: 8/20/2022 EVP, Compliance Services Conforms with the requirements of ISO/IEC 27001: 2013 for the scope listed below: The information security management system for securing the information assets that supports all the processes related to saliva-based direct-to-consumer (DTC) genetic testing business unit, Research/Clinical Trial Recruitment business unit, and Therapeutics business unit. Page 1 of 2