By DEEKSHA HEGDE
I had an itch to draw parallels between the two. The structural facts kept lining up in ways I couldn’t dismiss, and by the end, I stopped trying.
Function’s product is an app: you pay $365 a year, go to a Quest Diagnostics location, get 160+ biomarkers tested twice a year, and receive clinician-written notes interpreting your results. The lab testing is fully outsourced. Function is the layer on top: panel design, member experience, clinician note generation, longitudinal tracking.
Function Health raised $298 million at a $2.5 billion valuation in November 2025. At 25x revenue, the market clearly isn’t buying a lab reseller. It’s buying the data flywheel: longitudinal biomarker histories that compound in clinical value over time, aggregated across hundreds of thousands of members into a dataset that health plans, pharma companies, and AI developers can’t build any other way. A member with four years of data can’t switch to a cheaper competitor without losing the trend. The unit economics work if the interpretation layer scales without proportionally scaling headcount, which is what the Medical Intelligence Lab, their generative AI model launched in November 2025, is built to do. Function is also building toward a B2B enterprise channel, positioning the product as a way to keep employees “healthy, focused, and ready to perform.”
It satisfies a burning need for specific personas: the worried well, the health optimizers, the people who saw their loved ones get diagnosed a little too late, the people who aren’t waiting for a diagnosis before they start paying attention. These are people the rest of the industry has mostly left alone. I wrote earlier this year, in a piece on Hinge Health, about the prevention paradox: the employer ROI model is structurally blind to the member who benefits most from early intervention. Function skips the employer ROI story entirely, charges the member directly, and doesn’t try to prove a CFO case it can’t make. Yet.
Take apoB, short for apolipoprotein B, one of Function’s most prominently advertised biomarkers, a better predictor of cardiovascular risk than the LDL test most annual physicals still rely on. The Swedish AMORIS cohort study followed 137,000 people for an average of 17.8 years and found that elevated apoB separates cases from controls roughly 20 years before a major cardiovascular event, with the gap sharpening over the decade closest to the event. Catch it, act on it — statins, dietary changes, closer monitoring — and you could prevent a heart attack. That’s real clinical value.
Now run the employer math. Median private sector tenure in the United States is 3.5 years. The employer funding the Function membership will almost certainly not be insuring this person when that cardiovascular event materializes. The avoided cost accrues to whoever covers them in fifteen years. The CFO writing the check today captures none of it. What Function is actually selling right now to employers is a wellness perk. Higginbotham, an insurance broker, announced a partnership in January 2026 offering Function to employees at $334 instead of $365. A $31 discount. You don’t build a $2.5 billion company on a gym stipend.
What health plans and pharma partners would actually pay for doesn’t exist yet: actuarial risk models and research datasets built on years of longitudinal biomarker data at scale. The D2C subscription is the data acquisition engine for that product. Everything depends on the flywheel running long enough to close the gap.
That’s where the 23andMe comparison clicked for me.
23andMe was a D2C health data company whose valuation rested on a data monetization thesis: pharma research partnerships, data licensing. Kit sales alone couldn’t justify it. It wasn’t a HIPAA-covered entity, and it collected sensitive health data under a privacy policy that reserved the right to transfer it in a sale or bankruptcy. The consumer marketing, though, never said any of this. 23andMe led with ancestry, which made it viral, emotionally sticky, and FDA-adjacent rather than FDA-regulated. Health reports were the upsell. “Contributing to science” was how they framed data acquisition: altruism, not a transaction. The GSK partnership ($300 million for research access to the genetic database) was disclosed in the terms of service, for the people who read the fine print. When the business failed, the data was a sellable asset, and Regeneron grabbed it in a garage sale.
Function is structurally similar, with higher stakes on every dimension. D2C health data company, data monetization thesis: enterprise risk models, research partnerships, AI. Also not a HIPAA-covered entity. It doesn’t bill insurance and isn’t a covered healthcare provider, which means the legal protections most members assume apply to their health data don’t. The same bankruptcy transfer loophole that caught 23andMe’s members would catch Function’s too.
23andMe’s revenue model was broken from day one: buy a kit once, done. Function has recurring subscriptions and real switching costs. 23andMe also imploded trying to become a therapeutics company, a pivot that required capabilities entirely foreign to what it had. Function’s monetization path is at least adjacent to what it already does.
But the regulatory exposure is identical, and that window is closing. The FTC updated its Health Breach Notification Rule in April 2024, explicitly extending it to health apps and D2C platforms, and has already used it against GoodRx, Premom, and BetterHelp. HIPRA, the Health Information Privacy Reform Act introduced in November 2025, would extend HIPAA-equivalent obligations to exactly the category of company Function is.
The data Function holds makes this exposure worse. 23andMe held genetic predisposition data: probabilistic, future-oriented, a risk modifier. Function’s biomarker data is current: thyroid function, metabolic status, hormonal profile, cardiovascular markers, updated twice a year. More actionable, more temporally precise, more directly useful to anyone making decisions based on your health.
Which leads to a problem Function hasn’t fully named. Their D2C brand runs on a specific promise: your data is yours, and we’re helping you understand it. That’s what acquired 200,000 members. 23andMe acquired its first millions the same way, using aspirational identity marketing to capture data assets, while the actual value creation required a B2B transaction that the consumer marketing never prepared the user for. Function’s member base skews more sophisticated than 23andMe’s ever did — these are people who already believe their data has clinical value. Function’s marketing hasn’t built the narrative architecture yet to invite them into a transaction they’re already in.
The playbook exists. Oura chose the NBA and UCSF as research partners. These are institutions that made members feel like participants in something elite and scientific. Whoop publishes findings using aggregate member data. In both cases, the same underlying data transaction reads as an identity-enhancing contribution because the framing was built into the brand from the start, not buried in the terms of service. Function’s biomarker data is more clinically sensitive than wearable data like HRV and sleep stages, and its B2B thesis more load-bearing, which means the same playbook needs more rigor in execution. Partner selection is brand work: the first disclosed research partnerships will set the frame for everything. Publishing findings normalizes the data relationship while building the product validity case Function needs before health plans will write a check.
Function is already executing on parts of this playbook — the NBPA partnership in February 2026 brings biomarker testing to professional athletes, and the brand signal is real. But a distribution deal isn’t a research relationship. What’s missing is research partnerships structured to produce and publish findings, the kind that turn distribution into evidence, and evidence into retention.
There’s another layer that neither Oura nor Whoop has built. Proactive data governance is what makes the contribution framing credible rather than just brand copy. Function currently describes itself as “HIPAA-aligned”, following key requirements of the Security Rule voluntarily. That’s the gap in one phrase. Security practices without legal commitment don’t close the bankruptcy transfer loophole, don’t satisfy IRB consent requirements for future pharma partners, and don’t give insurance partners the assurance they need to license a dataset without importing regulatory exposure. Adopting HIPAA-equivalent data handling before HIPRA passes and framing it as a product decision rather than a compliance response protects the flywheel from being dismantled before it matures.
Function has a window to act on its own terms. 23andMe waited for regulators to write the rules and became the cautionary tale those rules were named after. Function could write the playbook instead.
Deeksha Hegde is a bioengineer who writes about healthtech and digital health positioning on Substack.
