Indeed, that is rather outrageous. It runs afoul of pretty much any current conception of information privacy; I'm pretty sure what they're doing would be illegal in the EU, as long as saliva counts as personal information. It's pretty standard anyway for anyone who's collecting your personal information to tell you what it will and will not be used for.