In the US that is not legal per the GINA act. Note that that is specific to health insurance. Life insurance can legally use that data. And laws can be broken often with less penalty than the profit made from violating them. And data can be retained much longer than laws exist so the GINA act could be repealed or updated at some point allowing companies to legally use the data already acquired.