Company: VERA
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000950170-25-029969
Chunk: 54

Company: Vera Therapeutics, Inc.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 54
---
 of revenue or profits; and other adverse business consequences.

In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) personal data and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, information we collect about trial participants in connection with clinical trials, and sensitive third-party information (collectively, sensitive information). Our data processing activities subject us to numerous obligations relating to data privacy and security, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual obligations and other obligations relating to data privacy and security. 

Outside the United States, an increasing number of laws, regulations and industry standards govern data privacy and security. For example, the EU’s General Data Protection Regulation (EU GDPR) and the UK’s Data Protection Act 2018 (UK GDPR) (collectively, GDPR), Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Australia’s Privacy Act, India’s Information Technology Act, China’s Personal Information Protection Law (PIPL) and South Korea’s Personal Information Protection Act impose strict requirements for processing of personal data, including clinical trials participants and other individuals. For instance, companies that violate the GDPR can face private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests, temporary or definitive prohibitions on data processing and other corrective actions, fines of up to the greater of 20 million Euros under the EU GDPR / 17.5 million pounds under the UK GDPR, or 4% of their worldwide annual revenue, whichever is higher. Furthermore, China’s PIPL imposes a set of specific obligations on covered businesses in connection with their processing and transfer of personal data and imposes fines of up to RMB 50 million or 5% of the prior year’s total annual revenue of the violator.

In addition, we may be unable to transfer personal data from Europe and other jurisdictions to the United States or other countries due to data localization requirements or limitations on cross-border data flows. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area (EEA) and the UK have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it generally believes are inadequate. Other jurisdictions may adopt or have already adopted similarly