Company: TVRD
Filing Date: 2025-02-14
Form Type: 424B3
Source: 0001104659-25-014310
Chunk: 229

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-02-14
Form: 424B3
Chunk 229
---
collectively, sensitive data). The global data protection landscape is rapidly evolving and Tvardi is or may become subject to numerous data privacy and security obligations, such as various state, federal and foreign laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations governing the collection use, disclosure, retention, and security of personal information or otherwise relating to data privacy and security, including as relates to information that Tvardi may collect in connection with clinical trials in the United States and abroad.

Various federal, state, local and foreign legislative and regulatory bodies, or self-regulatory organizations, may expand current laws, rules or regulations, enact new laws, rules or regulations or issue revised rules or guidance regarding data privacy and security. Implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and Tvardi cannot yet determine the impact future laws, regulations, standards, or perception of their requirements may have on its business. This evolution may create uncertainty in Tvardi’s business, affect its ability to operate in certain jurisdictions or to collect, store, transfer use and share personal information, necessitate the acceptance of more onerous obligations in its contracts, result in liability or impose additional costs on Tvardi. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the future. Any failure or perceived failure by Tvardi to comply with federal, state or foreign laws or regulations, its internal policies and procedures or its contracts governing the processing of personal information could result in negative publicity, government investigations and enforcement actions, claims by third parties and damage to Tvardi’s reputation, any of which could have a material adverse effect on its business, results of operation, and financial condition.

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, data privacy laws, and other similar laws. For example, HIPAA, as amended by HITECH (collectively, HIPAA), imposes among other things, certain requirements relating to the privacy, security, transmission, and breach of individually identifiable health information. Tvardi may obtain health information from third parties (including research institutions from which it obtains clinical trial data) that are subject to privacy and security requirements under HIPAA. Depending on the facts and circumstances, Tvardi could be subject to significant penalties if it violates HIPAA.

Certain states have also adopted comparable privacy and security laws and regulations, which govern the privacy,