Company: LENZ
Filing Date: 2025-05-07
Form Type: 10-Q
Source: 0001815776-25-000032
Chunk: 162

Company: LENZ Therapeutics, Inc.
Filing Date: 2025-05-07
Form: 10-Q
Item: Part I, Item 4
Chunk 162
---
 privacy, data protection, and cybersecurity. We may incur liabilities, expenses, costs, and other operational losses under the GDPR and local laws of applicable EU member states, the UK, and other regions in connection with any measures we take to comply with them. 

In the United States, in addition to HIPAA, HITECH and state laws addressing health-related information, numerous federal and state laws and regulations govern the collection, use, disclosure, and other processing of information relating to individuals. In California, the California Consumer Privacy Act (“CCPA”) requires covered companies to provide disclosures to consumers about such companies’ data collection, use and sharing practices, provide such consumers ways to opt-out of certain sales or transfers of personal information, and provide consumers with additional causes of action in data breach situations. The CCPA went into effect on January 1, 2020, and was modified significantly by the California Privacy Rights Act (“CPRA”), which was approved by California voters in the November 3, 2020 election and became effective January 1, 2023. The CCPA has prompted numerous proposals for federal and state privacy legislation. Numerous U.S. states have proposed, and in certain cases enacted, laws addressing privacy and cybersecurity matters. Many of these laws are comprehensive privacy statutes imposing obligations similar to the CCPA. Certain U.S. states also have enacted laws and regulations addressing specific subject matter, such as Washington’s My Health, My Data Act, which, among other things, provides for a private right of action. 

Compliance with U.S. and international laws and regulations relating to privacy, data protection, and cybersecurity could require us to take on more onerous obligations in our contracts, restrict our ability to collect, use and disclose data, or in some cases, impact our ability to operate in certain jurisdictions, and may increase our costs of doing business and require us to change our policies and practices. Any actual or alleged failure to comply with U.S. or international laws and regulations relating to privacy, data protection, or cybersecurity could result in governmental investigations, proceedings, and enforcement actions (which could include civil or criminal penalties), private litigation or adverse publicity, harm to our reputation, and could negatively affect our operating results and business. Moreover, clinical trial subjects about whom we or our potential collaborators obtain information, as well as the providers who share this information with us, may contractually limit our ability to use and disclose the information or impose other obligations or restrictions in connection with our use, retention, and other processing of information, and