Company: IPHYF
Filing Date: 2025-04-30
Form Type: 20-F
Source: 0001598599-25-000042
Chunk: 27

Company: Innate Pharma SA
Filing Date: 2025-04-30
Form: 20-F
Item: Item 3
Chunk 27
---
 to be in violation of any of these laws or any other governmental regulations that may apply to us, the Company may be subject to significant civil, criminal and administrative penalties, damages, fines, disgorgement, imprisonment, possible exclusion from government funded healthcare programs, such as Medicare and Medicaid, additional reporting requirements and oversight if the Company becomes subject to a corporate integrity agreement or similar agreement to resolve allegations of non-compliance with these laws, contractual damages, reputational harm, diminished profits and future earnings, and curtailment of its operations, any of which could substantially disrupt its operations. If the physicians or other providers or entities with whom the

Company expects to do business are found not to be in compliance with applicable laws, they may be subject to criminal, civil or administrative sanctions, including exclusions from government funded healthcare programs. Should any of these risks materialize, this could have a material adverse effect on its business, prospects, reputation, financial condition and results of operations.

European data collection is governed by restrictive regulations governing the collection, use, processing and cross-border transfer of personal information.

The Company may collect, process, use or transfer personal information from individuals located in the European Union in connection with its business, including in connection with conducting clinical studies in the European Union. The collection and use of personal health data in the European Union are governed by the provisions of the General Data Protection Regulation ((EU) 2016/679) (GDPR). This legislation imposes requirements relating to having legal bases for processing personal information relating to identifiable individuals and transferring such information outside of the European Economic Area (EEA), including to the United States, providing details to those individuals regarding the processing of their personal information, keeping personal information secure, having data processing agreements with third parties who process personal information, responding to individuals’ requests to exercise their rights in respect of their personal information, reporting security breaches involving personal data to the competent national data protection authority and affected individuals, appointing data protection officers, conducting data protection impact assessments and record-keeping. The GDPR applies across the European Economic Area (EEA) and, by virtue of the GDPR as it forms part of United Kingdom law, in a broadly uniform manner through section 3 of the European Union (Withdrawal) Act 2018, or the UK GDPR, in the United Kingdom. However, the GDPR provides that EEA member states can make their own further laws and regulations to introduce specific requirements related to the processing of "special categories of personal data," including personal data related to health, biometric data