Company: SCLXW
Filing Date: 2025-12-29
Form Type: 424B3
Source: 0001193125-25-335429
Chunk: 329

Company: Scilex Holding Co
Filing Date: 2025-12-29
Form: 424B3
Chunk 329
---
 other regulators. Various U.S. states have implemented privacy laws and regulations that regulate the use and disclosure of health information and other personal information. For example,
the CCPA, established a privacy framework for covered businesses by, among other items, expanding the definition of personal information, establishing new data privacy rights for consumers who are California residents, imposing rules on the
collection of personal information from minors, and creating a statutory damages framework for violations of the CCPA, including for failure to implement reasonable security procedures and practices to prevent data breaches. Penalties for violations
of the CCPA include civil penalties and may result in related legal claims. The CPRA, most provisions of which became operative on January 1, 2023, introduced significant amendments to the CCPA and established and funded a dedicated California
privacy regulator, the California Privacy Protection Agency. Several other states have implemented similar consumer privacy laws that took effect in the past year or will take effect in the near future. Further, Washington’s My Health My Data
Act, taking effect July 1, 2024, imposes requirements specific to consumer health data. The foregoing U.S. state privacy laws impose many similar obligations as the CCPA on our processing of personal information. Other U.S. states are
considering similar privacy legislation, and industry organizations regularly adopt and advocate for new standards in these areas. The uncertainty, ambiguity, complexity, and potential inconsistency surrounding the implementation and interpretation
of the CCPA and other enacted or forthcoming U.S. state privacy laws exemplify the vulnerability of our business to the evolving regulatory environment related to the privacy, security and confidentiality of personal information and protected health
information. We may be subject to fines, penalties, or private actions in the event of non-compliance with such laws.

Our activities outside of the U.S. implicate local, state, provincial, and national data protection standards, impose additional compliance
requirements and generate additional risks of enforcement for non-compliance. Such laws may also restrict the access, use and disclosure of patient health information abroad. We may be

220

required to expend significant capital and other resources to ensure ongoing compliance with applicable privacy and data security laws, to protect against security breaches and hackers, or to
remediate issues caused by such breaches. Compliance with these laws is challenging, constantly evolving, time consuming, and requires a flexible privacy framework and substantial resources. Compliance efforts will likely be an increasing and
substantial cost in the future.

The U.S. federal Physician Payments Sunshine Act requires certain manufacturers of drugs,