Company: QTIWW
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001844505-25-000038
Chunk: 63

Company: QT IMAGING HOLDINGS, INC.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1
Chunk 63
---
 of Section 5(a) of the Federal Trade Commission Act, 15 U.S.C § 45(a). The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards. The 

46

FTC’s guidance for appropriately securing consumers’ personal information is similar to what is required by the HIPAA Security Rule.

In addition, certain state and non-U.S. laws, such as the European Union’s General Data Protection Regulation (2016/679) (“GDPR”), govern the privacy and security of health information in certain circumstances, some of which are more stringent than HIPAA and many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Further, “business associates,” defined as independent contractors or agents of covered entities that create, receive, maintain or transmit protected health information in connection with providing a service for or on behalf of a covered entity, are also subject to certain HIPAA privacy and security standards. Failure to comply with these laws, where applicable, can result in the imposition of significant civil and/or criminal penalties and private litigation. For example, California recently enacted legislation, the California Consumer Privacy Act (“CCPA”), which went into effect January 1, 2020. The CCPA, among other things, creates new data privacy obligations for covered companies and provides new privacy rights to California residents, including the right to opt out of certain disclosures of their information. The CCPA also creates a private right of action with statutory damages for certain data breaches, thereby potentially increasing risks associated with a data breach. Although the law includes limited exceptions, including for PHI maintained by a covered entity or business associate, it may regulate or impact our expected processing of personal information depending on the context. In Europe, the GDPR went into effect in May 2018 and introduces strict requirements for processing the personal data of European Union data subjects. Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance of up to €20 million or 4% of the annual global revenues of the noncompliant company, whichever is greater. The State of Israel has also implemented data protection laws and regulations, including the Israeli Protection of Privacy Law of 1981.

Foreign Regulation