Company: MIRM
Filing Date: 2025-08-06
Form Type: 10-Q
Source: 0001759425-25-000041
Chunk: 470

Company: Mirum Pharmaceuticals, Inc.
Filing Date: 2025-08-06
Form: 10-Q
Item: Part I, Item 8
Chunk 470
---
, transmit, and share (collectively, “process”) personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, data we collect about trial participants in connection with clinical trials, and sensitive third-party data.

Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contracts, and other obligations that govern the processing of personal data by us and on our behalf. In the U.S., federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, HIPAA, as amended by HITECH, imposes specific requirements relating to the privacy, security, and transmission of individually identifiable health information. Additionally, the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (“CAN-SPAM”) and Telephone Consumer Protection Act (“TCPA”) imposes specific requirements on communications with customers. In particular, the TCPA imposes various consumer consent requirements and other restrictions relating to marketing to individuals using technology such as telephones, mobile devices, and text messages. TCPA violations can result in significant financial penalties, including penalties or criminal fines imposed by the Federal Communications Commission or fines of up to $1,500 per violation imposed through private litigation or by state authorities. 

Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, at the state level, the California Consumer Privacy Act, as amended, (“CCPA”), applies to personal data of California consumers, business representatives and employees, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for fines for violations