Company: BDRX
Filing Date: 2025-01-28
Form Type: 424B3
Source: 0001214659-25-001409
Chunk: 70

Company: Biodexa Pharmaceuticals Plc
Filing Date: 2025-01-28
Form: 424B3
Chunk 70
---
 operations or the operations of our partners, including state data breach notification laws, state health information privacy laws, and federal and state consumer protection laws and regulations, that govern the collection, use, disclosure, and protection of health-related and other personal information. In addition, we may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy and security requirements under HIPAA, as amended by HITECH and regulations promulgated thereunder. Depending on the facts and circumstances, we could be subject to significant penalties if we obtain, use, or disclose, or are subject to an actual or alleged data breach regarding, individually identifiable health information in a manner that is not authorized or permitted by HIPAA.

| 36 |

In addition, various U.S. states have enacted privacy and security laws and regulations, and such laws and regulations vary from state to state, constantly evolve, and remain subject to significant change. In some cases, such laws and regulations can impose more restrictive requirements than HIPAA and other U.S. federal laws, thus complicating compliance efforts. By way of example, California has enacted the California Consumer Privacy Act, or CCPA, which went into effect in January of 2020. The CCPA established a new privacy framework for covered businesses by creating an expanded definition of personal information, establishing new data privacy rights for California residents, requiring covered business to provide new disclosures to California residents, and creating a new and potentially severe statutory damages framework for violations of the CCPA and for businesses that fail to implement reasonable security procedures and practices to prevent data breaches. Additionally in 2020, California voters passed the California Privacy Rights Act, or CPRA, which went into full effect on January 1, 2023. The CPRA significantly amends the CCPA, potentially resulting in further uncertainty, additional costs and expenses in an effort to comply and additional potential for harm and liability for failure to comply. Among other things, the CPRA established a new regulatory authority, the California Privacy Protection Agency, which is tasked with enacting new regulations under the CPRA and will have expanded enforcement authority. In addition to California, more U.S. states are enacting similar legislation, increasing compliance complexity, and increasing risks of failures to comply. In 2023, comprehensive privacy laws in Virginia, Colorado, Connecticut, and Utah all took effect, and laws in Montana, Oregon, and Texas will take effect in 2024. In addition, laws in other U.S. states are set to