Company: DARE
Filing Date: 2025-04-24
Form Type: ARS
Source: 0001401914-25-000018
Chunk: 103

Company: Dare Bioscience, Inc.
Filing Date: 2025-04-24
Form: ARS
Chunk 103
---
 breach cases as unfair and/or deceptive acts or practices under the FTC Act and comparable state laws. State laws protecting health and personal information are becoming increasingly stringent. For example, California has implemented the California Confidentiality of Medical Information Act that imposes restrictive requirements regulating the use and disclosure of health information and other personally identifiable information, and California has adopted the California Consumer Privacy Act of 2018, or CCPA, which went into effect in January of 2020. The CCPA mirrors a number of the key provisions of the European General Data Protection Regulation, or GDPR, described below. The CCPA establishes a new privacy framework for covered businesses by creating an expanded definition of personal information, establishing new data privacy rights for consumers in the State of California, imposing special rules on the collection of consumer data from minors, requiring covered companies to provide new disclosures to consumers about such companies' practices for collection and use of consumer data, and providing customers new ways to opt-out of certain sales or transfers of personal information. In addition, the CCPA creates a new and potentially severe statutory damages framework for violations of the CCPA and for businesses that fail to implement reasonable security procedures and practices to prevent data breaches. While there is currently an exception for protected health information that is subject to HIPAA and clinical trial regulations, as currently written, the CCPA may impact our business activities. More recently, a new privacy law, the California Privacy Rights Act, or CPRA, was approved by California voters in the election on November 3, 2020. The CPRA went into effect in January of 2023, modifying and strengthening the CCPA significantly, potentially resulting in further uncertainty, additional costs and expenses in an effort to comply and additional potential for harm and liability for failure to comply. Among other things, the CPRA established a new regulatory authority, the California Privacy Protection Agency, which will be enacting new regulations and will have expanded enforcement authority. Various states such as Colorado, 50

Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia have enacted their own privacy laws similar to the CCPA, and other states are considering proposals for such. Health Care Reform and Potential Changes to Laws and Regulations In the United States and some foreign jurisdictions, there have been, and continue to be, several legislative and regulatory changes and proposed changes regarding the healthcare system that could prevent or delay marketing approval of product candidates, restrict or regulate post-approval