Company: DRTSW
Filing Date: 2025-03-12
Form Type: 20-F
Source: 0001213900-25-023187
Chunk: 42

Company: Alpha Tau Medical Ltd.
Filing Date: 2025-03-12
Form: 20-F
Item: Item 3
Chunk 42
---
.

Actual or perceived failures to comply with
applicable data protection, privacy and security laws, regulations, standards and other requirements could adversely affect our business,
financial condition and prospects.

The global data protection
landscape is rapidly evolving, and we are or may become subject to numerous state, federal and foreign laws, requirements and regulations
governing the collection, use, disclosure, retention, and security of personal information, such as information that we may collect in
connection with clinical trials in the U. S. and abroad. Implementation standards and enforcement practices are likely to remain uncertain
for the foreseeable future, and we cannot yet determine the impact future laws, regulations, standards, or perception of their requirements
may have on our business. This evolution may create uncertainty in our business, affect our ability to operate in certain jurisdictions
or to collect, store, transfer use and share personal information, necessitate the acceptance of more onerous obligations in our contracts,
result in liability or impose additional costs on us. The cost of compliance with these laws, regulations and standards is high and is
likely to increase in the future. Any failure or perceived failure by us to comply with federal, state or foreign laws or regulation,
our internal policies and procedures or our contracts governing our processing of personal information could result in negative publicity,
government investigations and enforcement actions, claims by third parties and damage to our reputation, any of which could have a material
adverse effect on our business, financial condition and prospects.

As our operations and business
grow, we may become subject to or affected by new or additional data protection laws and regulations and face increased scrutiny or attention
from regulatory authorities. For example, the State of Israel has implemented data protection laws and regulations, including the Israeli
Protection of Privacy Law of 1981. Further, in the U. S., HIPAA imposes, among other things, certain standards relating to the privacy,
security, transmission and breach reporting of individually identifiable health information. Most healthcare providers, including research
institutions from which we obtain patient health information, are subject to privacy and security regulations promulgated under HIPAA.
While we do not believe that we are currently acting as a covered entity or business associate under HIPAA and thus are not directly regulated
under HIPAA, any person may be prosecuted under HIPAA’s criminal provisions either directly or under aiding-and-abetting or conspiracy
principles. Consequently, depending on the facts and circumstances, we could face substantial criminal penalties if we knowingly receive
individually identifiable