Company: INKT
Filing Date: 2025-03-18
Form Type: 10-K
Source: 0000950170-25-041379
Chunk: 82

Company: MiNK Therapeutics, Inc.
Filing Date: 2025-03-18
Form: 10-K
Item: Item 1A
Chunk 82
---
 of which could have a material adverse effect on our business, financial condition, results of operations or prospects. 

There are numerous U.S. federal and state laws and regulations related to the privacy and security of personal information. For example, HIPAA and its implementing regulations establish privacy and security standards that limit the use and disclosure of individually identifiable health information, or protected health information, and require the implementation of administrative, physical and technological safeguards to protect the privacy of protected health information and ensure the confidentiality, integrity and availability of electronic protected health information. We have also assumed contractual obligations related to protecting the privacy and security of personal information. While we have determined that we are neither a “covered entity” nor a “business associate” directly subject to HIPAA, many of the U.S. health care providers, including U.S. clinical trial sites, with which we interact are subject to HIPAA, and we have assumed contractual obligations related to protecting the privacy of personal information. Determining whether protected health information has been handled in compliance with applicable privacy standards and our contractual obligations can be complex and may be subject to changing interpretation. 

If we are unable to properly protect the privacy and security of protected health information, we could be found to have breached our contracts and we could face civil and criminal penalties. 

In addition, we may be subject to privacy and security laws in the various jurisdictions in which we operate, obtain or store personally identifiable information. The legislative and regulatory landscape for privacy and data protection continues to evolve, and there has been an increasing focus on privacy and data protection issues with the potential to affect our business. For example, the processing of personal data in the European Economic Area (the “EEA”), is subject to the General Data Protection Regulation (the "GDPR"), which took effect in May 2018. The GDPR increases obligations with respect to clinical trials conducted in the EEA, such as in relation to 

 39

the provision of fair processing notices, responding to data subjects who exercise their rights and reporting certain data breaches to regulators and affected individuals. The GDPR also requires us to enter certain contractual arrangements with third parties that process GDPR-covered personal data on our behalf. The GDPR also increases the scrutiny applied to transfers of personal data from the EEA (including from clinical trial sites in the EEA) to countries that are considered by the European Commission to lack an adequate level of data protection, such as the United States. The July 2020 invalidation by the Court of Justice of the European Union of the EU-U.S. Privacy Shield