Company: PTHS
Filing Date: 2025-05-27
Form Type: DEFM14C
Source: 0001140361-25-020509
Chunk: 161

Company: Pelthos Therapeutics Inc.
Filing Date: 2025-05-27
Form: DEFM14C
Chunk 161
---
 and state consumer protection laws. Each of these laws is subject to varying interpretations by courts and government agencies, creating complex compliance issues. If LNHC fails to comply with applicable laws and regulations, LNHC could be subject to penalties or sanctions, including criminal penalties if LNHC knowingly obtains or discloses individually identifiable health information from a covered entity in a manner that is not authorized or permitted by HIPAA or applicable state laws. HIPAA imposes, among other things, certain standards relating to the privacy, security, transmission, and breach reporting of individually identifiable health

88

#### TABLE OF CONTENTS
information. LNHC may obtain health information from third parties (including research institutions from which LNHC obtains clinical trial data) that are subject to privacy and security requirements under HIPAA. Depending on the facts and circumstances, LNHC could be subject to significant penalties if we violate HIPAA.

Certain states have also adopted comparable privacy and security laws and regulations, which govern the privacy, processing and protection of health-related and other personal information. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for LNHC and its future customers and strategic partners. For example, the California Consumer Privacy Act of as amended by the California Privacy Rights Act (collectively, the “CCPA”) requires covered businesses that process the personal information of California residents to, among other things: (i) provide certain disclosures to California residents regarding the business’s collection, use, and disclosure of their personal information; (ii) receive and respond to requests from California residents to access, delete, and correct their personal information, or to opt out of certain disclosures of their personal information; and (iii) enter into specific contractual provisions with service providers that process California resident personal information on the business’s behalf. Additional compliance investment and potential business process changes may be required. Similar laws have passed in other states and are continuing to be proposed at the state and federal level, reflecting a trend toward more stringent privacy legislation in the United States. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging. In the event that LNHC is subject to or affected by HIPAA, the CCPA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect LNHC’s financial condition.

LNHC is also or may become subject to rapidly evolving data protection laws, rules and regulations in foreign jurisdictions. For example, the European Union General Data Protection Regulation (“GDPR”) went into effect