Company: MIRM
Filing Date: 2025-08-06
Form Type: 10-Q
Source: 0001759425-25-000041
Chunk: 161

Company: Mirum Pharmaceuticals, Inc.
Filing Date: 2025-08-06
Form: 10-Q
Item: Part I, Item 4
Chunk 161
---
 the Biden administration’s executive order Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern, which went into effect April 8, 2025.

In addition, we are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. Additionally, some of our customer contracts require us to host personal data locally. We also publish privacy policies, marketing materials and other statements, such as statements related to compliance with certain certifications or self-regulatory principles, concerning artificial intelligence, data privacy and security. Regulators in the United States may scrutinize these statements, and if these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading or misrepresentative of our practices, we may be subject to adverse consequences.

Obligations related to data privacy and security (and consumers’ data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires significant resources and may necessitate changes to our information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. 

59

Although we endeavor to comply with our data privacy and security obligations, we may at times fail (or be perceived to have failed) to do so. Moreover, despite our efforts, our personnel or third parties with whom we work may fail to comply with such obligations, which could negatively impact our business operations and compliance posture. 

Our, or the third parties with whom we work, actual or perceived failure to adequately comply with applicable laws and regulations relating to privacy and data protection, or to protect personal data and other data we process or maintain, could result in adverse consequences, including regulatory fines and bans on processing personal data, government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar), litigation (including class action claims), mass arbitration demands, and other liabilities, claims for damages by affected individuals, orders to destroy or not use personal data, imprisonment of company officials, additional reporting requirements and/or oversight, interruptions or stoppages in our business operations (including, as relevant, clinical trials), and damage to our reputation. Any of these consequences could have a material adverse effect on our business, financial condition, results of operations and growth prospects, including but not limited to: loss of customers;