Company: TVRD
Filing Date: 2025-02-14
Form Type: S-4/A
Source: 0001104659-25-013053
Chunk: 231

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-02-14
Form: S-4/A
Chunk 231
---
 Tvardi to comply with federal, state or foreign laws or regulations, its internal policies and procedures or its contracts governing the processing of personal information could result in negative publicity, government investigations and enforcement actions, claims by third parties and damage to Tvardi’s reputation, any of which could have a material adverse effect on its business, results of operation, and financial condition.

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, data privacy laws, and other similar laws. For example, HIPAA, as amended by HITECH (collectively, HIPAA), imposes among other things, certain requirements relating to the privacy, security, transmission, and breach of individually identifiable health information. Tvardi may obtain health information from third parties (including research institutions from which it obtains clinical trial data) that are subject to privacy and security requirements under HIPAA. Depending on the facts and circumstances, Tvardi could be subject to significant penalties if it violates HIPAA.

Certain states have also adopted comparable privacy and security laws and regulations, which govern the privacy, processing and protection of health-related and other personal information. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for Tvardi and its future customers and strategic partners. For example, the California Consumer Privacy Act (CCPA), went into effect on January 1, 2020 and applies to the personal information of California consumers, business representatives, and employees, and increases the privacy and security obligations of entities handling certain personal information, including among other things, requiring businesses to provide specific disclosures in privacy notices and honor requests of

<div align='center'>129</div>

TABLE OF CONTENTS

California residents to exercise certain privacy rights, including the right to opt out of certain disclosures of their information. The CCPA provides for civil penalties of up to $7,500 per violation as well as a private right of action with statutory damages for certain data breaches, thereby potentially increasing the likelihood of, and risks associated with, data breach litigation. Although the law includes limited exceptions, including for certain information collected as part of clinical trials, the CCPA may impact Tvardi’s processing of personal information and increases its compliance costs. Additionally, the California Privacy Rights Act of 2020 (CPRA) generally went into effect on January 1, 2023, and significantly expands the CCPA, such as granting additional rights to California residents, including the