Company: SCLXW
Filing Date: 2025-05-14
Form Type: 424B3
Source: 0001193125-25-119822
Chunk: 291

Company: Scilex Holding Co
Filing Date: 2025-05-14
Form: 424B3
Chunk 291
---
 in which we conduct our business. For example, under HIPAA, the U.S. Department of Health and Human Services imposes upon “covered entities” (broadly, healthcare providers, health plans and healthcare
clearinghouses) and their respective “business associates” (individuals or entities that create, receive, maintain or transmit protected health information on behalf of a covered entity) the HIPAA Privacy and Security Rules which include
privacy obligations; requirements to implement appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information; and breach response notification
obligations. Although we are neither a covered entity nor business associate, and therefore not subject to the HIPAA Privacy and Security Rules, we must monitor developments with these requirements for changing obligations that may apply to us. The
Federal Trade Commission (the “FTC”) also requires companies to take appropriate steps to keep consumers’ personal information secure and to make accurate statements regarding how they secure personal information under their custody
or control, such as in a privacy notice. The FTC also expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of personal information it holds, the size and complexity of its business,
and the cost of available tools to improve data security and reduce vulnerabilities. Individually identifiable health information, which we process, is considered sensitive data that merits stronger safeguards. Violations of the foregoing FTC
requirements may constitute unfair or deceptive acts or practices under Section 5(a) of the Federal Trade Commission Act (the “FTC Act”). While we do not intend to engage in unfair or deceptive acts or practices, the FTC has the power
to bring enforcement actions based on the FTC’s interpretation of public privacy statements. Further, events that we cannot fully control, such as data breaches, may also result in civil penalties, FTC enforcement or enforcement by U.S. state
attorneys general or other regulators. Various U.S. states have implemented privacy laws and regulations that regulate the use and disclosure of health information and other

191

personal information. For example, the CCPA, established a privacy framework for covered businesses by, among other items, expanding the definition of personal information, establishing new data
privacy rights for consumers who are California residents, imposing rules on the collection of personal information from minors, and creating a statutory damages framework for violations of the CCPA, including for failure to implement reasonable
security procedures and practices to prevent data breaches. Penalties for violations of the CCPA include civil penalties