Company: CRVO
Filing Date: 2025-03-17
Form Type: 10-K
Source: 0001437749-25-007829
Chunk: 103

Company: CervoMed Inc.
Filing Date: 2025-03-17
Form: 10-K
Item: Item 1A
Chunk 103
---
 and sanctions. Implementation standards and enforcement practices are likely to remain uncertain and unpredictable for the foreseeable future, which may create uncertainty in the Company’s business, affect the Company’s or the Company’s service providers’ ability to operate in certain jurisdictions or to collect, store, transfer use and share personal data, result in liability or impose additional compliance or other costs on the Company. Failure to comply with data protection laws and regulations, where applicable, could result in government enforcement actions, which could include civil or criminal penalties, private litigation and/or adverse publicity and could negatively affect the Company’s operating results and business.

73

In the U. S., numerous federal and state laws and regulations, including state data breach notification laws, state health information privacy laws and federal and state consumer protection laws govern the collection, use, disclosure and protection of health-related and other personal information. For example, the CCPA, which became effective in 2020, broadly defines personal information, gives California residents expanded individual privacy rights and protections and provides for civil penalties for violations and a private right of action for data breaches. Further, the CPRA, which became effective in 2023 and amends the CCPA, creates additional obligations with respect to processing and storing personal information. While there is limited exception for protected health information that is subject to HIPAA and clinical trial regulations, the CCPA may regulate or impact the Company’s processing of personal information depending on the context. Unlike other state privacy laws, the CCPA also regulates personal information collected in a business to business and in human resources contexts. Further, there continues to be some uncertainty about how provisions of the CCPA and the new regulations will be interpreted and how the law will be enforced. In addition to California, more U. S. states are enacting similar legislation, increasing compliance complexity and increasing risks of failures to comply. In 2023, comprehensive privacy laws in Virginia, Colorado, Connecticut, and Utah all took effect, and laws in Montana, Oregon, and Texas took effect in 2024. Laws in a number of other U. S. states took effect, or are set to take effect, in 2025, in 2026, and beyond, and additional U. S. states have proposals under consideration. The existence of differing comprehensive privacy laws in different states in the country may make the Company’s compliance obligations more complex and costly and may require us to modify the Company’s data processing practices and policies and to incur substantial costs and potential liability in an effort to comply with such legislation.

In addition