Company: IXHL
Filing Date: 2025-09-29
Form Type: 10-K
Source: 0001213900-25-092837
Chunk: 308

Company: Incannex Healthcare Inc.
Filing Date: 2025-09-29
Form: 10-K
Item: Item 1A
Chunk 308
---
 government enforcement actions, which could include civil or criminal penalties, private litigation and/or adverse publicity and could
negatively affect our operating results and business. For example, California has enacted the California Consumer Privacy Act (“CCPA”),
which went into effect in January of 2020. The CCPA gives California residents expanded rights to access and require deletion of their
personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information
is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that may increase
data breach litigation. Although the CCPA includes exemptions for certain categories of health information, the law may increase our compliance
costs and potential liability with respect to other personal information we collect about California residents. Additionally in 2020,
California voters passed the California Privacy Rights Act (“CPRA”), which went into full effect on January 1, 2023. The CPRA
significantly amended the CCPA, potentially resulting in further uncertainty, additional costs and expenses in an effort to comply and
additional potential for harm and liability for failure to comply. Among other things, the CPRA established a new regulatory authority,
the California Privacy Protection Agency, which is tasked with enacting new regulations under the CPRA, including with respect to use
of automated decision-making technology, annual cybersecurity audits, and risk assessments, and has expanded enforcement authority. In
addition to California, numerous U.S. states have enacted or are enacting similar legislation, increasing compliance complexity and increasing
risks of failures to comply. The existence of differing comprehensive privacy laws in different states in the country may make our compliance
obligations more complex and costly and may require us to modify our personal information processing practices and policies and to incur
substantial costs and potential liability in an effort to comply with such legislation.

66

Other federal and state laws establish additional
requirements for protecting the privacy and security of health information that is not protected by HIPAA. For instance, Washington’s
“My Health My Data” Act, regulates “consumer health data,” which is defined as “personal information that
is linked or reasonably linkable to a consumer and that identifies a consumer’s past, present, or future physical or mental health.”
The “My Health My Data” Act provides exemptions for personal data used or shared in connection with certain research activities,
including data subject to 45 C.F.R. Part 46 and 21 C.F.R. Parts 50 and