Company: KROS
Filing Date: 2025-11-05
Form Type: 10-Q
Source: 0001664710-25-000089
Chunk: 86

Company: Keros Therapeutics, Inc.
Filing Date: 2025-11-05
Form: 10-Q
Item: Item 4
Chunk 86
---
 that such coverage will pay future claims. The successful assertion of one or more large claims against us that exceeds our available insurance coverage, or results in changes to our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements), could have an adverse effect on our business. In addition to experiencing a security incident, third parties may gather, collect or infer sensitive information about us from public sources, data brokers or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

We and the third parties with whom we work are subject to stringent and evolving U.S. and foreign laws, regulations and rules, contractual obligations, industry standards, policies and other obligations related to data privacy and security. Our (or the third parties with whom we work) actual or perceived failure to comply with such obligations could lead to government enforcement actions, including administrative, civil or criminal fines or penalties, private 

76

litigation (including class claims) and mass arbitration demands; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; other liabilities and adverse publicity and could negatively affect our operating results and business. Compliance or the failure to comply with such laws and regulations could increase the costs of our products, could limit their use or adoption, and could otherwise negatively affect our operating results and business. 

In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) personal data and other sensitive information, including personal data, proprietary and confidential business data, trade secrets, intellectual property and data we collect about trial participants in connection with clinical trials. Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements and other obligations relating to data privacy and security.

In the United States, numerous federal and state laws and regulations, including federal and state health information privacy laws, state data breach notification laws, and federal and state consumer protection laws (including Section 5 of the Federal Trade Commission Act) and other similar laws (e.g., wiretapping laws), that govern the collection, use, disclosure and protection of health information and other personal information could apply to our operations or the operations of our collaborators. In addition, we obtain health information from third parties, including research institutions from which we obtain clinical