Company: BDRX
Filing Date: 2025-01-17
Form Type: F-1
Source: 0001214659-25-000922
Chunk: 72

Company: Biodexa Pharmaceuticals Plc
Filing Date: 2025-01-17
Form: F-1
Chunk 72
---
 and remain subject to significant change. In some cases, such laws and regulations can impose more restrictive requirements than HIPAA and other U.S. federal laws, thus complicating compliance efforts. By way of example, California has enacted the California Consumer Privacy Act, or CCPA, which went into effect in January of 2020. The CCPA established a new privacy framework for covered businesses by creating an expanded definition of personal information, establishing new data privacy rights for California residents, requiring covered business to provide new disclosures to California residents, and creating a new and potentially severe statutory damages framework for violations of the CCPA and for businesses that fail to implement reasonable security procedures and practices to prevent data breaches. Additionally in 2020, California voters passed the California Privacy Rights Act, or CPRA, which went into full effect on January 1, 2023. The CPRA significantly amends the CCPA, potentially resulting in further uncertainty, additional costs and expenses in an effort to comply and additional potential for harm and liability for failure to comply. Among other things, the CPRA established a new regulatory authority, the California Privacy Protection Agency, which is tasked with enacting new regulations under the CPRA and will have expanded enforcement authority. In addition to California, more U.S. states are enacting similar legislation, increasing compliance complexity, and increasing risks of failures to comply. In 2023, comprehensive privacy laws in Virginia, Colorado, Connecticut, and Utah all took effect, and laws in Montana, Oregon, and Texas will take effect in 2024. In addition, laws in other U.S. states are set to take effect beyond 2024, and additional U.S. states have proposals under consideration, all of which are likely to increase our regulatory compliance costs and risks, exposure to regulatory enforcement action and other liabilities. While these state privacy laws, like the CCPA, also exempt some data processed in the context of clinical trials (and most also exempt employee and business personal data), these developments further complicate compliance efforts, and increase legal risk and compliance costs for us and the third parties upon whom we rely. The scope and enforcement of these laws is uncertain and subject to rapid change. For example, increasing concerns about health information privacy have recently prompted the federal government to take a newly expansive view of the scope of existing privacy laws and regulations. Congress and some states are considering (and in some cases have passed) new laws and regulations that further and more broadly protect the privacy and security of personal health information.

The interplay of federal and state