Company: APM
Filing Date: 2025-10-06
Form Type: S-4
Source: 0001213900-25-096656
Chunk: 148

Company: Aptorum Group Ltd
Filing Date: 2025-10-06
Form: S-4
Chunk 148
---
 by the CAC together with competent departments of the State Council. In addition, for critical information infrastructure operators, or the “CIIOs”, that purchase network -relatedproducts and services, the CIIOs shall declare any network -relatedproduct or service that affects or may affect national security to the Office of Cybersecurity Review of the CAC for cybersecurity review. Due to the lack of further interpretations, the exact scope of what constitutes a “CIIO” remains unclear. Further, the PRC government authorities may have wide discretion in the interpretation and enforcement of these laws. In addition, the Review Measures stipulates that any online platform operators holding more than one million users/users’ individual information shall be subject to cybersecurity review before listing abroad. As of the date hereof, neither we nor our subsidiaries have received any notice from any authorities identifying us or our subsidiaries as a CIIO or requiring us or our subsidiaries to undertake a cybersecurity review by the CAC. Further, as of the date hereof, neither we nor our subsidiaries have been subject to any penalties, fines, suspensions, or investigations from any competent authorities for violation of the regulations or policies that the CAC has issued. On June 10, 2021, the Standing Committee of the National People’s Congress promulgated the Data Security Law, which took effect on September 1, 2021. The Data Security Law requires that data shall not be collected by theft or other illegal means, and it also provides for a data classification and hierarchical protection system. The data classification and hierarchical protection system protects data according to its importance in economic and social development, and the damages it may cause to national security, public interests, or the legitimate rights and interests of individuals and organizations if the data is falsified, damaged, disclosed, illegally obtained or illegally used, which protection system is expected to be built by the state for data security in the near future. On November 14, 2021, CAC published the Regulations on the Data Security Administration Draft, or the “Data Security Regulations Draft”, to solicit public opinion and comments. Under the Data Security Regulations Draft, an overseas initial public offering to be conducted by a data processor processing the personal information of more than one million individuals shall apply for a cybersecurity review. Data processor means an individual or organization that independently makes decisions on the purpose and manner of processing in data processing activities, and data processing activities refers to activities such as the collection, retention, use, processing, transmission, provision, disclosure, or deletion of data. Currently we