Company: BLLN
Filing Date: 2025-06-20
Form Type: DRS
Source: 0000950123-25-006095
Chunk: 208

Company: BillionToOne, Inc.
Filing Date: 2025-06-20
Form: DRS
Chunk 208
---
 1, 2023, which created additional obligations with respect to certain data relating to consumers, significantly expands the CCPA, is an example of the
increasingly stringent privacy laws at the state level in the United States. The CCPA also created a private right of action with statutory damages for certain data breaches, thereby potentially increasing risks associated with a data breach.
However, the CCPA and CPRA include an exemption for HIPAA covered entities such as our laboratory. The California Confidentiality of Medical Information Act, which protects the confidentiality of individually identifiable medical information
obtained by health care providers and their contractors, is much broader than HIPAA and the data protected is also broader than HIPAA.

In addition, numerous other
states’ legislatures have passed or are considering similar laws that will require ongoing compliance efforts and investment. For example, Virginia passed the Virginia Consumer Data Protection Act, and Colorado passed the Colorado Privacy Act,
both of which differ from the CPRA and became effective in 2023 and the Texas Data Privacy and Security Act became effective in 2024. These state privacy laws dictate how we can collect, use, store, sell, share, analyze or process personal
identifying information and/or consumer or health data received or generated by our business operations.

Outside the United States, there are an increasing number
of laws and regulations governing the collection, use and processing of personal data. For example, the European Union’s General Data Protection Regulation (EU GDPR) applies to any company established in the European Economic Area (EEA), and to
companies established outside the EEA that process personal information in connection with the offering of goods or services to data subjects in the EEA or the monitoring of the behavior of data subjects in the EEA. These regulations are often more
restrictive than those in the United States and may restrict transfers of personal data from the EEA to the United States and other countries unless certain requirements are met. The EU GDPR provides that EU member states may make their own further
laws and regulations limiting the processing of genetic, biometric or health data, which could limit our ability to use and share personal data or could cause our costs to increase, and harm our business and financial condition. Further, the United
Kingdom’s decision to leave the European Union has created uncertainty with regard to data protection regulation in the United Kingdom. As of January 1, 2021, we are also subject to the UK General Data Protection Regulation and UK Data
Protection Act of 2018, which