Company: DRTSW
Filing Date: 2025-03-12
Form Type: 20-F
Source: 0001213900-25-023187
Chunk: 43

Company: Alpha Tau Medical Ltd.
Filing Date: 2025-03-12
Form: 20-F
Item: Item 3
Chunk 43
---
 health information from a HIPAA-covered healthcare provider or research institution that has not satisfied HIPAA’s
requirements or exclusions for disclosure of individually identifiable health information. In addition, we may in the future maintain
sensitive personally identifiable information, including health information, that we receive throughout the clinical trial process, in
the course of our research collaborations, and directly from individuals (or their healthcare providers) who enroll in our patient assistance
programs. As such, we may be subject to state laws requiring notification of affected individuals and state regulators in the event of
a breach of personal information, which is a broader class of information than the health information protected by HIPAA.

Furthermore, certain health
privacy laws, data breach notification laws, consumer protection laws and genetic testing laws may apply directly to our operations and/or
those of our collaborators and may impose restrictions on our collection, use and dissemination of individuals’ health information.
Patients about whom we or our collaborators obtain health information, as well as the providers who share this information with us, may
have statutory or contractual rights that limit our ability to use and disclose the information. We may be required to expend significant
capital and other resources to ensure ongoing compliance with applicable privacy and data security laws. Claims that we have violated
individuals’ privacy rights or breached our contractual obligations, even if we are not found liable, could be expensive and time-consuming
to defend and could result in adverse publicity that could harm our business.

Certain states have also adopted
comparable privacy and security laws and regulations, some of which may be more stringent than HIPAA. Such laws and regulations will be
subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for
us and our future customers and strategic partners. For example, the California Consumer Privacy Act of 2018, as amended by the California
Privacy Rights Act, or collectively, the CCPA, requires covered businesses that process the personal information of California residents
to, among other things: (i) provide certain disclosures to California residents regarding the business’s collection, use, and disclosure
of their personal information; (ii) receive and respond to requests from California residents to access, delete, and correct their personal
information, or to opt out of certain disclosures of their personal information; and (iii) enter into specific contractual provisions
with service providers that process California resident personal information on the business’s behalf.. Additional compliance investment
and potential business process changes may also be required. Similar laws have been passed in other states,