Company: TVRD
Filing Date: 2025-11-13
Form Type: 424B3
Source: 0001104659-25-111336
Chunk: 189

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-11-13
Form: 424B3
Chunk 189
---
 and difficult, and failure to comply with any data privacy or security obligations, whether by Tvardi,
one of its CROs, CMOs, partners or another third party, could adversely affect its business, financial condition, results of operations
and prospects, including but not limited to: investigation costs; material fines and penalties; compensatory, special, punitive and statutory
damages; litigation; consent orders regarding Tvardi’s privacy and security practices; requirements that it provides notices, credit
monitoring services and/or credit restoration services or other relevant services to impacted individuals; adverse actions against Tvardi’s
licenses to do business; reputational damage; and injunctive relief. In addition, new regulation or legislative actions regarding data
privacy and security (together with applicable industry standards) may increase its costs of doing business.

​

In this regard, Tvardi expects that there will continue
to be new proposed laws, regulations and industry standards relating to privacy and data protection in the United States, the EEA and
other jurisdictions, and it cannot determine the impact such future laws, regulations and standards may have on its business. For example,
the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data
by Countries of Concern or Covered Persons, which places additional restriction on certain data transactions involving countries of concern
(e.g., China, Russia, Iran) and covered individuals (i.e., individuals and entities located in or controlled by individuals or entities
located in those jurisdictions) that may impact certain business activities such as vendor engagements, sale or sharing of data, employment
of certain individuals, and investor agreements. Violations of the rule could lead to significant civil and criminal fines and penalties.
The rule applies regardless of whether data is anonymized, key-coded, pseudonymized, de-identified or encrypted, which presents particular
challenges for companies like ours and may impact our ability to transfer data in connection with certain transactions or agreements.

​

Any actual or perceived failure by Tvardi or its
third-party service providers to comply with any federal, state or foreign laws, rules, regulations, industry self-regulatory principles,
industry standards or codes of conduct, regulatory guidance, orders to which Tvardi may be subject or other legal obligations relating
to data privacy, data protection, security or consumer protection could adversely affect Tvardi’s reputation, brand and business.
Tvardi may also be contractually required to indemnify and