Company: PFSA
Filing Date: 2025-08-25
Form Type: 424B3
Source: 0001213900-25-080387
Chunk: 67

Company: Profusa, Inc.
Filing Date: 2025-08-25
Form: 424B3
Chunk 67
---
 penalties as a result of a business associate violating HIPAA, if the business associate is found to be an agent of the covered entity. Profusa is a covered entity under HIPAA and may also function in a business associate capacity to other covered entities. Covered entities must report breaches of unsecured protected health information to affected individuals without unreasonable delay and notification must also be made to the U.S. Department of Health & Human Services, Office for Civil Rights, or OCR and, in certain situations involving large breaches, to the media. Various U.S. state laws and regulations may also require us to notify affected individuals and state agencies in the event of a data breach involving individually identifiable information. Violations of the HIPAA privacy and security regulations may result in criminal and civil penalties. The OCR enforces the regulations and performs compliance audits. In addition to enforcement by OCR, state attorneys general are authorized to bring civil actions seeking either injunction or damages in response to violations that threaten the privacy of state residents. We follow and maintain a HIPAA compliance plan, which we believe complies with the HIPAA privacy and security regulations, but there can be no assurance that OCR or other regulators will agree. The HIPAA privacy regulations and security regulations have and will continue to impose significant costs on us in order to comply with these standards. There are numerous other laws and legislative and regulatory initiatives at the federal and state levels addressing privacy and security concerns. We also remain subject to federal or state privacy -relatedlaws that are more restrictive than the regulations issued under HIPAA. These laws vary and could impose additional penalties. For example, the Federal Trade Commission uses its consumer protection authority to initiate enforcement actions in response to alleged privacy and data security violations. The California Consumer Privacy Act, or CCPA, which came into effect January 1, 2020 and was amended and expanded by the California Privacy Rights Act, or CPRA, which came into effect on January 1, 2023. The CCPA, including as amended by CPRA, among other things, create new data privacy obligations for covered companies and provide new privacy rights to California residents, including the right to opt out of certain disclosures of their information. The CCPA also creates a private right of action with statutory damages for certain data breaches, thereby potentially increasing risks associated with a data breach. As of January 1, 2023, the CCPA applies broadly to California employees and personal information of business contacts, which we anticipate will increase our compliance costs. It remains unclear what, if any, additional modifications will be