Company: TVRD
Filing Date: 2025-02-14
Form Type: S-4/A
Source: 0001104659-25-013053
Chunk: 107

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-02-14
Form: S-4/A
Chunk 107
---
 business transactions (such as acquisitions or integrations) could expose Cara to additional cybersecurity risks and vulnerabilities, as Cara’s systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, Cara may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into Cara’s information technology environment and security program.

While Cara has implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. Cara takes steps designed to detect, mitigate, and remediate vulnerabilities in its information systems (such as its hardware and/or software, including that of third parties upon which Cara relies). Cara may not, however, detect and remediate all such vulnerabilities including on a timely basis. Further, Cara may experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities. Vulnerabilities could be exploited and result in a security incident.

Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to Cara’s sensitive data or Cara’s information technology systems, or those of the third parties upon whom Cara relies. A security incident or other interruption could disrupt Cara’s ability (and that of third parties upon whom Cara relies) to provide its services.

Cara may expend significant resources or modify its business activities to try to protect against security incidents. Additionally, certain data privacy and security obligations may require Cara to implement and maintain specific security measures or industry-standard or reasonable security measures to protect its information technology systems and sensitive data.

Applicable data privacy and security obligations may require Cara to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences.

If Cara (or a third party upon whom Cara relies) experiences a security incident or is perceived to have experienced a security incident, it may experience material adverse consequences, such as government

<div align='center'>57</div>

TABLE OF CONTENTS

enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive data (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in Cara’s operations (including