Company: AEMD
Filing Date: 2025-06-26
Form Type: 10-K
Source: 0001683168-25-004780
Chunk: 204

Company: AETHLON MEDICAL INC
Filing Date: 2025-06-26
Form: 10-K
Item: Item 1A
Chunk 204
---
 (e.g., wiretapping
laws). For example, the federal Health Insurance Portability and Accountability Act of 1996, or HIPAA, as amended by the Health Information
Technology for Economic and Clinical Health Act, or HITECH, imposes specific requirements relating to the privacy, security, and transmission
of individually identifiable health information.

In addition, over the past
few years, numerous U.S. states—including California, Virginia, Colorado, Connecticut, and Utah—have enacted comprehensive
privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording
residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or
delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated
decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states
also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy
impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of
2018, or CCPA, applies to personal data of consumers, business representatives, and employees who are California residents, and requires
covered businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy
rights. The CCPA also provides for fines of up to $7,500 per intentional violation and allows private litigants affected by certain data
breaches to recover significant statutory damages. The CCPA and other comprehensive U.S. state privacy laws exempt some data Processing
in the context of clinical trials, but these developments may further complicate compliance efforts, and increase legal risk and compliance
costs for us, the third parties with whom we work. Similar laws are being considered in several other states, as well as at the federal
and local levels, and we expect more states to pass similar laws in the future.

Outside the United States,
an increasing number of laws, regulations, and industry standards may govern data privacy and security. For example, the European Union’s
General Data Protection Regulation, or EU GDPR, and the United Kingdom’s GDPR, or UK GDPR, or collectively GDPR, Australia’s
Privacy Act, and India’s Information Technology Act and supplementary rules impose strict requirements for Processing personal data.
For example, under GDPR, companies can face private litigation related to Processing of personal data brought by