Company: DAWN
Filing Date: 2025-11-04
Form Type: 10-Q
Source: 0001193125-25-264649
Chunk: 80

Company: Day One Biopharmaceuticals, Inc.
Filing Date: 2025-11-04
Form: 10-Q
Item: Item 3
Chunk 80
---
 including health information privacy and security laws, data breach notification laws, health information privacy laws and consumer protection laws that govern the collection, use, disclosure and protection of health-related and other personal information could apply to our operations or the operations of our collaborators. In addition, we may obtain protected health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy and security requirements under HIPAA, as amended by HITECH. Depending on the facts and circumstances, we could be subject to civil and criminal penalties if we obtain, use or disclose individually identifiable health information maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA.Over a third of U.S. states have adopted comprehensive privacy and security laws and regulations, which govern the privacy, processing and protection of personal information, including certain specific requirements and laws with respect to health-related information. For example, Washington state has passed the My Health My Data Act, which is focused on the collection of consumer health data, which has a broader scope than HIPAA and includes a private right of action.In California, the CCPA, grants individual privacy rights for California consumers and places increased privacy and data security obligations on entities handling personal information of consumers or households. The CCPA is enforced by the California Privacy Protection Agency, or the CPPA. The CCPA gives California residents expanded privacy rights, including the right to request correction, access and deletion of their personal information, the right to opt out of certain personal information sharing, and the right to receive detailed information about how their personal information is processed, including by California residents’ employers, and provides for civil penalties and a private right of action for data breaches that is expected to increase data breach litigation.We are also subject to foreign data protection laws, including the General Data Protection Regulation, or GDPR, which applies to personal information (including health-related data) obtained from individuals in the European Economic Area, or the EEA (as well as substantially similar laws that govern the collection of data from individuals in the UK and Switzerland). The GDPR imposes strict obligations on businesses, including requiring changes to informed consent practices and more detailed notices for clinical trial subjects and investigators, requiring limitations on data processing, establishing a legal basis for processing personal information, notification of data processing obligations, notification of security incidents to appropriate data protection authorities or data subjects, protecting the security and confidentiality of the personal information, and establishing means for data subjects to exercise rights in relation to their personal information. The GDPR subjects noncompliant companies to fines