Company: AMWL
Filing Date: 2025-02-12
Form Type: 10-K
Source: 0000950170-25-019024
Chunk: 78

Company: American Well Corp
Filing Date: 2025-02-12
Form: 10-K
Item: Item 1
Chunk 78
---
 which we operate. 

International Privacy and Data Protection Laws

As a result of our presence in Europe and some of our customers being located in the European Union and the United Kingdom, we are subject to applicable international laws and regulations related to privacy and the protection of personal data (including data concerning health), in particular the GDPR and the UK GDPR. These regimes impose stringent data protection requirements and may increase both the risk of noncompliance and the costs of providing our products and services in a compliant manner. 

The GDPR establishes data protection principles that govern the lawful use of personal data, requires privacy by design, and technical and organizational measures to ensure a level of security appropriate to the risk. The regulation grants rights for data subjects in regard to their personal data (including the right to be “forgotten” and the right to data portability) and enhances pre-existing rights (e.g., data subject access requests). GDPR is directly applicable in EU member states, which provides a degree of consistency. Member states may have additional national data protection and privacy laws. The UK has adopted the UK GDPR and Data Protection Act. The GDPR and UK data protection law may increasingly diverge from each other, thereby increasing both our compliance costs and the potential for noncompliance. 

16

Our European clinical operations team and our health care clients in Europe are regulated as data controllers under GDPR. We are a data processor for our data controller clients when we are working on their behalf and also when we are providing technology services to those clients via the Amwell Platform. As a data processor, we are also directly regulated by GDPR and are required to provide satisfactory written assurances to our clients through written data processing agreements that we will provide our services in accordance with GDPR. Failure to comply with these agreements could lead to loss of clients, contractual liability to our clients, and direct action by European data protection authorities, including monetary penalties.  

GDPR and similar comprehensive data protection laws apply to personal data broadly across sectors. GDPR applies to personal data relating to all categories of data subjects including patients, job applicants, employees, contractors, client workforce members, business contacts, and web visitors. We are the data controller where we decide the purpose and means of processing data for a given activity, such as recruit mentor marketing.

 In addition, the GDPR imposes strict rules on the transfer of personal data out of the EEA to a “third country,” including the United States. The same is true for the UK GDPR. In July 2020, the Court of Justice of the European Union (“CJEU