Company: ANTX
Filing Date: 2025-03-25
Form Type: 10-K
Source: 0000950170-25-044366
Chunk: 109

Company: AN2 Therapeutics, Inc.
Filing Date: 2025-03-25
Form: 10-K
Item: Item 1A
Chunk 109
---
 in connection with the conduct of our clinical trials. As such, we are subject to laws and regulations governing the privacy and security of such information. In the United States, there are numerous federal and state privacy and data security laws and regulations governing the collection, use, disclosure, and protection of personal information that apply or could apply to our operations or the operations of our partners, including federal and state health information privacy laws, federal and state security breach notification laws, and federal and state consumer protection laws. The legislative and regulatory landscape for privacy and data protection continues to evolve, and there has been an increasing focus on privacy and data protection issues, in particular in relation to health information, which may affect our business and is expected to increase our compliance costs and exposure to liability. In addition, we may obtain health information from third parties, including research institutions from which we obtain clinical trial data, that are subject to privacy and security requirements under HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, and the regulations promulgated thereunder. Depending on the facts and circumstances, we could be subject to significant penalties if we obtain, use or disclose individually identifiable health information in a manner that is not authorized or permitted by HIPAA.

Compliance with these and any other applicable privacy and data security laws, regulations and other requirements we may be subject to in the future is a rigorous and time-intensive process, and we may be required to put in place additional mechanisms ensuring compliance with such data protection rules. If we fail to comply with any such laws, regulations or other requirements, we may face significant fines and penalties that could adversely affect our business, financial condition, results of operations or growth prospects. Any failure or perceived failure by us or our third-party processors to comply with these data protection and privacy laws, regulations and requirements could result in significant government enforcement actions, which could include civil, criminal, and administrative penalties, orders requiring that we change our practices, claims for damages, and other liabilities, regulatory investigations and enforcement action, private litigation, significant costs (including in investigating and defending such claims, in remediation measures or changes to our operations), and adverse publicity, any of which could negatively affect our business, financial condition, results of operations and growth prospects. Furthermore, the laws are not consistent, and compliance in the event of a widespread data breach is costly. In addition, states are constantly adopting new laws or amending existing laws, requiring attention to frequently changing regulatory requirements.

With laws, regulations, and other obligations relating to privacy and data