Company: PFSA
Filing Date: 2025-10-29
Form Type: 424B3
Source: 0001213900-25-103174
Chunk: 73

Company: Profusa, Inc.
Filing Date: 2025-10-29
Form: 424B3
Chunk 73
---
, including in the United States at both the federal and state level, that
could impose additional and potentially conflicting obligations in areas affecting our business.

We are also subject to laws
and regulations in foreign countries covering data privacy and other protection of health and employee information that may be more onerous
than corresponding U.S. laws, including in particular the laws of Europe.

For instance, in the European
Union, increasingly stringent data protection and privacy rules that have and will continue to have substantial impact on the use of patient
data across the healthcare industry became effective in May 2018. The EU General Data Protection Regulation, or GDPR, applies across
the European Union and includes, among other things, a requirement for prompt notice of data breaches to data subjects and supervisory
authorities in certain circumstances and significant fines for non-compliance. The GDPR fine framework can be up to 20 million euros,
or up to 4% of the company’s total global turnover of the preceding fiscal year, whichever is higher. The GDPR also requires companies
processing personal data of individuals residing in the European Union to comply with EU privacy and data protection rules, even if the
company itself does not have a physical presence in the European Union. Noncompliance could result in the imposition of fines, penalties,
or orders to stop noncompliant activities. Due to the strong consumer protection aspects of the GDPR, companies subject to its purview
are allocating substantial legal costs to the development of necessary policies and procedures and overall compliance efforts. For example,
following a decision of the Court of Justice of the EU in October 2015, the transfer of personal data to US companies that had certified
as members of the US Safe Harbor Scheme was declared invalid. In July 2016, the European Commission adopted the EU-US Privacy Shield
Framework, or the Privacy Shield Framework, which replaced the US Safe Harbor Scheme. On July 16, 2020, the Court of Justice of the
European Union issued a decision that declared the Privacy Shield Framework invalid, and will also result in additional compliance obligations
for companies that implement standard contractual clauses to ensure a valid basis for the transfer of personal data outside of Europe.
We expect continued costs associated with maintaining compliance with GDPR into the future, and these provisions as interpreted by EU
agencies, could negatively impact our business, financial condition and results of operations.

<div align='center'>39</div>

In addition to the laws discussed
above, we may see more stringent state and federal privacy legislation in 202