Company: PFSA
Filing Date: 2025-08-29
Form Type: S-1
Source: 0001213900-25-082672
Chunk: 65

Company: Profusa, Inc.
Filing Date: 2025-08-29
Form: S-1
Chunk 65
---
, which we anticipate will increase our compliance costs. It remains unclear what, if any, additional modifications will be made to this legislation or how it will be interpreted and regulations implementing CPRA amendments will not be finalized before CPRA amendments come into effect. Therefore, the effects of the CCPA and CPRA are significant and will likely require us to modify our data processing practices, and may cause us to incur substantial costs and expenses to comply, particularly given our base of operations in California. There are also a number of other legislative proposals worldwide, including in the United States at both the federal and state level, that could impose additional and potentially conflicting obligations in areas affecting our business. We are also subject to laws and regulations in foreign countries covering data privacy and other protection of health and employee information that may be more onerous than corresponding U.S. laws, including in particular the laws of Europe. For instance, in the European Union, increasingly stringent data protection and privacy rules that have and will continue to have substantial impact on the use of patient data across the healthcare industry became effective in May 2018. The EU General Data Protection Regulation, or GDPR, applies across the European Union and includes, among other things, a requirement for prompt notice of data breaches to data subjects and supervisory authorities in certain circumstances and significant fines for non -compliance. The GDPR fine framework can be up to 20 million euros, or up to 4% of the company’s total global turnover of the preceding fiscal year, whichever is higher. The GDPR also requires companies processing personal data of individuals residing in the European Union to comply with EU privacy and data protection rules, even if the company itself does not have a physical presence in the European Union. Noncompliance could result in the imposition of fines, penalties, or orders to stop noncompliant activities. Due to the strong consumer protection aspects of the GDPR, companies subject to its purview are allocating substantial legal costs to the development of necessary policies and procedures and overall compliance efforts. For example, following a decision of the Court of Justice of the EU in October 2015, the transfer of personal data to US companies that had certified as members of the US Safe Harbor Scheme was declared invalid. In July 2016, the European Commission adopted the EU -USPrivacy Shield Framework, or the Privacy Shield Framework, which replaced the US Safe Harbor 38 Scheme. On July 16, 2020, the Court of Justice of the European Union issued a decision that declared the Privacy Shield Framework invalid, and will also