Company: PFSA
Filing Date: 2025-08-22
Form Type: S-1/A
Source: 0001213900-25-079829
Chunk: 72

Company: Profusa, Inc.
Filing Date: 2025-08-22
Form: S-1/A
Chunk 72
---
 in the European Union, increasingly stringent data protection and privacy rules that have and will continue to have substantial impact on the use of patient data across the healthcare industry became effective in May 2018. The EU General Data Protection Regulation, or GDPR, applies across the European Union and includes, among other things, a requirement for prompt notice of data breaches to data subjects and supervisory authorities in certain circumstances and significant fines for non -compliance. The GDPR fine framework can be up to 20 million euros, or up to 4% of the company’s total global turnover of the preceding fiscal year, whichever is higher. The GDPR also requires companies processing personal data of individuals residing in the European Union to comply with EU privacy and data protection rules, even if the company itself does not have a physical presence in the European Union. Noncompliance could result in the imposition of fines, penalties, or orders to stop noncompliant activities. Due to the strong consumer protection aspects of the GDPR, companies subject to its purview are allocating substantial legal costs to the development of necessary policies and procedures and overall compliance efforts. For example, following a decision of the Court of Justice of the EU in October 2015, the transfer of personal data to US companies that had certified as members of the US Safe Harbor Scheme was declared invalid. In July 2016, the European Commission adopted the EU -USPrivacy Shield Framework, or the Privacy Shield Framework, which replaced the US Safe Harbor Scheme. On July 16, 2020, the Court of Justice of the European Union issued a decision that declared the Privacy Shield Framework invalid, and will also result in additional compliance obligations for companies that 41 implement standard contractual clauses to ensure a valid basis for the transfer of personal data outside of Europe. We expect continued costs associated with maintaining compliance with GDPR into the future, and these provisions as interpreted by EU agencies, could negatively impact our business, financial condition and results of operations. In addition to the laws discussed above, we may see more stringent state and federal privacy legislation in 2022 and beyond, as the increased cyber attacks during the COVID -19pandemic have once again put a spotlight on data privacy and security in the U.S. and other jurisdictions. We cannot predict where new legislation might arise, the scope of such legislation, or the potential impact to our business and operations. Cybersecurity risks and cyber incidents could result in the compromise of confidential data or critical data systems and give rise to potential harm to customers, remediation and other expenses, expose us to