Company: PFSA
Filing Date: 2025-05-15
Form Type: 424B3
Source: 0001213900-25-044417
Chunk: 140

Company: Profusa, Inc.
Filing Date: 2025-05-15
Form: 424B3
Chunk 140
---
 penalties, or orders to stop noncompliant activities. Due to the strong consumer protection aspects of the GDPR, companies subject to its purview are allocating substantial legal costs to the development of necessary policies and procedures and overall compliance efforts. For example, following a decision of the Court of Justice of the EU in October 2015, the transfer of personal data to US companies that had certified as members of the US Safe Harbor Scheme was declared invalid. In July 2016, the European Commission adopted the EU -USPrivacy Shield Framework, or the Privacy Shield Framework, which replaced the US Safe Harbor Scheme. On July 16, 2020, the Court of Justice of the European Union issued a decision that declared the Privacy Shield Framework invalid, and will also result in additional compliance obligations for companies that implement standard contractual clauses to ensure a valid basis for the transfer of personal data outside of Europe. We expect continued costs associated with maintaining compliance with GDPR into the future, and these provisions as interpreted by EU agencies, could negatively impact our business, financial condition and results of operations. 57 In addition to the laws discussed above, we may see more stringent state and federal privacy legislation in 2022 and beyond, as the increased cyber attacks during the COVID -19pandemic have once again put a spotlight on data privacy and security in the U.S. and other jurisdictions. We cannot predict where new legislation might arise, the scope of such legislation, or the potential impact to our business and operations. Cybersecurity risks and cyber incidents could result in the compromise of confidential data or critical data systems and give rise to potential harm to customers, remediation and other expenses, expose us to liability under HIPAA, consumer protection laws, or other common law theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business and operations. Cyber incidents can result from deliberate attacks or unintentional events. We collect and store on our networks sensitive information, including intellectual property, proprietary business information and personally identifiable information of individuals, such as our customers and employees. The secure maintenance of this information and technology is critical to our business operations. We have implemented multiple layers of security measures to protect the confidentiality, integrity and availability of this data and the systems and devices that store and transmit such data. We utilize current security technologies, and our defenses are monitored and routinely tested internally and by external parties. Additionally, we use third party products such as Amazon Cognito that provide advanced user authentication services that aim to prevent bad actors from accessing our