Company: TVRD
Filing Date: 2025-05-30
Form Type: S-1
Source: 0001104659-25-054853
Chunk: 110

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-05-30
Form: S-1
Chunk 110
---
 notification laws, data privacy laws, and other similar laws. For example, HIPAA, as amended by HITECH (collectively, “HIPAA”), imposes among other things, certain requirements relating to the privacy, security, transmission, and breach of individually identifiable health information. The Company may obtain health information from third parties (including research institutions from which it obtains clinical trial data) that are subject to privacy and security requirements under HIPAA. Depending on the facts and circumstances, the Company could be subject to significant penalties if it violates HIPAA.

Certain states have also adopted comparable privacy and security laws and regulations, which govern the privacy, processing and protection of health-related and other personal information. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for the Company and its future customers and strategic partners. For example, the CCPA, went into effect on January 1, 2020 and applies to the personal information of consumers, business representatives, and employees who are California residents, and increases the privacy and security obligations of covered businesses under the CCPA that handle personal information subject to the CCPA, including among other things, requiring such businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights, including the right to opt out of certain disclosures of their information. The CCPA provides for civil penalties as well as a private right of action with statutory damages for certain data breaches, thereby potentially increasing the likelihood of, and risks associated with, data breach litigation. Although the law includes limited exceptions, including for certain information collected as part of clinical trials, the CCPA may impact the Company’s processing of personal information and increases its compliance costs. Additionally, the California Privacy Rights Act of 2020 (“CPRA”) went into effect on January 1, 2023, and significantly expands the CCPA, such as by granting additional rights to California residents, including the right to correct personal information and affording opt-out rights for certain uses of sensitive information, and imposes additional data protection obligations on covered businesses, including additional limitations on data uses and new audit requirements for higher risk sensitive information. The CPRA also established the California Privacy Protection Agency which is authorized to issue substantive regulations and could result in increased privacy and information security enforcement. Other states have also passed comprehensive privacy laws, and similar laws are being

<div align='center'>60</div>

considered in several other states, as well as at the federal and local levels. While these state privacy