Company: BLLN
Filing Date: 2025-10-07
Form Type: S-1
Source: 0001193125-25-233697
Chunk: 257

Company: BillionToOne, Inc.
Filing Date: 2025-10-07
Form: S-1
Chunk 257
---

regulations promulgated by HHS related to patient access to electronic PHI, or EHI, to promote interoperability and to ensure the access, exchange, or use of EHI.

Various U.S. states have implemented similar restrictive requirements regulating the use and disclosure of health information and other personal information that are not
necessarily preempted by HIPAA or that regulate different information than HIPAA. The California Consumer Privacy Act (CCPA), which went into effect January 1, 2020, and California Privacy Rights Act of 2020 (CPRA), which went into effect on
January 1, 2023,

191

which created additional obligations with respect to certain data relating to consumers, significantly expands the CCPA, is an example of the increasingly stringent privacy laws at the state
level in the United States. The CCPA also created a private right of action with statutory damages for certain data breaches, thereby potentially increasing risks associated with a data breach. However, the CCPA and CPRA include an exemption for
HIPAA covered entities such as our laboratory. The California Confidentiality of Medical Information Act, which protects the confidentiality of individually identifiable medical information obtained by health care providers and their contractors, is
much broader than HIPAA and the data protected is also broader than HIPAA.

In addition, numerous other states’ legislatures have passed or are considering
similar laws that will require ongoing compliance efforts and investment. For example, Virginia passed the Virginia Consumer Data Protection Act, and Colorado passed the Colorado Privacy Act, both of which differ from the CPRA and became effective
in 2023 and the Texas Data Privacy and Security Act became effective in 2024. These state privacy laws dictate how we can collect, use, store, sell, share, analyze or process personal identifying information and/or consumer or health data received
or generated by our business operations.

Outside the United States, there are an increasing number of laws and regulations governing the collection, use and
processing of personal data. For example, the European Union’s General Data Protection Regulation (EU GDPR) applies to any company established in the European Economic Area (EEA), and to companies established outside the EEA that process
personal information in connection with the offering of goods or services to data subjects in the EEA or the monitoring of the behavior of data subjects in the EEA. These regulations are often more restrictive than those in the United States and may
restrict transfers of personal data from the EEA to the United States and other countries unless certain requirements