Company: BLLN
Filing Date: 2025-12-10
Form Type: 10-Q
Source: 0001628280-25-056321
Chunk: 300

Company: BillionToOne, Inc.
Filing Date: 2025-12-10
Form: 10-Q
Item: Part II, Item 1A
Chunk 300
---
 the company has violated privacy and consumer protection laws. If we cannot use AI/ML or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.

In addition, the interpretation and application of consumer, health-related and data protection laws, especially with respect to genetic samples and data, in the United States, European Economic Area (EEA) and elsewhere are often uncertain, contradictory and in flux. The General Data Protection Regulation (GDPR) and other privacy laws and regulations related to the use, transfer, and protection of data impose obligations to the extent we test EU citizens or expand internationally. While we believe that our current processes and practices comply with the GDPR, we may need to expend considerable time and resources, including management attention, to revise our practices to ensure ongoing compliance with GDPR.

Some of the above privacy laws and regulations in many cases may be more restrictive than, and may not be preempted by, HIPAA and its implementing rules. In addition, some countries have stricter consumer notice and/or consent requirements relating to personal data collection, use or sharing, more stringent requirements relating to organizations’ privacy programs and provide stronger individual rights. Failure to comply with GDPR and other applicable privacy or data security-related laws, rules or regulations in the EEA and elsewhere could have an adverse effect on our business, financial condition and results of operations.

We expect that there will continue to be new proposed laws and regulations in the U.S. and internationally concerning data privacy and security, and we cannot yet determine the impact such future laws, regulations and standards may have on our business. Because the interpretation and application of laws, regulations, standards and other obligations relating to data privacy and security are still uncertain, these laws, regulations, standards and other obligations could be interpreted and applied in a manner that is inconsistent with our data processing practices and policies or the features of our products. In such cases, changes or modifications to our data processing practices and policies to comply with such interpretations in a commercially reasonable manner would be difficult.

We will make public statements about our use and disclosure of personal information through our privacy policy, information provided on our internet platform and press statements. Although we endeavor to comply with our public statements and documentation, we may at times fail to do so or be alleged to have failed to do so. The publication of our privacy policy and other statements that provide promises and assurances about data privacy and security can subject us to potential government or legal action if they are found to be deceptive, unfair or misrepresentative of our actual practices.