Company: TVRD
Filing Date: 2025-02-14
Form Type: S-4/A
Source: 0001104659-25-013053
Chunk: 524

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-02-14
Form: S-4/A
Chunk 524
---
, intellectual property, trade secrets and proprietary information owned or controlled by Tvardi or other third parties. Tvardi, and third parties upon whom it relies, use sophisticated information technology, software and services to process, store, use, generate, transfer and disclose information, as well as other sensitive information controlled by Tvardi or other third parties.

Tvardi may be subject to federal, state, and foreign data privacy and security laws and regulations. In the United States, numerous federal and state laws and regulations, including state data breach notification laws, state health information privacy laws, and federal and state consumer protection laws and regulations (e.g., Section 5 of the FTC Act), govern the collection, use, disclosure and protection of health-related and other personal information and could apply to its operations or the operations of Tvardi’s partners, vendors or other third parties on whom Tvardi relies. The legislative and regulatory framework related to the collection, use, retention, safeguarding, disclosure, sharing, transfer, security and other processing of personal data worldwide is rapidly evolving. The number and scope of data protection laws and regulations is changing, subject to differing applications and interpretations and may be inconsistent among jurisdictions, or in conflict with other rules, laws or other data processing obligations. Efforts to ensure that Tvardi’s current and future business arrangements, including its relationship with its third-party contract research organizations (CROs) or other vendors who process data on its behalf, comply with applicable data privacy and data security laws and regulations will involve substantial costs.

For example, HIPAA, as amended by HITECH, imposes requirements relating to the privacy, security and transmission of individually identifiable health information on certain health care providers, health plans and health care clearinghouses, known as covered entities, as well as their business associates and covered subcontractors that perform certain services that involve creating, receiving, maintaining or transmitting individually identifiable health information for or on behalf of such covered entities. Entities that are found to be in violation of HIPAA as the result of a breach of unsecured protected health information, a complaint about privacy practices or an audit by HHS, may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. Further, entities that knowingly obtain, use or disclose individually identifiable health information maintained by a HIPAA covered entity in a manner that is not authorized or permitted by HIPAA may