Company: TVRD
Filing Date: 2025-02-14
Form Type: 424B3
Source: 0001104659-25-014310
Chunk: 523

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-02-14
Form: 424B3
Chunk 523
---
 processing of personal data worldwide is rapidly evolving. The number and scope of data protection laws and regulations is changing, subject to differing applications and interpretations and may be inconsistent among jurisdictions, or in conflict with other rules, laws or other data processing obligations. Efforts to ensure that Tvardi’s current and future business arrangements, including its relationship with its third-party contract research organizations (CROs) or other vendors who process data on its behalf, comply with applicable data privacy and data security laws and regulations will involve substantial costs.

For example, HIPAA, as amended by HITECH, imposes requirements relating to the privacy, security and transmission of individually identifiable health information on certain health care providers, health plans and health care clearinghouses, known as covered entities, as well as their business associates and covered subcontractors that perform certain services that involve creating, receiving, maintaining or transmitting individually identifiable health information for or on behalf of such covered entities. Entities that are found to be in violation of HIPAA as the result of a breach of unsecured protected health information, a complaint about privacy practices or an audit by HHS, may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. Further, entities that knowingly obtain, use or disclose individually identifiable health information maintained by a HIPAA covered entity in a manner that is not authorized or permitted by HIPAA may be subject to civil and criminal penalties. Even when HIPAA does not apply, according to the FTC, violating consumers’ privacy rights or failing to take appropriate steps to keep consumers’ personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5 of the FTC Act. The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards.

Tvardi expects that there will continue to be new proposed laws, regulations and industry standards relating to privacy and data protection in the United States, the European Union (EU) and other jurisdictions, such as the California Consumer Privacy Act (CCPA). Although the CCPA exempts certain data processed in the context of clinical trials, the CCPA, to the extent applicable to Tvardi’s business and operations, may increase its