Company: QTIWW
Filing Date: 2025-12-31
Form Type: 424B3
Source: 0001628280-25-059235
Chunk: 233

Company: QT IMAGING HOLDINGS, INC.
Filing Date: 2025-12-31
Form: 424B3
Chunk 233
---
 that merits stronger safeguards. The FTC’s guidance for appropriately securing consumers’ personal information is similar to what is required by the HIPAA Security Rule.

In addition, certain state and non-U.S. laws, such as the European Union’s General Data Protection Regulation (2016/679) (“

#### GDPR
”), govern the privacy and security of health information in certain circumstances, some of which are more stringent than HIPAA and many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Further, “business associates,” defined as independent contractors or agents of covered entities that create, receive, maintain or transmit protected health information in connection with providing a service for or on behalf of a covered entity, are also subject to certain HIPAA privacy and security standards. Failure to comply with these laws, where applicable, can result in the imposition of significant civil and/or criminal penalties and private litigation. For example, California recently enacted legislation, the California Consumer Privacy Act (“

#### CCPA
”), which went into effect January 1, 2020. The CCPA, among other things, creates new data privacy obligations for covered companies and provides new privacy rights to California residents, including the right to opt out of certain disclosures of their information. The CCPA also creates a private right of action with statutory damages for certain data breaches, thereby potentially increasing risks associated with a data breach. Although the law includes limited exceptions, including for PHI maintained by a covered entity or business associate, it may regulate or impact the Company’s expected processing of personal information depending on the context. In Europe, the GDPR went into effect in May 2018 and introduces strict requirements for processing the personal data of European Union data subjects. Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance of up to €20 million or 4% of the annual global revenues of the noncompliant company, whichever is greater. The State of Israel has also implemented data protection laws and regulations, including the Israeli Protection of Privacy Law of 1981.

#### Foreign Regulation
As the Company plans to market and deploy the QT Breast Scanner and products under development broadly across the globe, the Company will be subject to regulations applicable to medical and radiation-emitting devices in

<div align='center'>152</div>

the jurisdictions in which the Company operates, which regulations vary among countries. While some countries’ regulations may not impose barriers to marketing and selling the Company