Company: SCLXW
Filing Date: 2025-05-14
Form Type: 424B3
Source: 0001193125-25-119822
Chunk: 125

Company: Scilex Holding Co
Filing Date: 2025-05-14
Form: 424B3
Chunk 125
---
 signed by clinical trial subjects or the terms of the contract that we enter into with providers or other data sources.

Furthermore, U.S. state laws and regulations relating to data privacy and security and consumer protection are constantly evolving. For
example, the California Consumer Privacy Act and its implementing regulations (the “CCPA”), which went into effect on January 1, 2020, created new individual privacy rights for California consumers and placed increased privacy and
security obligations on entities handling personal data of consumers or households. The CCPA has been amended by the California Privacy Rights Act (the “CPRA”), which largely took effect on January 1, 2023. The CPRA also created a new
state agency, the CPPA, vested with authority to implement and, along with the California Attorney General, enforce the CCPA. Further, Washington’s My Health My Data Act, taking effect July 1, 2024, imposes requirements specific to
consumer health data. Several other states have enacted or are considering similar state consumer privacy laws. The state privacy laws vary from each other in many ways, which may complicate compliance efforts. The effects on our business of the
state privacy laws and general consumer protection authorities are potentially significant, and may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to so comply. Privacy laws
and regulations are constantly evolving and there are a number of legislative proposals at both the state and federal levels that could impose new obligations or limitations in areas affecting our business.

The FTC also sets expectations for failing to take appropriate steps to keep consumers’ personal information secure, or failing to
provide a level of security commensurate to promises made to individuals about the security of their personal information (such as in a privacy notice) may constitute unfair or deceptive acts or practices in violation of Section 5(a) of the FTC
Act. While we do not intend to engage in unfair or deceptive acts or practices, the FTC has the power to enforce promises as it interprets them, and events that we cannot fully control, such as data breaches, may be result in FTC enforcement.
Enforcement by the FTC under the FTC Act can result in civil penalties or enforcement actions.

International data protection laws,
including the EU’s and UK’s GDPR, may also apply to health-related and other personal information obtained outside of the United States. The GDPR imposes several data protection requirements in the EU, as well as fines for violations that
can reach up to the greater of €20 million or