Company: SION
Filing Date: 2025-02-03
Form Type: S-1/A
Source: 0001193125-25-018825
Chunk: 110

Company: Sionna Therapeutics, Inc.
Filing Date: 2025-02-03
Form: S-1/A
Chunk 110
---
, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security.

The legislative and regulatory framework for the processing of personal data worldwide is rapidly evolving and is likely to remain uncertain for the
foreseeable future. In the U.S., there are numerous federal and state privacy and data security laws and regulations governing the collection, use, disclosure, transfer, security and processing of personal information, including federal and
state health information privacy laws, federal and state security breach notification laws, federal and state consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). In
addition, we may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to HIPAA, which imposes specific requirements relating to the privacy, security, and
transmission of individually identifiable health information. Depending on the facts and circumstances, we could be subject to criminal penalties if we knowingly obtain, use or disclose individually identifiable health information maintained by a
HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA.

At the state level, numerous U.S. states have enacted comprehensive
privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording individuals certain rights concerning their personal data. Similar laws are being considered in several
other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. While these states exempt some data processed in the context of clinical trials, these developments may further complicate
compliance efforts, and increase legal risk and compliance costs for us and the third parties upon whom we rely. Furthermore, other states have proposed or enacted legislation that is focused on more narrow aspects of privacy. For example, a number
of states have passed laws that protect biometric information and a smaller number of states have passed or are considering laws that are specifically focused upon health privacy, such as Washington’s My Health My Data Act. The My Health My
Data Act imposes new state restrictions and requirements on the processing and sale of consumer health data and creates a private right of action. The effects of state and federal privacy laws are potentially significant and may require us to modify
our data processing practices and policies and to incur substantial costs and potential liability in an effort to comply with such legislation.

77

Outside the U.S., an increasing number of laws,