Company: HCTI
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001213900-25-026218
Chunk: 165

Company: Healthcare Triangle, Inc.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1A
Chunk 165
---
 the transitional period. These changes will lead to additional costs and increase our overall risk exposure.

Recent legal developments in Europe have created
complexity and uncertainty regarding transfers of personal data from the EEA to the United States, e.g., on July 16, 2020, the
Court of Justice of the European Union (“CJEU”) invalidated the EU-US Privacy Shield Framework (“Privacy Shield”)
under which personal data could be transferred from the EEA to U.S. entities who had self-certified under the Privacy Shield scheme. While
the CJEU upheld the adequacy of the standard contractual clauses (a standard form of contract approved by the European Commission as an
adequate personal data transfer mechanism, and a potential alternative to the Privacy Shield), it made clear that reliance on them alone
may not necessarily be sufficient in all circumstances; this has created uncertainty. At the moment we have not implemented any Privacy
Shield procedures or certifications. We also currently rely on the standard contractual clauses to transfer personal data outside the
EEA, including to the United States. It may subject us to a lawsuit of a European Union citizen, if we inadvertently process their personally-identifiable
information.

The United States, the European Union, and other
jurisdictions where we operate continue to issue new and enhance existing, privacy and data security protection regulations related to
the collection, use, disclosure, disposal, and protection of information about individuals, including medical information. Privacy and
data security laws are rapidly evolving both in the United States and internationally, and the future interpretation of those laws is
somewhat uncertain. E.g., we do not know how E.U. regulators will interpret or enforce many aspects of the GDPR and some regulators
may do so in an inconsistent manner. In the United States, privacy and data security is an area of emphasis for some but not all state
regulators, and new legislation has been and likely will continue to be introduced at the state and/or federal level. For instance, there
is a new act on the ballot in California, the California Privacy Rights Act, which may go into effect in 2023. Additional legislation
or regulation might, among other things, require us to implement new security measures and processes or bring within the legislation or
regulation de-identified health or other information about individuals, each of which may require substantial expenditures or limit our
ability to offer some of our services.

Risks Related to Our Industry

Markets for our products and services are highly
competitive and subject to