Company: HURA
Filing Date: 2025-05-06
Form Type: S-4/A
Source: 0001193125-25-113920
Chunk: 250

Company: TuHURA Biosciences, Inc./NV
Filing Date: 2025-05-06
Form: S-4/A
Chunk 250
---
 employees, and Kineta is subject to laws and regulations governing the privacy and security of such information. In the United States, there are numerous federal and state privacy and data security laws and regulations governing the collection, use, disclosure and protection of personal information, including federal and state health information privacy laws, federal and state security breach notification laws, and federal and state consumer protection laws. The legislative and regulatory landscape for privacy and data protection continues to evolve, and there has been an increasing focus on privacy and data protection issues, including with respect to regulatory enforcement and private litigation, which may affect Kineta’s business and is expected to increase its compliance costs and**

<div align='center'>147</div>

exposure to liability. In the United States, numerous federal and state laws and regulations could apply to Kineta’s operations or the operations of Kineta’s partners, including state data breach notification laws, state health information privacy laws and federal and state consumer protection laws and regulations (e.g., Section 5 of the FTC Act), that govern the collection, use, disclosure and protection of health-related and other personal information. In addition, Kineta may obtain health information from third parties (including research institutions from which Kineta obtains clinical trial data) that are subject to privacy and security requirements under HIPAA, as amended by HITECH and regulations promulgated thereunder. Depending on the facts and circumstances, Kineta could be subject to significant penalties if Kineta obtains, uses or discloses, or is subject to an actual or alleged data breach regarding, individually identifiable health information in a manner that is not authorized or permitted by HIPAA.

In the EEA, Kineta is subject to the EU General Data Protection Regulation (the “EU GDPR”), which took effect in May 2018. The EU GDPR governs the collection, use, disclosure, transfer or other processing of personal data (i.e., data which identifies an individual or from which an individual is identifiable), including clinical trial data, and grants individuals various data protection rights (e.g., the right to erasure of personal data). The EU GDPR imposes a number of obligations on companies, including inter alia: (i) accountability and transparency requirements, and enhanced requirements for obtaining valid consent; (ii) obligations to consider data protection as any new products or services are developed and to limit the amount of personal data processed; and (iii) obligations to implement appropriate technical and organizational measures to safeguard personal data and to report certain personal data breaches to the supervisory authority without undue delay (and