Company: QTIWW
Filing Date: 2025-12-31
Form Type: 424B3
Source: 0001628280-25-059235
Chunk: 78

Company: QT IMAGING HOLDINGS, INC.
Filing Date: 2025-12-31
Form: 424B3
Chunk 78
---
 European ePrivacy Directive (Directive 2002/58/EC as amended by Directive 2009/136/EC). The GDPR, supplemented by national laws and further implemented through binding guidance from the European Data Protection Board, imposes more stringent European Union data protection requirements and provides for significant penalties for noncompliance. Further, the United Kingdom’s initiating a process to leave the European Union has created uncertainty with regard to the regulation of data protection in the United Kingdom. In particular, the United Kingdom has brought the GDPR into domestic law with the Data Protection Act of 2018 which will remain in force, even if and when the United Kingdom leaves the European Union.

Virtually every jurisdiction in which we expect to operate has established its own data security and privacy legal framework with which we must, and our target customers will need to, comply, including the rules and regulation mentioned above. We may also need to comply with varying and possibly conflicting privacy laws and regulations in other jurisdictions. As a result, we could face regulatory actions, including significant fines or penalties, adverse publicity and possible loss of business.

In addition, there are ongoing public policy discussions regarding whether the standards for de-identified, anonymous or pseudonymized health information are sufficient to adequately protect patient privacy. These discussions may lead to further restrictions on the use or disclosure of such information. We use a third party service provider to de-identify PHI that parties with which we work receive and may make available to us. There can be no assurance that the policy initiatives or future initiatives will not adversely affect our ability to access and use data or to develop or market current or future services, or that the third party service providers that we use to de-identify PHI will do so in a manner that is deemed compliant with any regulatory standards that currently exist or are developed in the future. There is also a risk that the third parties that license us data and enable us to receive de-identified PHI may fail to properly de-identify PHI under HIPAA or personal data under applicable state or other privacy laws, some of which may impose different standards for de- identification than those required by HIPAA. Furthermore, if we are unable to secure these rights to de-identified information or because of any future changes to HIPAA or other applicable laws, we may face limitations on the use of PHI and our ability to use de-identified information that could negatively affect the scope of our product and service offering as well as impair our ability to provide upgrades and enhancements to our services.

While we are preparing to implement various measures intended