Company: NIVFW
Filing Date: 2025-03-07
Form Type: F-1
Source: 0001213900-25-021404
Chunk: 73

Company: NewGenIvf Group Ltd
Filing Date: 2025-03-07
Form: F-1
Chunk 73
---
 Data Protection Law also provide patients with rights related to understanding        
 and controlling how their protected health information is collected, used and/ or disclosed. As a provider of services to entities           
 subject to the PDPA and Data Protection Law, NewGenIvf is directly subject to certain provisions of the regulations. To the extent           
 permitted by applicable privacy regulations and contracts with its clients, NewGenIvf is permitted to use and disclose protected             
 health information to perform its services and for other limited purposes, but other uses and disclosures, such as marketing communications, 
 require written authorization from the patient or must meet an exception specified under the privacy regulations.                            |

47 NewGenIvf also has downstream entities which provide it with services and are also subject to applicable regulations. If NewGenIvf or any of its downstream entities are unable to properly protect the privacy and security of protected health information entrusted to it, it could be found to have breached its contracts with its clients and be subject to investigation by the relevant supervision institution, i.e., the Office of the Personal Data Protection Committee of Thailand (the Government Authority under the PDPA), the Cambodia MOH and the State Data Protection Agency under the Cabinet of Ministers of Kyrgyzstan (the “Agency”). In the event the Office of the Personal Data Protection Committee or the Agency finds that NewGenIvf has failed to comply with applicable privacy and security standards, it could face civil, criminal, and/ or administrative penalties. In addition, the Office of the Personal Data Protection Committee performs compliance audits in order to proactively enforce the privacy and security standards. The Office of the Personal Data Protection Committee has become an increasingly active regulator and has signaled its intention to continue this trend. The Office of the Personal Data Protection Committee has the discretion to impose penalties and may require companies to enter into resolution agreements and corrective action plans which impose ongoing compliance requirements. The Office of the Personal Data Protection Committee’s enforcement activity, or audit related to incident regarding it or its downstream entity, can result in financial liability and reputational harm, and responses to such enforcement activity can consume significant internal resources. Although NewGenIvf has implemented and maintain policies, processes and compliance program infrastructure to assist it in complying with these laws and regulations and its contractual obligations, NewGenIvf cannot provide assurance regarding how these laws and regulations will be interpreted, enforced or applied to its operations. In associated with enforcement activities and potential contractual liabilities, its ongoing efforts to comply with evolving laws and regulations might also require it to make costly system purchases and/or modifications or otherwise divert