Company: CRVO
Filing Date: 2025-03-17
Form Type: 10-K
Source: 0001437749-25-007829
Chunk: 104

Company: CervoMed Inc.
Filing Date: 2025-03-17
Form: 10-K
Item: Item 1A
Chunk 104
---
, other federal and state laws establish additional requirements for protecting the privacy and security of health information that is not protected by HIPAA. For instance, Washington state recently passed the “ My Health My Data” Act, which came into force in 2024 and regulates “consumer health data,” which is broadly defined as “personal information that is linked or reasonably linkable to a consumer and that identifies a consumer’s past, present, or future physical or mental health.” The “ My Health My Data” Act provides exemptions for personal data used or shared in connection with certain research activities, including data subject to 45 C. F. R. Parts 46, 50 and 56. Notably, the “ My Health My Data” Act contains a private right of action. In addition, Nevada recently enacted a consumer health data privacy bill, SB 370, which also took effect in 2024, and regulates “consumer health data.” SB 370 shares many similarities with Washington’s “ My Health My Data” Act, and Connecticut recently amended its comprehensive privacy law to include heighted regulation of “consumer health data.” Additional states are considering and may adopt health-specific privacy laws that could impact the Company’s business activities and the Company’s collection and handling of health-related data.

Numerous other countries have, or are developing, laws governing the collection, use and transmission of personal information as well. For example, the European Parliament and the Council of the European Union adopted a comprehensive general data privacy framework called the GDPR which became fully effective in May 2018 and governs the collection and use of personal data in the European Union, including by companies outside of the European Union., The GDPR also imposes strict rules on the transfer of personal data out of the European Union to the U. S. The GDPR imposes stringent data protection requirements and provides for penalties for noncompliance of up to the greater of €20 million or four percent of worldwide annual turnover. The GDPR and many other laws and regulations relating to privacy and data protection are still being tested in courts, and they are subject to new and differing interpretations by courts and regulatory officials. The GDPR and other changes in laws or regulations associated with the enhanced protection of certain types of personal data, such as healthcare data or other sensitive information, could greatly increase the Company’s cost of providing the Company’s products and services or even prevent us from offering certain services in jurisdictions that the Company may operate in. The GDPR may increase the Company’s responsibility and liability in relation to personal data that the Company processes where such processing is subject