Company: QTIWW
Filing Date: 2025-02-05
Form Type: 424B3
Source: 0001628280-25-004061
Chunk: 79

Company: QT IMAGING HOLDINGS, INC.
Filing Date: 2025-02-05
Form: 424B3
Chunk 79
---
 associates, like us, to develop and maintain policies and procedures with respect to protected health information that is used or disclosed,

<div align='center'>47</div>

#### Table of Contents
including the adoption of administrative, physical and technical safeguards to protect such information. HITECH expands the notification requirement for breaches of patient-identifiable health information, restricts certain disclosures and sales of patient-identifiable health information and provides for civil monetary penalties for HIPAA violations. HITECH also increased the civil and criminal penalties that may be imposed against Covered Entities and business associates and gave state attorneys general new authority to file civil actions for damages or injunctions in federal courts to enforce HIPAA and its implementing regulations and seek attorney’s fees and costs associated with pursuing federal civil actions. Additionally, certain states have adopted comparable privacy and security laws and regulations, some of which may be more stringent than HIPAA.

Internationally, many jurisdictions have or are considering enacting privacy or data protection laws or regulations relating to the collection, use, storage, transfer, disclosure and/or other processing of personal data, as well as certification requirements for the hosting of health data specifically. Such laws and regulations may include data hosting, data residency or data localization requirements (which generally require that certain types of data collected within a certain country be stored and processed within that country), data export restrictions, international transfer laws (which prohibit or impose conditions upon the transfer of such data from one country to another), or may require companies to implement privacy or data protection and security policies, enable users to access, correct and delete personal data stored or maintained by such companies, inform individuals of security breaches that affect their personal data or obtain individuals’ consent to use their personal data. For example, European legislators adopted the European Union’s General Data Protection Regulation (2016/679) (“

#### GDPR
”), which became effective on May 25, 2018, and are now in the process of finalizing the ePrivacy Regulation to replace the European ePrivacy Directive (Directive 2002/58/EC as amended by Directive 2009/136/EC). The GDPR, supplemented by national laws and further implemented through binding guidance from the European Data Protection Board, imposes more stringent European Union data protection requirements and provides for significant penalties for noncompliance. Further, the United Kingdom’s initiating a process to leave the European Union has created uncertainty with regard to the regulation of data protection in the United Kingdom. In particular, the United Kingdom has brought the GDPR into domestic law with the Data Protection Act of