Company: TVRD
Filing Date: 2025-10-07
Form Type: S-1/A
Source: 0001104659-25-097519
Chunk: 111

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-10-07
Form: S-1/A
Chunk 111
---
 collection, use, storage or processing of personal information, which may increase its compliance expenses and make its business more costly or less efficient to conduct. In addition, any such changes could compromise the Company’s ability to develop an adequate marketing strategy and pursue its growth strategy effectively or even prevent the Company from providing certain products in jurisdictions in which it currently operates and in which the Company may operate in the future or incur potential liability in an effort to comply with such legislation, which, in turn, could adversely affect its business, financial condition, results of operations and prospects.

Complying with these numerous, complex and often changing obligations is expensive and difficult, and failure to comply with any data privacy or security obligations, whether by the Company, one of its CROs, CMOs, partners or another third party, could adversely affect its business, financial condition, results of operations and prospects, including but not limited to: investigation costs; material fines and penalties; compensatory, special, punitive and statutory damages; litigation; consent orders regarding the Company’s privacy and security practices; requirements that it provides notices, credit monitoring services and/or credit restoration services or other relevant services to impacted individuals; adverse actions against the Company’s licenses to do business; reputational damage; and injunctive relief. In addition, new regulation or legislative actions regarding data privacy and security (together with applicable industry standards) may increase its costs of doing business.

In this regard, the Company expects that there will continue to be new proposed laws, regulations and industry standards relating to privacy and data protection in the United States, the EEA and other jurisdictions, and it cannot determine the impact such future laws, regulations and standards may have on its business. For example, the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places additional restriction on certain data transactions involving countries of concern (e.g., China, Russia, Iran) and covered individuals (i.e., individuals and entities located in or controlled by individuals or entities located in those jurisdictions) that may impact certain business activities such as vendor engagements, sale or sharing of data, employment of certain individuals, and investor agreements. Violations of the rule could lead to significant civil and criminal fines and penalties. The rule applies regardless of whether data is anonymized, key-coded, pseudonymized, de-identified or encrypted, which presents particular challenges for companies like ours and may impact our ability to transfer data in