Company: SCLXW
Filing Date: 2025-05-14
Form Type: 424B3
Source: 0001193125-25-119846
Chunk: 299

Company: Scilex Holding Co
Filing Date: 2025-05-14
Form: 424B3
Chunk 299
---
 to keep
consumers’ personal information secure and to make accurate statements regarding how they secure personal information under their custody or control, such as in a privacy notice. The FTC also expects a company’s data security measures to
be reasonable and appropriate in light of the sensitivity and volume of personal information it holds, the size and complexity of its business, and the cost of available tools to improve data security and reduce vulnerabilities. Individually
identifiable health information, which we process, is considered sensitive data that merits stronger safeguards. Violations of the foregoing FTC requirements may constitute unfair or deceptive acts or practices under Section 5(a) of the Federal
Trade Commission Act (the “FTC Act”). While we do not intend to engage in unfair or deceptive acts or practices, the FTC has the power to bring enforcement actions based on the FTC’s interpretation of public privacy statements.
Further, events that we cannot fully control, such as data breaches, may also result in civil penalties, FTC enforcement or enforcement by U.S. state attorneys general or other regulators. Various U.S. states have implemented privacy laws and
regulations that regulate the use and disclosure of health information and other personal information. For example, the CCPA, established a privacy framework for covered businesses by, among other items, expanding the definition of personal
information, establishing new data privacy rights for consumers who are California residents, imposing rules on the collection of personal information from minors, and creating a statutory damages framework for violations of the CCPA, including for
failure to implement reasonable security procedures and practices to prevent data breaches. Penalties for violations of the CCPA include civil penalties and may result in related legal claims. The CPRA, most provisions of which became operative on
January 1, 2023, introduced significant amendments to the CCPA and established and funded a dedicated California privacy regulator, the California Privacy Protection Agency. Several other states have implemented similar consumer privacy laws
that took effect in the past year or will take effect in the near future. Further, Washington’s My Health My Data Act, taking effect July 1, 2024, imposes requirements specific to consumer health data. The foregoing U.S. state privacy laws
impose many similar obligations as the CCPA on our processing of personal information. Other U.S. states are considering similar privacy legislation, and industry organizations regularly adopt and advocate for new standards in these areas. The
uncertainty, ambiguity, complexity, and potential inconsistency surrounding the implementation and interpretation of the CCPA and other enacted or forthcoming U