Company: SION
Filing Date: 2025-11-05
Form Type: 10-Q
Source: 0001628280-25-049251
Chunk: 557

Company: Sionna Therapeutics, Inc.
Filing Date: 2025-11-05
Form: 10-Q
Item: Part I, Item 2
Chunk 557
---
 for us and the third parties upon whom we rely. Furthermore, other states have proposed or enacted legislation that is focused on more narrow aspects of privacy. For example, a number of states have passed laws that protect biometric information and a smaller number of states have passed or are considering laws that are specifically focused upon health privacy, such as Washington’s My Health My Data Act. The My Health My Data Act imposes new state restrictions and requirements on the processing and sale of consumer health data and creates a private right of action. The effects of state and federal privacy laws are potentially significant and may require us to modify our data processing practices and policies and to incur substantial costs and potential liability in an effort to comply with such legislation.

Outside the U.S., an increasing number of laws, regulations, and industry standards may govern data privacy and security. For example, if we commence clinical trials in Europe, our processing of personal data in that context would become subject to the European Union’s General Data Protection Regulation (“EU GDPR”), and/or the United Kingdom’s so-called “UK GDPR” (together, the “GDPR”). The GDPR is wide-ranging in scope and imposes numerous requirements on companies that are subject to it, including relating to having a legal basis for processing personal data, relating to the processing of sensitive data (such as health data), obtaining consent of the individuals to whom the personal data relates, providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of personal data, notification of data breaches, requiring data protection impact assessments for high risk processing and taking certain measures when engaging third-party processors. The GDPR also imposes strict rules on the transfer of personal data to countries outside the European Union and the UK, including the U.S., and permits data 

78

protection authorities to impose large penalties for violations of the GDPR, including potential fines of up to €20 million (£17.5 million) or 4% of annual global revenues, whichever is greater. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR.

In addition, we may be unable to transfer personal data from Europe and other jurisdictions to the U.S. or other countries due to data localization requirements or limitations on cross-border data flows. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area (“EEA”) and the United