Company: BOLT
Filing Date: 2025-03-24
Form Type: 10-K
Source: 0000950170-25-043873
Chunk: 85

Company: Bolt Biotherapeutics, Inc.
Filing Date: 2025-03-24
Form: 10-K
Item: Item 1A
Chunk 85
---
 Further, defending against any such actions can be costly and time-consuming, and may require significant financial and personnel resources. Therefore, even if we are successful in defending against any such actions that may be brought against us, our business may be impaired. If any of the physicians or other providers or entities with whom we expect to do business is found to not be in compliance with applicable laws, they may be subject to criminal, civil or administrative sanctions, including exclusions from government funded healthcare programs and imprisonment. If any of the above occur, it could adversely affect our ability to operate our business and our results of operations. 

We are subject to stringent and evolving U.S. and foreign laws, regulations, rules, industry standards, contractual obligations, policies and other obligations related to data privacy and security. Our actual or perceived failure to comply with privacy and data protection obligations could lead to government investigations or enforcement actions (which could include civil or criminal penalties), private litigation, reputational harm and/or adverse publicity and could negatively affect our operating results and business. 

We and our collaborators and third-party providers are subject to evolving federal, state and foreign data privacy and security laws and regulations. In the United States, numerous federal and state laws and regulations, including federal health information privacy laws, state data breach notification laws, proposed cybersecurity rules from the SEC, state health information privacy laws and federal and state consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), that govern the collection, use, disclosure and protection of health-related and other personal information could apply to our operations or the operations of our collaborators and third-party providers. 

In many jurisdictions, enforcement actions and consequences for noncompliance are rising. If we fail to follow security regulations or standards, even if no customer information is compromised, we may incur significant fines or experience a significant increase in costs. Many state legislatures have adopted legislation that regulates how businesses operate online, including measures relating to privacy, data security and data breaches. Laws in all 50 states require businesses to provide notice to customers whose personally identifiable information has been disclosed as a result of a data breach. The laws are not consistent, and compliance in the event of a widespread data breach is costly. 

For example, the California Consumer Privacy Act of 2018 (“CCPA”) applies to personal information of consumers, business representatives, and employees, and requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights.  The CCPA provides for civil penalties of up to $7