Company: TVRD
Filing Date: 2025-02-14
Form Type: S-4/A
Source: 0001104659-25-013053
Chunk: 232

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-02-14
Form: S-4/A
Chunk 232
---
 right to correct personal information and additional opt-out rights for certain uses and sensitive data, and imposes additional data protection obligations on covered businesses, including additional limitations on data uses and new audit requirements for higher risk data. The CPRA also established a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. Other states, such as Virginia, Indiana, Oregon, Texas, Tennessee, Montana, Iowa, Delaware, Connecticut, Utah and Colorado, have also passed comprehensive privacy laws, and similar laws are being considered in several other states, as well as at the federal and local levels. While these state privacy laws, like the CCPA, also exempt some data processed in the context of clinical trials, these laws could have potentially conflicting requirements that further complicate compliance efforts, and increase legal risk and compliance costs for Tvardi and the third parties upon whom it relies. In the event that Tvardi is subject to or affected by HIPAA, the CCPA, the CPRA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect its financial condition. In addition to government activity, privacy advocacy groups and technology and other industries are considering various new, additional or different self-regulatory standards that may place additional burdens on Tvardi. In addition to data privacy and security laws, Tvardi is also bound by other contractual obligations related to data privacy and security, and its efforts to comply with such obligations may not be successful.

Each of these laws, rules, regulations and contractual obligations relating to data privacy and security, and any other such changes or new laws, rules, regulations or contractual obligations could impose significant limitations, require changes to Tvardi’s business, or restrict its collection, use, storage or processing of personal information, which may increase its compliance expenses and make its business more costly or less efficient to conduct. In addition, any such changes could compromise Tvardi’s ability to develop an adequate marketing strategy and pursue its growth strategy effectively or even prevent Tvardi from providing certain products in jurisdictions in which it currently operates and in which Tvardi may operate in the future or incur potential liability in an effort to comply with such legislation, which, in turn, could adversely affect its business, financial condition, results of operations and prospects. Complying with these numerous, complex and often changing regulations is expensive and difficult, and failure to comply with any data privacy or security laws, whether by Tvardi, one of its CRO