Company: BLLN
Filing Date: 2025-08-11
Form Type: DRS/A
Source: 0000950123-25-007483
Chunk: 86

Company: BillionToOne, Inc.
Filing Date: 2025-08-11
Form: DRS/A
Chunk 86
---
 other jurisdictions will adopt similar laws. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision making,
which may be incompatible with our use of AI/ML. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI/ML, or prevent or
limit our use of AI/ML. For example, the FTC has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI/ML where they allege the company has violated privacy and consumer protection laws.
If we cannot use AI/ML or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.

In addition, the interpretation
and application of consumer, health-related and data protection laws, especially with respect to genetic samples and data, in the United States, European Economic Area (EEA) and elsewhere

53

are often uncertain, contradictory and in flux. The General Data Protection Regulation (GDPR) and other privacy laws and regulations related to the use, transfer, and protection of data impose obligations to the extent we test EU citizens or expand internationally. While we believe that our current processes and practices comply with the GDPR, we may need to expend considerable time and resources, including management attention, to revise our practices to ensure ongoing compliance with GDPR. Some of the above privacy laws and regulations in many cases may be more restrictive than, and may not be preempted by, HIPAA and its implementing rules. In addition, some countries have stricter consumer notice and/or consent requirements relating to personal data collection, use or sharing, more stringent requirements relating to organizations’ privacy programs and provide stronger individual rights. Failure to comply with GDPR and other applicable privacy or data security-related laws, rules or regulations in the EEA and elsewhere could have an adverse effect on our business, financial condition and results of operations. We expect that there will continue to be new proposed laws and regulations in the U.S. and internationally concerning data privacy and security, and we cannot yet determine the impact such future laws, regulations and standards may have on our business. Because the interpretation and application of laws, regulations, standards and other obligations relating to data privacy and security are still uncertain, these laws, regulations, standards and other obligations could be interpreted and applied in a manner that is inconsistent with our data processing practices and policies or the features of our