Company: IXHL
Filing Date: 2025-09-29
Form Type: 10-K
Source: 0001213900-25-092837
Chunk: 309

Company: Incannex Healthcare Inc.
Filing Date: 2025-09-29
Form: 10-K
Item: Item 1A
Chunk 309
---
 56. Notably, the “My Health My Data” Act contains a
private right of action. In addition, Nevada enacted a consumer health data privacy bill, SB 370, which also regulates “consumer
health data” and shares many similarities with Washington’s “My Health My Data” Act, and Connecticut recently
amended its comprehensive privacy law to include heightened regulation of “consumer health data.” Additional states may adopt
health-specific privacy laws that could impact our business activities and our collection and handling of health-related data.

Globally, numerous other countries have, or are
developing, laws governing the collection, use and transmission of personal information as well. For example, the European Parliament
and the Council of the European Union adopted a comprehensive general data privacy framework called the General Data Protection Regulation
(“GDPR”) which took effect in May 2018 and governs the collection and use of personal data in the European Union, including
by companies outside of the European Union. The GDPR, which is wide-ranging in scope, imposes several requirements relating to the consent
of the individuals to whom the personal data relates, the information provided to the individuals, the security and confidentiality of
the personal data, data breach notification, and the use of third-party processors in connection with the processing of the personal data.
The GDPR also imposes strict rules on the transfer of personal data out of the European Union to the United States, enhances enforcement
authority and imposes large penalties for noncompliance, including the potential for fines of up to €20 million or 4% of the annual
global revenues of the infringer, whichever is greater. The GDPR also confers a private right of action on data subjects and consumer
associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from
violations of the GDPR. Compliance with the GDPR has been and will continue to be a rigorous and time-intensive process that has increased
and will continue to increase our cost of doing business or require us to change our business practices, and despite those efforts, there
is a risk that we may be subject to fines and penalties, litigation and reputational harm in connection with any European activities,
which could adversely affect our business, prospects, financial condition and results of operations.

Additionally, following the United Kingdom’s
withdrawal from the European Union (i.e., Brexit), and the expiry of the Brexit transition period, which ended on December 31, 2020, the
GDPR has been implemented