Company: NIVFW
Filing Date: 2025-04-22
Form Type: 20-F
Source: 0001213900-25-033966
Chunk: 36

Company: NewGenIvf Group Ltd
Filing Date: 2025-04-22
Form: 20-F
Item: Item 3
Chunk 36
---
 establishments, including private medical clinics, are under the supervision of the Cambodia
MOH and the Ministry of Health of Kyrgyzstan, respectively, which each governs and regulates the operation of medical clinics and activities
of medical practitioners in respective countries. In particular, the Medical Council of Cambodia, Cambodian Council of Nurses, Cambodian
Midwives Council and the Pharmaceutical Council of Cambodia, all assist the Cambodia MOH to supervise and monitor the practice of health
professionals in Cambodia. IVF/embryo implant/transfer activities are subject to an approval by the Cambodia MOH.

  Privacy and Security Requirements. There are numerous laws and regulations related to the privacy and security of health information in each country. In particular, regulations promulgated purs...  
 ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

NewGenIvf also has downstream entities
which provide it with services and are also subject to applicable regulations. If NewGenIvf or any of its downstream entities are unable
to properly protect the privacy and security of protected health information entrusted to it, it could be found to have breached its contracts
with its clients and be subject to investigation by the relevant supervision institution, i. e., the Office of the Personal Data Protection
Committee of Thailand (the Government Authority under the PDPA), the Cambodia MOH and the State Data Protection Agency under the Cabinet
of Ministers of Kyrgyzstan (the “ Agency”). In the event the Office of the Personal Data Protection Committee or the Agency
finds that NewGenIvf has failed to comply with applicable privacy and security standards, it could face civil, criminal, and/ or administrative
penalties. In addition, the Office of the Personal Data Protection Committee performs compliance audits in order to proactively enforce
the privacy and security standards. The Office of the Personal Data Protection Committee has become an increasingly active regulator and
has signaled its intention to continue this trend. The Office of the Personal Data Protection Committee has the discretion to impose penalties
and may require companies to enter into resolution agreements and corrective action plans which impose ongoing compliance requirements.
The Office of the Personal Data Protection Committee’s enforcement activity, or audit related to incident regarding it or its downstream
entity, can result in financial liability and reputational harm, and responses to such enforcement activity can consume significant internal
resources. Although NewGenIvf has implemented and maintain policies, processes and compliance program infrastructure to assist it in complying