Company: DARE
Filing Date: 2025-04-24
Form Type: ARS
Source: 0001401914-25-000018
Chunk: 102

Company: Dare Bioscience, Inc.
Filing Date: 2025-04-24
Form: ARS
Chunk 102
---
 “demonstrable difficulties for compounding.” The FDA must publish a list of such drugs, through notice and comment rulemaking, before implementing the prohibition, and FDA has not yet finalized any such lists for publication. Data Privacy and the Protection of Personal Information We are subject to numerous laws and regulations governing data privacy and the protection of personal information of patients, clinical investigators, employees, and vendors/business contacts including in relation to medical records and other health information, credit card data and financial information. The legislative and regulatory landscape for privacy and data protection continues to evolve, and there has been an increasing focus on privacy and data protection issues which will continue to affect our business. In the United States, we may be subject to state security breach notification laws, state laws protecting the privacy of health and personal information and federal and state consumer protections laws that regulate the collection, use, disclosure and transmission of personal information. These laws overlap and often conflict and each of these laws is subject to varying interpretations by courts and government agencies, creating complex compliance issues. If we fail to comply with applicable laws and regulations we could be subject to penalties or sanctions, including criminal penalties as well as reputational harm. Our customers and research partners must comply with laws governing the privacy and security of health information, including HIPAA, HITECH and state health information privacy laws. If we knowingly obtain protected health information without the authority to do so, our customers or research collaborators may be subject to enforcement and we may have direct liability for the unlawful receipt of protected health information or for aiding and abetting a HIPAA violation. Even when HIPAA does not apply, according to the Federal Trade Commission, or the FTC, failing to take appropriate steps to keep consumers’ personal information secure, or failing to provide a level of security commensurate to promises made to individual about the security of their personal information (such as in a privacy notice) may constitute unfair or deceptive acts or practices in violation of Section 5(a) of the Federal Trade Commission Act, or the FTC Act. The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards. The FTC’s guidance for appropriately securing consumers’ personal information is similar to what is required by the HIPAA Security Rule. The FTC and states' Attorneys General have brought enforcement actions and prosecuted some data