Company: MLTX
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001821586-25-000006
Chunk: 62

Company: MoonLake Immunotherapeutics
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1
Chunk 62
---
 that country. The current approval process varies from country to country, and the time spent in gaining approval varies from that required for FDA approval. In certain countries, the sales price of a product must also be approved. The pricing review period often begins after market approval is granted. Even if a product is approved by a regulatory authority, satisfactory prices may not be approved for such product, which would make launch of such products commercially unfeasible in such countries. 

Regulation in the European Union

European Data Laws

The collection and use of personal health data and other personal data in the EU is governed by the provisions of the European General Data Protection Regulation (EU) 2016/679 (“GDPR”), which came into force in May 2018, and related data protection laws in individual EU Member States. The GDPR imposes a number of strict obligations and restrictions on the ability to process, including collecting, analyzing and transferring, personal data of individuals, in particular with respect to health data from clinical trials and adverse event reporting. The GDPR includes requirements relating to the legal basis of the processing (such as consent of the individuals to whom the personal data relates), the information provided to the individuals prior to processing their personal data, the personal data breaches which may have to be notified to the national data protection authorities and data subjects, the measures to be taken when engaging processors, and the security and confidentiality of the personal data. EU Member States may also impose additional requirements in relation to health, genetic and biometric data through their national legislation. 

30

MOONLAKE IMMUNOTHERAPEUTICSFORM 10-K FOR THE YEAR ENDED DECEMBER 31, 2024PART I

In addition, the GDPR imposes specific restrictions on the transfer of personal data to countries outside of the European Economic Area (“EEA”) that are not considered by the European Commission (“EC”) to provide an adequate level of data protection. Appropriate safeguards are required to enable such transfers. Among the appropriate safeguards that can be used, the data exporter may use the standard contractual clauses (“SCCs”). When relying on SCCs, data exporters are also required to conduct a transfer risk assessment to verify if anything in the law and/or practices of the third country may impinge on the effectiveness of the SCCs in the context of the transfer at stake and, if so, to identify and adopt supplementary measures that are necessary to bring the level of protection of the data transferred to the EU standard of essential equivalence. Where no supplementary measure is suitable, the data exporter should avoid