Company: HURA
Filing Date: 2025-02-07
Form Type: S-4
Source: 0001193125-25-022803
Chunk: 143

Company: TuHURA Biosciences, Inc./NV
Filing Date: 2025-02-07
Form: S-4
Chunk 143
---
 on privacy and data protection issues with the potential to affect TuHURA’s business. Failure to comply with any of these laws and regulations by TuHURA or third parties to whom TuHURA contracts certain types of work (like clinical trials) could result in enforcement action against TuHURA or such third parties, including fines, imprisonment of company officials and public censure, claims for damages by affected individuals, damage to TuHURA’s reputation and loss of goodwill, any of which could have a material adverse effect on its business, financial condition, results of operations or prospects. There are numerous U.S. federal and state laws and regulations related to the privacy and security of personal information. In particular, regulations promulgated pursuant to the HIPAA, establish privacy and security standards that limit the use and disclosure of individually identifiable health information, or protected 82

health information, and require the implementation of administrative, physical and technological safeguards to protect the privacy of protected health information and ensure the confidentiality, integrity and availability of electronic protected health information. Determining whether protected health information has been handled in compliance with applicable privacy standards and its contractual obligations can be complex and may be subject to changing interpretation.

If TuHURA is unable to properly protect the privacy and security of protected health information or other personal, sensitive, or confidential information in its possession, TuHURA could be found to have breached its contracts. Further, if TuHURA fails to comply with applicable privacy laws, including applicable HIPAA privacy and security standards, TuHURA could face significant administrative, civil and criminal penalties. Enforcement activity can also result in financial liability and reputational harm, and responses to such enforcement activity can consume significant internal and outside resources. In addition, state attorneys general are authorized to bring civil actions seeking either injunctions or damages in response to violations that threaten the privacy of state residents. In addition to the risks associated with enforcement activities and potential contractual liabilities, TuHURA’s ongoing efforts to comply with evolving laws and regulations at the federal and state level may be costly and require ongoing modifications to its policies, procedures and systems.

In the EU, TuHURA may be subject to the General Data Protection Regulation (“GDPR”) which went into effect in May 2018 and which imposes obligations on companies that operate in TuHURA’s industry with respect to the processing of personal data and the cross-border transfer of such data. The GDPR imposes onerous accountability obligations requiring data controllers and processors to maintain a record of their data processing and policies. If TuHURA’s or