Company: SMNR
Filing Date: 2025-08-12
Form Type: S-4/A
Source: 0001193125-25-178821
Chunk: 218

Company: Semnur Pharmaceuticals, Inc.
Filing Date: 2025-08-12
Form: S-4/A
Chunk 218
---
AA, as we are neither a Covered Entity nor Business Associate (as such terms are defined in HIPAA), we may have access to very sensitive data regarding patients who participate in, or whose tissue samples or other biospecimens are used in, our clinical trials. The maintenance of this data imposes upon us administrative and financial burdens and litigation risks. In addition, we may obtain health information from third parties, including research institutions from which we obtain clinical trial data that are subject to HIPAA**

<div align='center'>119</div>

and other privacy, data security and consumer protection laws. Depending on the facts and circumstances, we could be subject to criminal penalties if we knowingly receive individually identifiable health information maintained by a Covered Entity in a manner that is not authorized by HIPAA, and we may be subject to other civil and/or criminal penalties if we obtain, use, or disclose information in a manner not permitted by other privacy and data security and consumer protection laws. Our ability to use or disclose information may be limited by the scope of an authorization signed by clinical trial subjects or the terms of the contract that we enter into with providers or other data sources.

Furthermore, U.S. state laws and regulations relating to data privacy and security and consumer protection are constantly evolving. For example, the California Consumer Privacy Act and its implementing regulations (the “CCPA”), which went into effect on January 1, 2020, created new individual privacy rights for California consumers and placed increased privacy and security obligations on entities handling personal data of consumers or households. The CCPA has been amended by the California Privacy Rights Act (“CPRA”), which largely took effect on January 1, 2023. The CPRA also created a new state agency, the CPPA, vested with authority to implement and, along with the California Attorney General, enforce the CCPA. Further, Washington’s My Health My Data Act, taking effect July 1, 2024, imposes requirements specific to consumer health data. Several other states have enacted or are considering similar state consumer privacy laws. The state privacy laws vary from each other in many ways, which may complicate compliance efforts. The effects on our business of the state privacy laws and general consumer protection authorities are potentially significant, and may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to so comply. Privacy laws and regulations are constantly evolving and there are a number of legislative proposals at both the state and federal levels that could impose new obligations or limitations in areas affecting our business.