Company: CMND
Filing Date: 2025-12-05
Form Type: F-1/A
Source: 0001213900-25-118772
Chunk: 71

Company: Clearmind Medicine Inc.
Filing Date: 2025-12-05
Form: F-1/A
Chunk 71
---
 effect in May 2018 and establishes a strengthened individual data rights regime and imposes several requirements for controllers and processors of personal data relating to the establishment of a legal basis for processing, the consent of the individuals to whom the personal data relates, notification of data processing obligations to the competent national data protection authorities, the implementation of safeguards to protect the security and confidentiality of the personal data that requires the adoption of administrative, physical and technical safeguards, shortened timelines for data breach notifications to appropriate data protection authorities or data subjects, limitations on retention and secondary use of information, as well as increased requirements pertaining to health data and pseudonymized (i.e. ,key-coded) data and additional obligations when data controllers contract with third-party processors in connection with the processing of the personal data. The GDPR also imposes strict rules on the transfer of personal data out of the EEA to recipients in countries outside the EEA, such as the United States. The GDPR allows EU and EEA member states to make additional laws and regulations further limiting the processing of genetic, biometric or health data. Failure to comply with the requirements of the GDPR and the related national data protection laws of the EU and EEA Member States may result in fines of up to €20,000,000 or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher, and other administrative penalties. In addition, the GDPR confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. The GDPR may impose additional responsibility and liability in relation to personal data that we process and we may be required to put in place additional mechanisms ensuring compliance with these and/or new data protection rules. For example, the GDPR increases our obligations with respect to clinical trials conducted in the EEA by expanding the definition of personal data to include coded data and requiring changes to informed consent practices and more detailed notices for clinical trial subjects and investigators. This may be onerous and adversely affect our business, prospects, financial condition and results of operations. The United Kingdom has transposed the GDPR into domestic law, with its version of the GDPR taking effect in January 2021, which could expose us to two parallel regimes, each of which potentially authorizes similar fines for certain violations. Other EU countries have also passed or are considering passing similar laws. Compliance with U.S. and international data protection laws and regulations, including the GDPR, the CCPA and the CPRA could require