Company: HCTI
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001213900-25-026218
Chunk: 164

Company: Healthcare Triangle, Inc.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1A
Chunk 164
---
 choice, security,
and access. Consumer protection laws require us to publish statements that describe how we handle information about individuals and choices
individuals may have about the way we handle their information. If such information that we publish is considered untrue, we may be subject
to government claims of unfair or deceptive trade practices, which could lead to significant liabilities and consequences. Furthermore,
according to the FTC violating consumers’ privacy rights or failing to take appropriate steps to keep information about consumers
secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the FTC Act.

19

In addition, certain states have adopted robust
privacy and security laws and regulations. Such laws and regulations will be subject to interpretation by various courts and other governmental
authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. For example,
the CCPA, which took effect in 2020, imposes obligations and restrictions on businesses regarding their collection, use, and sharing of
personal information and provides new and enhanced data privacy rights to California residents, such as affording them the right to access
and delete their personal information and to opt-out of certain sharing of personal information. Protected health information that is
subject to HIPAA is excluded from the CCPA, however, the information we hold about individuals that is not subject to HIPAA would be subject
to the CCPA. It is unclear how HIPAA and the other exceptions may be applied under the CCPA. The CCPA may increase our compliance costs
and potential liability. Many similar privacy laws have been proposed at the federal level and in other states.

The GDPR became enforceable on May 25, 2018. The
GDPR regulates our processing of personal data, and imposes stringent requirements. The GDPR includes sanctions for violations up to the
greater of €20 million or 4.0% of worldwide gross annual revenue and applies to services providers such as us. In addition, from
the beginning of 2021(when the transitional period following Brexit expires), we will have to comply with the GDPR and also the UK GDPR,
with each regime having the ability to fine up to the greater of €20 million (£17 million) or 4% of global turnover. The relationship
between the United Kingdom and the European Union in relation to certain aspects of data protection law remains unclear, for example how
data transfers between EU member states and the United Kingdom will be treated and the role of the Information Commissioner’s Office
following the end of