Company: APM
Filing Date: 2025-12-05
Form Type: 424B5
Source: 0001213900-25-118752
Chunk: 141

Company: Aptorum Group Ltd
Filing Date: 2025-12-05
Form: 424B5
Chunk 141
---
 to undertake a cybersecurity review by the
CAC. Further, as of the date hereof, neither we nor our subsidiaries have been subject to any penalties, fines, suspensions, or investigations
from any competent authorities for violation of the regulations or policies that the CAC has issued.

<div align='center'>74</div>

On June 10, 2021, the
Standing Committee of the National People’s Congress promulgated the Data Security Law, which took effect on September 1, 2021.
The Data Security Law requires that data shall not be collected by theft or other illegal means, and it also provides for a data classification
and hierarchical protection system. The data classification and hierarchical protection system protects data according to its importance
in economic and social development, and the damages it may cause to national security, public interests, or the legitimate rights and
interests of individuals and organizations if the data is falsified, damaged, disclosed, illegally obtained or illegally used, which protection
system is expected to be built by the state for data security in the near future. On November 14, 2021, CAC published the Regulations
on the Data Security Administration Draft, or the “Data Security Regulations Draft”, to solicit public opinion and comments.
Under the Data Security Regulations Draft, an overseas initial public offering to be conducted by a data processor processing the personal
information of more than one million individuals shall apply for a cybersecurity review. Data processor means an individual or organization
that independently makes decisions on the purpose and manner of processing in data processing activities, and data processing activities
refers to activities such as the collection, retention, use, processing, transmission, provision, disclosure, or deletion of data. Currently
we do not expect the Review Measures to have an impact on the business and operations of our Hong Kong subsidiaries, because (i) our
Hong Kong subsidiaries are incorporated and operating in Hong Kong without any subsidiary or variety interest entity (“VIE”)
structure in mainland China, and it is unclear whether the Review Measures shall be applied to a Hong Kong company; (ii) as
of the date of hereof, our Hong Kong subsidiaries have not collected or stored personal information of any individual clients of
mainland China; and (iii) as of the date hereof, our Hong Kong subsidiaries have not been informed by any PRC governmental authority
of any requirement that it file for a cybersecurity review for the offering. Based on laws and regulations currently in effect in the
PRC as of the date