Company: HURA
Filing Date: 2025-02-07
Form Type: S-4
Source: 0001193125-25-022803
Chunk: 247

Company: TuHURA Biosciences, Inc./NV
Filing Date: 2025-02-07
Form: S-4
Chunk 247
---
 parties (including research institutions from which Kineta obtains clinical trial data) that are subject to privacy and security requirements under HIPAA, as amended by HITECH and regulations promulgated thereunder. Depending on the facts and circumstances, Kineta could be subject to significant penalties if Kineta obtains, uses or discloses, or is subject to an actual or alleged data breach regarding, individually identifiable health information in a manner that is not authorized or permitted by HIPAA.

In the EEA, Kineta is subject to the EU General Data Protection Regulation (the “EU GDPR”), which took effect in May 2018. The EU GDPR governs the collection, use, disclosure, transfer or other processing of personal data (i.e., data which identifies an individual or from which an individual is identifiable), including clinical trial data, and grants individuals various data protection rights (e.g., the right to erasure of personal data). The EU GDPR imposes a number of obligations on companies, including inter alia: (i) accountability and transparency requirements, and enhanced requirements for obtaining valid consent; (ii) obligations to consider data protection as any new products or services are developed and to limit the amount of personal data processed; and (iii) obligations to implement appropriate technical and organizational measures to safeguard personal data and to report certain personal data breaches to the supervisory authority without undue delay (and no later than 72 hours where feasible). In addition, the EU GDPR prohibits the transfer of personal data from the EEA to the United States and other jurisdictions that the European Commission does not recognize as having “adequate” data protection laws unless a data transfer mechanism has been put in place. In July 2020, the Court of Justice of the EU (the “CJEU”) limited how organizations could lawfully transfer personal data from the EEA to the United States by invalidating the EU-US Privacy Shield for purposes of international transfers and imposing further restrictions on use of the standard contractual clauses (the “SCCs”), including a requirement for companies to carry out a transfer privacy impact assessment, which, among other things, assesses laws governing access to personal data in the recipient country and considers whether supplementary measures that provide privacy protections additional to those provided under SCCs will need to be implemented to ensure an essentially equivalent level of data protection to that afforded in the EEA. The European Commission subsequently issued new SCCs in June 2021 to account for the decision of the CJEU and recommendations made by the European Data Protection Board and which are in turn relatively more on