Company: KROS
Filing Date: 2025-08-06
Form Type: 10-Q
Source: 0001664710-25-000070
Chunk: 89

Company: Keros Therapeutics, Inc.
Filing Date: 2025-08-06
Form: 10-Q
Item: Item 4
Chunk 89
---
 may impact certain business activities such as vendor engagements, sale or sharing of data, 

76

employment of certain individuals and investor agreements. Violations of the rule could lead to significant civil and criminal fines and penalties. The rule applies regardless of whether data is anonymized, key-coded, pseudonymized, de-identified or encrypted, which presents particular challenges for companies like ours and may impact our ability to transfer data in connection with certain transactions or agreements.

Laws such as these give rise to an increasingly complex set of compliance obligations on us. These data protection rules continue to evolve and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions and increased costs of compliance. We strive to comply with these rules and obligations to the extent possible. Such compliance is a rigorous and time-consuming process.

We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. We publish privacy policies, marketing materials, whitepapers and other statements, such as statements related to compliance with certain certifications or self-regulatory principles, concerning data privacy and security. Although we endeavor to comply with our policies and other documentation, we may at times fail to do so or may be perceived to have failed to do so. Regulators in the United States are increasingly scrutinizing these statements, and if these policies, materials, statements or documentation are found to be deficient, lacking in transparency, deceptive, unfair, misleading or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences. 

Obligations related to data privacy and security (and individuals’ data privacy expectations) are quickly changing, becoming increasingly stringent and creating uncertainty. Additionally, these obligations are subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources. These obligations may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. In addition, these obligations may require us to change our business model. We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third parties with whom we work on may fail to comply with such obligations, which could negatively impact our business operations. If we or the third parties with whom we work fail, or are perceived to have failed, to address or comply