Company: BLLN
Filing Date: 2025-12-10
Form Type: 10-Q
Source: 0001628280-25-056321
Chunk: 576

Company: BillionToOne, Inc.
Filing Date: 2025-12-10
Form: 10-Q
Item: Part I, Item 2
Chunk 576
---
 the collection, use, retention, security, disclosure, transfer and other processing of sensitive and personal information in the jurisdictions in which we operate. In many cases, these laws, regulations and standards apply not only to third-party transactions, but also to transfers of information between or among us and other parties with which we have commercial relationships. These laws, regulations and standards are interpreted and applied differently over time and from jurisdiction to jurisdiction, and it is possible that they will be interpreted and applied in ways that will materially and adversely affect our business, financial condition and results of operations. The regulatory framework for data privacy, data security and data transfers worldwide is rapidly evolving and, as a result, interpretation and implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future.

Numerous federal, state and foreign laws and regulations govern collection, dissemination, use and confidentiality of PHI, including: the federal Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, and regulations promulgated thereunder (collectively, HIPAA); state privacy and confidentiality laws (including state laws requiring disclosure of breaches); federal and state consumer protection and employment laws; and European and other foreign data protection laws. In addition to government regulation, privacy advocates and industry groups have and may in the future propose self-regulatory standards, which may legally or contractually apply to us or which we may elect to comply with such standards. Implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, standards or perception of their requirements may have on our business. This evolution often creates uncertainty in our business, affect our ability to operate in certain jurisdictions, necessitate the acceptance of more onerous obligations in our contracts, result in liability or impose additional costs on us. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the future. Any failure or perceived failure by us to comply with laws or regulation, our internal policies and procedures or our contracts governing processing of personal information could result in negative publicity, government investigations and enforcement actions, claims by third parties and damage to our reputation, any of which could have a material adverse effect on our operations, financial performance and business.

75

We are a covered entity under HIPAA, and therefore, must comply with its requirements to protect the privacy and security of PHI and must provide individuals with certain rights with respect to their PHI. We currently, and will