Company: SION
Filing Date: 2025-05-12
Form Type: 10-Q
Source: 0002036042-25-000016
Chunk: 85

Company: Sionna Therapeutics, Inc.
Filing Date: 2025-05-12
Form: 10-Q
Item: Part I, Item 3
Chunk 85
---
 protect us from liabilities, damages or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims. In addition to adverse impacts relating to experiencing a security incident, third parties may gather, collect or infer sensitive information about us from public sources, data brokers or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

74

Table of Contents

We are subject to stringent and evolving U.S. laws and regulations and foreign laws, regulations, rules, contractual obligations, policies and other obligations related to data privacy and security. Our actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations, reputational harm, loss of revenue or profits, and other adverse business consequences.

In the ordinary course of business, we and the third parties on which we rely process personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, data we collect about clinical trial participants and sensitive third-party data. Our data processing activities may subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security.

The legislative and regulatory framework for the processing of personal data worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future. In the U.S., there are numerous federal and state privacy and data security laws and regulations governing the collection, use, disclosure, transfer, security and processing of personal information, including federal and state health information privacy laws, federal and state security breach notification laws, federal and state consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). In addition, we may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to HIPAA, which imposes specific requirements relating to the privacy, security, and transmission of individually identifiable health information. Depending on the facts and circumstances, we could be subject to criminal penalties if we knowingly obtain, use or disclose individually identifiable health information maintained by a HIPAA-covered entity in a manner that is not authorized