Company: TVRD
Filing Date: 2025-02-14
Form Type: 424B3
Source: 0001104659-25-014310
Chunk: 230

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-02-14
Form: 424B3
Chunk 230
---
 processing and protection of health-related and other personal information. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for Tvardi and its future customers and strategic partners. For example, the California Consumer Privacy Act (CCPA), went into effect on January 1, 2020 and applies to the personal information of California consumers, business representatives, and employees, and increases the privacy and security obligations of entities handling certain personal information, including among other things, requiring businesses to provide specific disclosures in privacy notices and honor requests of

<div align='center'>129</div>

TABLE OF CONTENTS

California residents to exercise certain privacy rights, including the right to opt out of certain disclosures of their information. The CCPA provides for civil penalties of up to $7,500 per violation as well as a private right of action with statutory damages for certain data breaches, thereby potentially increasing the likelihood of, and risks associated with, data breach litigation. Although the law includes limited exceptions, including for certain information collected as part of clinical trials, the CCPA may impact Tvardi’s processing of personal information and increases its compliance costs. Additionally, the California Privacy Rights Act of 2020 (CPRA) generally went into effect on January 1, 2023, and significantly expands the CCPA, such as granting additional rights to California residents, including the right to correct personal information and additional opt-out rights for certain uses and sensitive data, and imposes additional data protection obligations on covered businesses, including additional limitations on data uses and new audit requirements for higher risk data. The CPRA also established a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. Other states, such as Virginia, Indiana, Oregon, Texas, Tennessee, Montana, Iowa, Delaware, Connecticut, Utah and Colorado, have also passed comprehensive privacy laws, and similar laws are being considered in several other states, as well as at the federal and local levels. While these state privacy laws, like the CCPA, also exempt some data processed in the context of clinical trials, these laws could have potentially conflicting requirements that further complicate compliance efforts, and increase legal risk and compliance costs for Tvardi and the third parties upon whom it relies. In the event that Tvardi is subject to or affected by HIPAA, the CCPA, the CPRA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect