Company: HCTI
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001213900-25-026218
Chunk: 28

Company: Healthcare Triangle, Inc.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1
Chunk 28
---
 and applies to services providers such as us. In addition, from
the beginning of 2021(when the transitional period following Brexit expires), we will have to comply with the GDPR and also the UK GDPR,
with each regime having the ability to fine up to the greater of €20 million (£17 million) or 4% of global turnover. The relationship
between the United Kingdom and the European Union in relation to certain aspects of data protection law remains unclear, for example how
data transfers between EU member states and the United Kingdom will be treated and the role of the Information Commissioner’s Office
following the end of the transitional period. These changes will lead to additional costs and increase our overall risk exposure.

Recent legal developments in Europe have created
complexity and uncertainty regarding transfers of personal data from the EEA to the United States, e.g., on July 16, 2020, the
Court of Justice of the European Union (“CJEU”) invalidated the EU-US Privacy Shield Framework (“Privacy Shield”)
under which personal data could be transferred from the EEA to U.S. entities who had self-certified under the Privacy Shield scheme. While
the CJEU upheld the adequacy of the standard contractual clauses (a standard form of contract approved by the European Commission as an
adequate personal data transfer mechanism, and a potential alternative to the Privacy Shield), it made clear that reliance on them alone
may not necessarily be sufficient in all circumstances; this has created uncertainty. At the moment we have not implemented any Privacy
Shield procedures or certifications. We also currently rely on the standard contractual clauses to transfer personal data outside the
EEA, including to the United States. It may subject us to a lawsuit of a European Union citizen, if we inadvertently process their personally-identifiable
information.

The United States, the European Union, and other
jurisdictions where we operate continue to issue new and enhance existing, privacy and data security protection regulations related to
the collection, use, disclosure, disposal, and protection of information about individuals, including medical information. Privacy and
data security laws are rapidly evolving both in the United States and internationally, and the future interpretation of those laws is
somewhat uncertain. E.g., we do not know how E.U. regulators will interpret or enforce many aspects of the GDPR and some regulators
may do so in an inconsistent manner. In the United States, privacy and data security is an area of emphasis for some but not all state
regulators, and new legislation has been