Company: BIAF
Filing Date: 2025-04-22
Form Type: 424B3
Source: 0001641172-25-005598
Chunk: 140

Company: bioAffinity Technologies, Inc.
Filing Date: 2025-04-22
Form: 424B3
Chunk 140
---
. In addition, it is likely that our CyPath ®Lung test is classified in a risk class that requires a review by an external party, a Notified Body, prior to placing the test on the EU market. This process is expected to require an additional six to 12 months after required documents and systems are in place. There currently is a general shortage in the EU of available Notified Bodies designated for IVDR devices. Further, we will need to contract a European Authorized Representative (“EAR”) that acts as the Company’s legal representative in the EU. Medical devices also must be registered with the competent authority in the country in which they are based. In addition to the CE mark and the registration done by the EAR, there is a need for an administrative national notification with certain member states of the EU.

European Data Collection

The collection and use of personal data (including health data) in the European Economic Area (“EEA”) are governed by the EU General Data Protection Regulations (“EU GDPR”) and national implementing legislation in EEA member states. The EU GDPR applies to any company established in the EEA and to companies established outside the EEA that process personal data in connection with the offering of goods or services to data subjects in the EEA or the monitoring of the behavior of data subjects in the EEA. The EU GDPR establishes stringent requirements applicable to the processing of personal data, including strict requirements relating to the validity of consent of data subjects, expanded disclosures about how personal data is used, requirements to conduct data protection impact assessments for “high risk” processing, limitations on retention of personal data, special provisions for “special categories of personal data” including health and genetic information of data subjects, mandatory data breach notification (in certain circumstances), “privacy by design” requirements, and direct obligations on service providers acting as processors. The EU GDPR also prohibits the international transfer of personal data from the EEA to countries outside of the EEA unless made to a country deemed to have adequate data privacy laws by the European Commission or a data transfer mechanism has been put in place. Failure to comply with the requirements of the EU GDPR and the related national data protection laws of the EEA states may result in fines up to 20 million euros or 4% of a company’s global annual revenues for the preceding financial year, whichever is higher. Moreover, the EU GDPR affords various data protection rights to individuals (i.e., the right to erasure of personal data) in certain circumstances, and the ability for data subjects to claim material and non-material damages