Company: HURA
Filing Date: 2025-05-06
Form Type: S-4/A
Source: 0001193125-25-113920
Chunk: 947

Company: TuHURA Biosciences, Inc./NV
Filing Date: 2025-05-06
Form: S-4/A
Chunk 947
---
 the Company or any of its Subsidiaries nor, to the knowledge of the Company, any officer, employee, agent or distributor of the Company or any of its Subsidiaries, has been excluded from participation in any federal health care program or convicted of any crime or engaged in any conduct for which such Person could be excluded from participating in any federal health care program under Section 1128 of the Social Security Act of 1935, as amended, or any similar Health Care Law or program.

Section 3.26 Data Privacy and Security.

(a) Except where any non-compliance would not, individually or the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and each of its Subsidiaries comply, and within the past three (3) years have complied, with all applicable (i) Privacy and Security Laws, (ii) written contractual commitments to which they are legally bound to the extent relating to and governing Personal Data protection, privacy, and security, and (iii) Privacy Policies.

(b) The Company and each of its Subsidiaries have taken commercially reasonable steps consistent with their size and resources as well as the nature and purpose of the Processing and the types of Personal Data and, where appliable, Privacy and Security Laws, that are designed to: (i) protect their Business Systems and Personal Data from a Security Incident and (ii) maintain, as applicable, the confidentiality, integrity and availability of such Business Systems and Company Data.

(c) In the past three (3) years, the Company and each of its Subsidiaries has regularly performed a security risk assessment and obtained an independent vulnerability assessment performed by a recognized third-party firm. The Company and each of its Subsidiaries have used reasonable efforts to address and remediate all material vulnerabilities, threats, and deficiencies identified in each such assessment.

(d) In the past three (3) years, to the knowledge of the Company, neither the Company nor any of its Subsidiaries has: (i) experienced any material Security Incident involving any Business System or Company Data

<div align='center'>A-26</div>

in their respective possession, custody, or control or otherwise held or Processed on its behalf, (ii) been required to send a notification or report to any Person pursuant to applicable Privacy and Security Laws as a result of any material Security Incident, or (iii) failed in any material respect to comply with any notification or reporting requirement to any Person in connection with any material Security Incident under applicable