Company: PMVP
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000950170-25-030414
Chunk: 99

Company: PMV Pharmaceuticals, Inc.
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1A
Chunk 99
---
 abuse or other healthcare laws and regulations. If our operations are found to be in violation of any of the laws described above or any other governmental laws and regulations that may apply to us, we may be subject to significant penalties, including civil, criminal and administrative penalties, damages, fines, exclusion from government-funded healthcare programs, such as Medicare and Medicaid or similar programs in other countries or jurisdictions, integrity oversight and reporting obligations to resolve allegations of non-compliance, disgorgement, individual imprisonment, contractual damages, reputational harm, diminished profits and the curtailment or restructuring of our operations. If any of the physicians or other providers or entities with whom we expect to do business are found to not be in compliance with applicable laws, they may be subject to criminal, civil or administrative sanctions, including exclusions from government funded healthcare programs and imprisonment, which could affect our ability to operate our business. Further, defending against any such actions can be costly, time-consuming and may require significant personnel resources. Therefore, even if we are successful in defending against any such actions that may be brought against us, our business may be impaired. 

Data collection is governed by restrictive regulations governing the use, processing and cross-border transfer of personal information. 

In connection with our clinical trials or enrollment of patients in any future clinical trials, we will be subject to additional privacy restrictions. The collection, use, storage, disclosure, transfer, or other processing of personal data regarding individuals in the EU, including personal health data, is subject to the EU General Data Protection Regulation, or GDPR, which became effective on May 25, 2018. The GDPR is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including requirements relating to processing health and other sensitive data, obtaining consent of the individuals to whom the personal data relates, providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of personal data, providing notification of data breaches and taking certain measures when engaging third-party processors. The GDPR also imposes strict rules on the transfer of personal data to countries outside the EU, including the United States, and permits data protection authorities to impose large penalties for violations of the GDPR, including potential fines of up to €20 million or 4% of annual global revenues, whichever is greater. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies and obtain compensation for damages resulting from violations of the GDPR. In addition, the GDPR includes restrictions on cross-border data