Company: QTIWW
Filing Date: 2025-12-29
Form Type: S-1/A
Source: 0001628280-25-058960
Chunk: 77

Company: QT IMAGING HOLDINGS, INC.
Filing Date: 2025-12-29
Form: S-1/A
Chunk 77
---
 HIPAA.

Internationally, many jurisdictions have or are considering enacting privacy or data protection laws or regulations relating to the collection, use, storage, transfer, disclosure and/or other processing of personal data, as well as certification requirements for the hosting of health data specifically. Such laws and regulations may include data hosting, data residency or data localization requirements (which generally require that certain types of data collected within a certain country be stored and processed within that country), data export restrictions, international transfer laws (which prohibit or impose conditions upon the transfer of such data from one country to another), or may require companies to implement privacy or data protection and security policies, enable users to access, correct and delete personal data stored or maintained by such companies, inform individuals of security breaches that affect their personal data or obtain individuals’ consent to use their personal data. For example, European legislators adopted the GDPR, which became effective on May 25, 2018, and are now in the process of finalizing the ePrivacy Regulation to replace the European ePrivacy Directive (Directive 2002/58/EC as amended by Directive 2009/136/EC). The GDPR, supplemented by national laws and further implemented through binding guidance from the European Data Protection Board, imposes more stringent European Union data protection requirements and provides for significant penalties for noncompliance. Further, the United Kingdom’s initiating a process to leave the European Union has created uncertainty with regard to the regulation of data protection in the United Kingdom. In particular, the United Kingdom has brought the GDPR into domestic law with the Data Protection Act of 2018 which will remain in force, even if and when the United Kingdom leaves the European Union.

Virtually every jurisdiction in which we expect to operate has established its own data security and privacy legal framework with which we must, and our target customers will need to, comply, including the rules and regulation mentioned above. We may also need to comply with varying and possibly conflicting privacy laws and regulations in other jurisdictions. As a result, we could face regulatory actions, including significant fines or penalties, adverse publicity and possible loss of business.

In addition, there are ongoing public policy discussions regarding whether the standards for de-identified, anonymous or pseudonymized health information are sufficient to adequately protect patient privacy. These discussions may lead to further restrictions on the use or disclosure of such information. We use a third party service provider to de-identify PHI that parties with which we work receive and may make available to us. There can be no assurance that the policy initiatives or future initiatives