Company: DNLI
Filing Date: 2025-08-11
Form Type: 10-Q
Source: 0001714899-25-000170
Chunk: 259

Company: Denali Therapeutics Inc.
Filing Date: 2025-08-11
Form: 10-Q
Item: Part I, Item 4
Chunk 259
---
 to detect and prevent this activity may not be effective in controlling unknown or unmanaged risks or losses or in protecting us from governmental investigations or other actions or lawsuits stemming from a failure to be in compliance with such laws. Further, because of the breadth of these laws and the narrowness of the statutory exceptions and safe harbors available, it is possible that some of our business activities could, despite our efforts to comply, be subject to challenge under one or more of such laws. If any such actions are instituted against us, and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business, including the imposition of civil, criminal, and administrative penalties, damages, disgorgement, monetary fines, possible exclusion from participation in Medicare, Medicaid, and other federal healthcare programs, contractual damages, reputational harm, diminished profits and future earnings, and curtailment of our operations, any of which could adversely affect our ability to operate our business and our results of operations. In addition, the approval and commercialization of any of our product candidates outside the United States will also likely subject us to foreign equivalents of the healthcare laws mentioned above, among other foreign laws.

Our business is subject to complex and evolving U.S. and foreign laws and regulations, information security policies, and contractual obligations relating to privacy and data protection and security, including the use, processing, and cross-border transfer of personal information. These laws and regulations are subject to change and uncertain interpretation, and could result in claims, changes to our business practices, or monetary penalties, and otherwise may harm our business.

We receive, generate, store, and otherwise process significant and increasing volumes of sensitive information and business-critical information, including employee and personal data (including protected health information), research and development information, commercial information, and business and financial information. We heavily rely on external security and infrastructure vendors to manage our information technology systems and data centers. We face a number of risks relative to protecting this critical information, including the loss of access, inappropriate use or disclosure, inappropriate modification, and the risk of our being unable to adequately monitor, audit, and modify our controls over our critical information. This risk extends to third-party vendors and subcontractors we use to manage this sensitive data.

A wide variety of provincial, state, national, and international laws and regulations apply to the collection, use, retention, protection, disclosure, transfer, and other processing of data relating to individuals. These laws and regulations are evolving and may result in ever-increasing regulatory and public