Company: TVRD
Filing Date: 2025-10-20
Form Type: S-1/A
Source: 0001104659-25-100896
Chunk: 112

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-10-20
Form: S-1/A
Chunk 112
---
 information and increase its compliance costs. Additionally, the California

<div align='center'>66</div>

TABLE OF CONTENTS

Privacy Rights Act of 2020 (“CPRA”) went into effect on January 1, 2023, and significantly expands the CCPA, such as by granting additional rights to California residents, including the right to correct personal information and affording opt-out rights for certain uses of sensitive information, and imposes additional data protection obligations on covered businesses, including additional limitations on data uses and new audit requirements for higher risk sensitive information. The CPRA also established the California Privacy Protection Agency which is authorized to issue substantive regulations and could result in increased privacy and information security enforcement. Other states have also passed comprehensive privacy laws, and similar laws are being considered in several other states, as well as at the federal and local levels. While these state privacy laws, like the CCPA, may or do exempt some data processed in the context of clinical trials, these laws could have potentially conflicting requirements that further complicate compliance efforts, and increase legal risk and compliance costs for the Company and the third parties upon whom it relies.

In the event that the Company is subject to or affected by HIPAA, the CCPA, the CPRA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect its financial condition. In addition to government activity, privacy advocacy groups and technology and other industries are considering various new, additional or different self-regulatory standards that may place additional burdens on the Company. In addition to data privacy and security laws, the Company is also bound by other contractual obligations related to data privacy and security, and its efforts to comply with such obligations may not be successful. Each of these laws, rules, regulations and contractual obligations relating to data privacy and security, and any other such changes or new laws, rules, regulations or contractual obligations could impose significant limitations on the Company’s business, require changes to the Company’s business, or restrict its collection, use, storage or processing of personal information, which may increase its compliance expenses and make its business more costly or less efficient to conduct. In addition, any such changes could compromise the Company’s ability to develop an adequate marketing strategy and pursue its growth strategy effectively or even prevent the Company from providing certain products in jurisdictions in which it currently operates and in which the Company may operate in the future or incur potential liability in an effort to comply with such legislation, which, in turn, could adversely affect its business, financial condition, results