Company: SION
Filing Date: 2025-08-11
Form Type: 10-Q
Source: 0002036042-25-000047
Chunk: 85

Company: Sionna Therapeutics, Inc.
Filing Date: 2025-08-11
Form: 10-Q
Item: Part I, Item 3
Chunk 85
---
 loss of revenue or profits, and other adverse business consequences.

In the ordinary course of business, we and the third parties on which we rely process personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, data we collect about clinical trial participants and sensitive third-party data. Our data processing activities may subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security.

The legislative and regulatory framework for the processing of personal data worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future. In the U.S., there are numerous federal and state privacy and data security laws and regulations governing the collection, use, disclosure, transfer, security and processing of personal information, including federal and state health information privacy laws, federal and state security breach notification laws, federal and state consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). In addition, we may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to HIPAA, which imposes specific requirements relating to the privacy, security, and transmission of individually identifiable health information. Depending on the facts and circumstances, we could be subject to criminal penalties if we knowingly obtain, use or disclose individually identifiable health information maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA.

At the state level, numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording individuals certain rights concerning their personal data. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. While these states exempt some data processed in the context of clinical trials, these developments may further complicate compliance efforts, and increase legal risk and compliance costs for us and the third parties upon whom we rely. Furthermore, other states have proposed or enacted legislation that is focused on more narrow aspects of privacy. For example, a number of states have passed laws that protect biometric information and a smaller number of states have passed or are considering laws that are specifically focused upon health privacy, such as Washington’s My Health My Data Act. The My Health My Data Act imposes new state restrictions and requirements on the processing and sale