Company: SMNR
Filing Date: 2025-10-21
Form Type: S-1
Source: 0001193125-25-245178
Chunk: 247

Company: Semnur Pharmaceuticals, Inc.
Filing Date: 2025-10-21
Form: S-1
Chunk 247
---
 subject to, or our marketing activities may be limited by, data privacy and security law and regulation promulgated by both the U.S. federal government and the U.S. states in which we conduct our business. For example, under HIPAA, the U.S. Department of Health and Human Services imposes upon “covered entities” (broadly, healthcare providers, health plans and healthcare clearinghouses) and their respective “business associates” (individuals or entities that create, receive, maintain or transmit protected health information on behalf of a covered entity) the HIPAA Privacy and Security Rules which include privacy

<div align='center'>160</div>

obligations; requirements to implement appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information; and breach response notification obligations. Although we are neither a covered entity nor business associate, and therefore not subject to the HIPAA Privacy and Security Rules, we must monitor developments with these requirements for changing obligations that may apply to us. The FTC also requires companies to take appropriate steps to keep consumers’ personal information secure and to make accurate statements regarding how they secure personal information under their custody or control, such as in a privacy notice. The FTC also expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of personal information it holds, the size and complexity of its business, and the cost of available tools to improve data security and reduce vulnerabilities. Individually identifiable health information, which we process, is considered sensitive data that merits stronger safeguards. Violations of the foregoing FTC requirements may constitute unfair or deceptive acts or practices under Section 5(a) of the FTC Act. While we do not intend to engage in unfair or deceptive acts or practices, the FTC has the power to bring enforcement actions based on the FTC’s interpretation of public privacy statements. Further, events that we cannot fully control, such as data breaches, may also result in civil penalties, FTC enforcement or enforcement by U.S. state attorneys general or other regulators. Various U.S. states have implemented privacy laws and regulations that regulate the use and disclosure of health information and other personal information. For example, the CCPA, established a privacy framework for covered businesses by, among other items, expanding the definition of personal information, establishing new data privacy rights for consumers who are California residents, imposing rules on the collection of personal information from minors, and creating a statutory damages framework for violations of the CCPA, including for failure to implement reasonable security procedures and practices to