Company: CERO
Filing Date: 2025-02-07
Form Type: 424B3
Source: 0001213900-25-011071
Chunk: 82

Company: CERO THERAPEUTICS HOLDINGS, INC.
Filing Date: 2025-02-07
Form: 424B3
Chunk 82
---
 or organization,
other than a member of a covered entity’s workforce, that creates, receives, maintains or transmits protected health information
for or on behalf of a covered entity for a function or activity regulated by HIPAA as well as their covered subcontractors.

In addition, the California
Consumer Privacy Act (“CCPA”) applies to personal information of consumers, business representatives, and employees, and
creates individual privacy rights and places increased privacy and security obligations on entities handling personal data of consumers
or households. The CCPA requires covered companies to provide disclosures to California consumers, affords California residents certain
rights related to their personal data, including the right to opt-out of certain sales of personal data, and allow for a new cause of
action for certain data breaches. Although there are limited exemptions for clinical trial data under the CCPA, as our business progresses,
the CCPA may become applicable and significantly impact our business activities and exemplifies the vulnerability of our business to
evolving regulatory environment related to personal data and protected health information. Furthermore, the California Privacy Rights
Act of 2020, effective January 1, 2023, expands the CCPA’s requirements, including by applying to personal information
of business representatives and employees and establishing a new regulatory agency to implement and enforce the law. In addition, other
states, such as Virginia and Colorado, have also passed comprehensive privacy laws, and similar laws are being considered in several
other states, as well as at the federal and local levels. While these states, like the CCPA, also exempt some data processed in the context
of clinical trials, these developments further complicate compliance efforts, and increase legal risk and compliance costs for us and
the third parties upon whom we rely. Moreover, data privacy and security laws have been proposed at the federal, state, and local levels
in recent years, which could further complicate compliance efforts.

Outside the United States,
there are an increasing number of laws, regulations and industry standards concerning privacy, data protection, information security
and cross-border personal data transfers. For example, GDPR, UK GDPR, and China’s Personal Information Protection Law impose strict
requirements for processing personal data. Failure to comply with the requirements of the GDPR and the applicable national data protection
laws of the European Union Member States may result in fines of up to €20,000,000 or up to 4% of the total worldwide annual turnover
of the preceding financial year, whichever is higher, other administrative penalties, and private litigation related to processing