Company: PFSA
Filing Date: 2025-10-29
Form Type: 424B3
Source: 0001213900-25-103174
Chunk: 72

Company: Profusa, Inc.
Filing Date: 2025-10-29
Form: 424B3
Chunk 72
---
 the media. Various U.S. state laws and regulations may also require us to notify affected individuals and state
agencies in the event of a data breach involving individually identifiable information.

Violations of the HIPAA privacy
and security regulations may result in criminal and civil penalties. The OCR enforces the regulations and performs compliance audits.
In addition to enforcement by OCR, state attorneys general are authorized to bring civil actions seeking either injunction or damages
in response to violations that threaten the privacy of state residents. We follow and maintain a HIPAA compliance plan, which we believe
complies with the HIPAA privacy and security regulations, but there can be no assurance that OCR or other regulators will agree. The HIPAA
privacy regulations and security regulations have and will continue to impose significant costs on us in order to comply with these standards.

There are numerous other laws
and legislative and regulatory initiatives at the federal and state levels addressing privacy and security concerns. We also remain subject
to federal or state privacy-related laws that are more restrictive than the regulations issued under HIPAA. These laws vary and could
impose additional penalties. For example, the Federal Trade Commission uses its consumer protection authority to initiate enforcement
actions in response to alleged privacy and data security violations. The California Consumer Privacy Act, or CCPA, which came into effect
January 1, 2020 and was amended and expanded by the California Privacy Rights Act, or CPRA, which came into effect on January 1,
2023. The CCPA, including as amended by CPRA, among other things, create new data privacy obligations for covered companies and provide
new privacy rights to California residents, including the right to opt out of certain disclosures of their information. The CCPA also
creates a private right of action with statutory damages for certain data breaches, thereby potentially increasing risks associated with
a data breach. As of January 1, 2023, the CCPA applies broadly to California employees and personal information of business contacts,
which we anticipate will increase our compliance costs. It remains unclear what, if any, additional modifications will be made to this
legislation or how it will be interpreted and regulations implementing CPRA amendments will not be finalized before CPRA amendments come
into effect. Therefore, the effects of the CCPA and CPRA are significant and will likely require us to modify our data processing practices,
and may cause us to incur substantial costs and expenses to comply, particularly given our base of operations in California. There are
also a number of other legislative proposals worldwide