Company: NIVFW
Filing Date: 2025-10-31
Form Type: 424B3
Source: 0001213900-25-104469
Chunk: 84

Company: NewGenIvf Group Ltd
Filing Date: 2025-10-31
Form: 424B3
Chunk 84
---
2, Offences Code No. 128 of October 28, 2021 of Kyrgyzstan establish privacy and security standards in each country that                  
 limit the collection, use, and/ or disclosure of certain individually identifiable health information, whether directly or indirectly        
 (excluding the information of the deceased person) and require the implementation of administrative, physical and technological safeguards   
 to protect the privacy of protected health information and ensure the confidentiality, integrity and availability of electronic protected    
 health information. The privacy regulations established under the PDPA and Data Protection Law also provide patients with rights             
 related to understanding and controlling how their protected health information is collected, used and/ or disclosed. As a provider          
 of services to entities subject to the PDPA and Data Protection Law, NewGenIvf is directly subject to certain provisions of the regulations. 
 To the extent permitted by applicable privacy regulations and contracts with its clients, NewGenIvf is permitted to use and disclose         
 protected health information to perform its services and for other limited purposes, but other uses and disclosures, such as marketing       
 communications, require written authorization from the patient or must meet an exception specified under the privacy regulations.            |

<div align='center'>46</div>

NewGenIvf also has downstream entities
which provide it with services and are also subject to applicable regulations. If NewGenIvf or any of its downstream entities are unable
to properly protect the privacy and security of protected health information entrusted to it, it could be found to have breached its
contracts with its clients and be subject to investigation by the relevant supervision institution, i.e., the Office of the Personal
Data Protection Committee of Thailand (the Government Authority under the PDPA), the Cambodia MOH and the State Data Protection Agency
under the Cabinet of Ministers of Kyrgyzstan (the “Agency”). In the event the Office of the Personal Data Protection Committee
or the Agency finds that NewGenIvf has failed to comply with applicable privacy and security standards, it could face civil, criminal,
and/ or administrative penalties. In addition, the Office of the Personal Data Protection Committee performs compliance audits in order
to proactively enforce the privacy and security standards. The Office of the Personal Data Protection Committee has become an increasingly
active regulator and has signaled its intention to continue this trend. The Office of the Personal Data Protection Committee has the
discretion to impose penalties and may require companies to enter into resolution agreements and corrective action plans which impose
ongoing compliance requirements. The Office of the Personal Data Protection Committee’s enforcement