Company: CMND
Filing Date: 2025-01-22
Form Type: 20-F
Source: 0001213900-25-005490
Chunk: 164

Company: Clearmind Medicine Inc.
Filing Date: 2025-01-22
Form: 20-F
Item: Item 4
Chunk 164
---
 of HIPAA as the result of a breach of unsecured protected health information, a complaint about privacy practices or an audit
by the HHS, may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight
obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance.
Further, entities that knowingly receive individually identifiable health information from a HIPAA covered entity in a manner that is
not authorized or permitted by HIPAA may be subject to criminal penalties.

Even when HIPAA does not apply, according to the
Federal Trade Commission, or FTC, violating consumers’ privacy rights or failing to take appropriate steps to keep consumers’
personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5 of the FTC Act.
The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer
information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities.

In addition, certain federal, state and foreign
laws, such as the GDPR, govern the privacy and security of personal data, including health-related data in certain circumstances, some
of which are more stringent than HIPAA and many of which differ from each other in significant ways and may not have the same effect,
thus complicating compliance efforts. Failure to comply with these laws, where applicable, can result in the imposition of significant
civil and/or criminal penalties and private litigation. For example, California enacted the CCPA, which went into effect on January 1,
2020. The CCPA, among other things, creates new data privacy obligations for covered companies and provides new privacy rights to California
residents, including the right to access and delete their personal information, opt out of certain personal information sharing, and receive
detailed information about how their personal information is used. The CCPA also creates a private right of action with statutory damages
for certain data breaches, thereby potentially increasing risks associated with a data breach. Further, the CPRA was recently voted into
law by California residents. The CPRA significantly amends the CCPA and imposes additional data protection obligations on covered companies
doing business in California, including additional consumer rights processes and opt outs for certain uses of sensitive data. It also
creates a new California data protection agency specifically tasked to implement and enforce the CCPA and the CPRA, which would likely
result in