Company: KROS
Filing Date: 2025-08-06
Form Type: 10-Q
Source: 0001664710-25-000070
Chunk: 195

Company: Keros Therapeutics, Inc.
Filing Date: 2025-08-06
Form: 10-Q
Item: Item 1A
Chunk 195
---
 whom we work. 

Other laws and regulations also apply to our business model. We are subject to new laws governing the privacy of consumer health data. For example, Washington’s My Health My Data Act, or MHMD, broadly defines consumer health data, places restrictions on processing consumer health data (including imposing stringent requirements for consents), provides consumers certain rights with respect to their health data, and creates a private right of action to allow individuals to sue for violations of the law. Other states are considering and may adopt similar laws. Additionally, under various privacy laws and other obligations, we may be required to obtain certain consents to process personal data. For example, some of our data processing practices may be challenged under wiretapping laws, if we obtain consumer information from third parties through various methods, including chatbot and session replay providers, or via third-party marketing pixels. These practices may be subject to increased challenges by class action plaintiffs. Our inability or failure to obtain consent for these practices could result in adverse consequences, including class action litigation and mass arbitration demands.

Outside the United States, an increasing number of laws, regulations, and industry standards govern data privacy and security. For example, the EU's General Data Protection Regulation, or EU GDPR, the United Kingdom’s GDPR, or UK GDPR (collectively referred to as the GDPR), Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais) (Law No. 13,709/2018), Turkey’s Personal Data Protection Law, South Korea’s Personal Information Protection Act, Taiwan’s Personal Data Protection Act, Peru’s Personal Data Protection Law, South Africa’s Protection of Personal Information Act, and China’s Personal Information Protection Law impose strict requirements for processing personal data. For example, under the GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to €20 million under the EU GDPR, 17.5 million pounds sterling under the UK GDPR, or in each case, 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests.

In the ordinary course of business, we transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area, or the EEA, and the UK have significantly restricted the transfer