Company: BLLN
Filing Date: 2025-09-17
Form Type: DRS/A
Source: 0001193125-25-206347
Chunk: 257

Company: BillionToOne, Inc.
Filing Date: 2025-09-17
Form: DRS/A
Chunk 257
---
 on January 1, 2023, which created additional obligations with respect to certain data relating to consumers, significantly expands the CCPA, is an example of the increasingly stringent privacy
laws at the state level in the United States. The CCPA also created a private right of action with statutory damages for certain data breaches, thereby potentially increasing risks associated with a data breach. However, the CCPA and CPRA include an
exemption for HIPAA covered entities such as our laboratory. The California Confidentiality of Medical Information Act, which protects the confidentiality of individually identifiable medical information obtained by health care providers and their
contractors, is much broader than HIPAA and the data protected is also broader than HIPAA.

In addition, numerous other states’ legislatures have passed or are
considering similar laws that will require ongoing compliance efforts and investment. For example, Virginia passed the Virginia Consumer Data Protection Act, and Colorado passed the Colorado Privacy Act, both of which differ from the CPRA and became
effective in 2023 and the Texas Data Privacy and Security Act became effective in 2024. These state privacy laws dictate how we can collect, use, store, sell, share, analyze or process personal identifying information and/or consumer or health data
received or generated by our business operations.

Outside the United States, there are an increasing number of laws and regulations governing the collection, use
and processing of personal data. For example, the European Union’s General Data Protection Regulation (EU GDPR) applies to any company established in the European Economic Area (EEA), and to companies established outside the EEA that process
personal information in connection with the offering of goods or services to data subjects in the EEA or the monitoring of the behavior of data subjects in the EEA. These regulations are often more restrictive than those in the United States and may
restrict transfers of personal data from the EEA to the United States and other countries unless certain requirements are met. The EU GDPR provides that EU member states may make their own further laws and regulations limiting the processing of
genetic, biometric or health data, which could limit our ability to use and share personal data or could cause our costs to increase, and harm our business and financial condition. Further, the United Kingdom’s decision to leave the European
Union has created uncertainty with regard to data protection regulation in the United Kingdom. As of January 1, 2021, we are also subject to the UK General Data Protection Regulation and UK Data Protection Act of 2018, which