Company: PFSA
Filing Date: 2025-10-29
Form Type: 424B3
Source: 0001213900-25-103174
Chunk: 74

Company: Profusa, Inc.
Filing Date: 2025-10-29
Form: 424B3
Chunk 74
---
2 and beyond, as the increased cyber attacks during the COVID-19
pandemic have once again put a spotlight on data privacy and security in the U.S. and other jurisdictions. We cannot predict where
new legislation might arise, the scope of such legislation, or the potential impact to our business and operations.

Cybersecurity risks and cyber incidents could result in the compromise of confidential data or critical data systems and give rise to potential harm to customers, remediation and other expenses, expose us to liability under HIPAA, consumer protection laws, or other common law theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business and operations.

Cyber incidents can result
from deliberate attacks or unintentional events. We collect and store on our networks sensitive information, including intellectual property,
proprietary business information and personally identifiable information of individuals, such as our customers and employees. The secure
maintenance of this information and technology is critical to our business operations. We have implemented multiple layers of security
measures to protect the confidentiality, integrity and availability of this data and the systems and devices that store and transmit such
data. We utilize current security technologies, and our defenses are monitored and routinely tested internally and by external parties.
Additionally, we use third party products such as Amazon Cognito that provide advanced user authentication services that aim to prevent
bad actors from accessing our systems. Despite these efforts, threats from malicious persons and groups, new vulnerabilities and advanced
new attacks against information systems create risk of cybersecurity incidents. These incidents can include, but are not limited to, gaining
unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data, or causing operational
disruption. Because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently
and may not immediately produce signs of intrusion, we may be unable to anticipate these incidents or techniques, timely discover them,
or implement adequate preventative measures. When we leverage third-party tools to manage security features, we add an additional potential
attack surface that is capable of being exploited.

In response to the COVID-19
pandemic, we have modified our business practices and implemented telework policies wherever possible for appropriate categories of “nonessential”
employees to minimize the disruption to our operations, to the extent possible. The continuation of these telework policies means additional
operational risk, including increased cybersecurity risk. These cyber risks include, among other risks, greater phishing, malware, and