Company: BDRX
Filing Date: 2025-01-28
Form Type: 424B3
Source: 0001214659-25-001409
Chunk: 71

Company: Biodexa Pharmaceuticals Plc
Filing Date: 2025-01-28
Form: 424B3
Chunk 71
---
 take effect beyond 2024, and additional U.S. states have proposals under consideration, all of which are likely to increase our regulatory compliance costs and risks, exposure to regulatory enforcement action and other liabilities. While these state privacy laws, like the CCPA, also exempt some data processed in the context of clinical trials (and most also exempt employee and business personal data), these developments further complicate compliance efforts, and increase legal risk and compliance costs for us and the third parties upon whom we rely. The scope and enforcement of these laws is uncertain and subject to rapid change. For example, increasing concerns about health information privacy have recently prompted the federal government to take a newly expansive view of the scope of existing privacy laws and regulations. Congress and some states are considering (and in some cases have passed) new laws and regulations that further and more broadly protect the privacy and security of personal health information.

The interplay of federal and state laws may be subject to varying interpretations by courts and government agencies, creating complex compliance issues for us and our clients and potentially exposing us to additional expense, adverse publicity and liability. Further, as regulatory focus on privacy issues continues to increase and laws and regulations concerning the protection of personal information expand and become more complex, these potential risks to our business could intensify.

In the European Union, the General Data Protection Regulation (EU) 2016/679, or GDPR, lays down the legal framework for data protection and privacy. The GDPR applies directly in all European Union member states (until December 31, 2020, this included the United Kingdom) and applies to companies with an establishment in the European Economic Area, or EEA, and to certain other companies not in the EEA that process personal data in relation to offering or providing goods or services to individuals located in the EEA, or monitor the behavior of individuals located in the EEA. In the United Kingdom, the GDPR has been implemented into United Kingdom domestic law, pursuant to the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (as amended), which makes some minor technical amendments to ensure the GDPR is operable in the United Kingdom, or the UK GDPR. The UK GDPR is also supplemented by the Data Protection Act 2018. United Kingdom and European Union data protection law is therefore aligned. The GDPR and UK GDPR implement stringent operational requirements for both controllers and processors of personal data, including, for example, expanded disclosures about how personal information is to be used, limitations on retention of information, increased