Company: HCWB
Filing Date: 2025-03-28
Form Type: 10-K
Source: 0000950170-25-046724
Chunk: 53

Company: HCW Biologics Inc.
Filing Date: 2025-03-28
Form: 10-K
Item: Item 1
Chunk 53
---
 and mental health diagnosis and genetic and biometric information that can identify a consumer. Colorado enacted the Colorado Privacy Act, and Connecticut enacted the Connecticut Data Privacy Act, each of which took effect on July 1, 2023, and Utah enacted the Consumer Privacy Act, which became effective on December 31, 2023, and each of these laws may increase the complexity, variation in requirements, restrictions, and potential legal risks, and could require increased compliance costs and changes in business practices and policies. Other states have also enacted, proposed, or are considering proposing, data privacy laws, which could further complicate compliance efforts, increase our potential liability and adversely affect our business. In Europe, the GDPR went into effect in May 2018 and introduces strict requirements for processing the personal data of individuals within the European Economic Area (“EEA”). Further, recent legal developments in Europe have created complexity and compliance uncertainty regarding certain transfers of personal data from the EEA. For example, on July 16, 2020, the Court of Justice of the European Union invalidated the EU-U.S. Privacy Shield Framework (the “Privacy Shield”) under which personal data could be transferred from the EEA to United States entities who had self-certified under the Privacy Shield scheme. Moreover, it is uncertain whether the standard contractual clauses will also be invalidated by the European courts or legislature.

Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance of up to €20 million or 4% of the annual global revenues of the noncompliant company, whichever is greater. Additionally, following the United Kingdom’s withdrawal from the European Union and the EEA, companies have to comply with the GDPR and the GDPR as incorporated into United Kingdom national law, the latter regime having the ability to separately fine up to the greater of £17.5 million or 4% of global turnover. The relationship between the United Kingdom and the European Union in relation to certain aspects of data protection law remains unclear, for example around how data can lawfully be transferred between each jurisdiction.

Coverage and Reimbursement

Significant uncertainty exists as to the coverage and reimbursement status of any pharmaceutical or biological product for which we obtain regulatory approval. Sales of any product, if approved, depend in part on the extent to which such product will be covered by third-party payors, such as federal, state, and foreign government healthcare programs, commercial insurance, and managed healthcare organizations, and the level of reimbursement,