Company: VERA
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000950170-25-029969
Chunk: 56

Company: Vera Therapeutics, Inc.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 56
---
 privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (CPRA), (collectively, the CCPA), applies to personal data of consumers, business representatives, and employees who are California residents, and requires covered businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA also provides for fines and allows private litigants affected by certain data breaches to recover significant statutory damages. Although there are limited exemptions for clinical trial data under the CCPA, the CCPA increases compliance costs and potential liability with respect to other personal data we maintain about California residents. Similar laws have been enacted or are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. While certain of these laws exempt or may exempt data processed in the context of clinical trials, these developments may further complicate compliance efforts and increase legal risk and compliance costs for us and the third parties with whom we work.

In addition to data privacy and security laws, we are contractually subject to industry standards adopted by industry groups and may become subject to such obligations in the future. We are also bound by other contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful.

We also publish privacy policies, marketing materials, and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and security. Regulators are increasingly scrutinizing these statements, and if these policies, materials, or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators, or other adverse consequences. 

Obligations related to data privacy and security (and consumers’ data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing