Company: LBRX
Filing Date: 2025-07-23
Form Type: DRS/A
Source: 0000950123-25-006557
Chunk: 108

Company: LB PHARMACEUTICALS INC
Filing Date: 2025-07-23
Form: DRS/A
Chunk 108
---
 Commission Act), and other similar laws (e.g., wiretapping laws). For example, HIPAA,
as amended by HITECH, imposes specific requirements relating to the privacy, security, and transmission of individually identifiable protected health information. In addition, other federal and state laws establish and may in the future establish
requirements for protecting the privacy and security of health information that is not protected by HIPAA.

Additionally, numerous U.S.
states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. These state
laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, or CCPA, applies to personal data of California residents and requires businesses subject to the CCPA to provide specific disclosures in
privacy notices and respond to requests of such individuals to exercise certain privacy rights. Although there are minimum revenue or personal data processing thresholds for entities to be subject to many of these laws and there are limited
exemptions for clinical trial data under the CCPA and similar U.S. state comprehensive privacy laws, such laws may impact (possibly significantly) our business activities depending on how they are interpreted, should we become subject to the CCPA or
other such state comprehensive privacy laws in the future. In addition, similar laws are being considered in other states, as well as at the international, federal and local levels, and we expect more laws related to personal data to become
effective in the future. These developments may further complicate compliance efforts and increase our legal risk and compliance costs.

Outside the United States, an increasing number of laws, regulations, and industry standards govern data privacy and security. For example,
the European Union’s General Data Protection Regulation, or EU GDPR, the United Kingdom’s GDPR, or UK GDPR, Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or LGPD) (Law
No. 13,709/2018), and China’s Personal Information Protection Law, or PIPL, impose strict requirements for processing personal data.

For example, under GDPR, companies may face private litigation related to processing of personal data brought by classes of data subjects or
consumer protection organizations authorized at law to represent their interests, temporary or definitive prohibitions on data processing and other corrective actions, or fines of up to the greater of 20 million Euros under the EU GDPR /
17.5 million pounds under the UK GDPR, or