Company: SMNR
Filing Date: 2025-07-23
Form Type: S-4/A
Source: 0001193125-25-163401
Chunk: 543

Company: Semnur Pharmaceuticals, Inc.
Filing Date: 2025-07-23
Form: S-4/A
Chunk 543
---
 personal information from minors, and creating a statutory damages framework for violations of the CCPA, including for failure to implement reasonable security procedures and practices to prevent data breaches. Penalties for violations of the CCPA include civil penalties and may result in related legal claims. The CPRA, most provisions of which became operative on January 1, 2023, introduced significant amendments to the CCPA and established and funded a dedicated California privacy regulator, the California Privacy Protection Agency. Several other states have implemented similar consumer privacy laws that took effect in the past year or will take effect in the near future. Further, Washington’s My Health My Data Act, taking effect July 1, 2024, imposes requirements specific to consumer health data. The foregoing U.S. state privacy laws impose many similar obligations as the CCPA on our processing of personal information. Other U.S. states are considering similar privacy legislation, and industry organizations regularly adopt and advocate for new standards in these areas. The uncertainty, ambiguity, complexity, and potential inconsistency surrounding the implementation and interpretation of the CCPA and other enacted or forthcoming U.S. state privacy laws exemplify the vulnerability of our business to the evolving

<div align='center'>325</div>

regulatory environment related to the privacy, security and confidentiality of personal information and protected health information. We may be subject to fines, penalties, or private actions in the event of non-compliance with such laws.

Our activities outside of the U.S. implicate local, state, provincial, and national data protection standards, impose additional compliance requirements and generate additional risks of enforcement for non-compliance. Such laws may also restrict the access, use and disclosure of patient health information abroad. We may be required to expend significant capital and other resources to ensure ongoing compliance with applicable privacy and data security laws, to protect against security breaches and hackers, or to remediate issues caused by such breaches. Compliance with these laws is challenging, constantly evolving, time consuming, and requires a flexible privacy framework and substantial resources. Compliance efforts will likely be an increasing and substantial cost in the future.

The U.S. federal Physician Payments Sunshine Act requires certain manufacturers of drug products, devices, biologics and medical supplies for which payment is available under Medicare, Medicaid or the Children’s Health Insurance Program, with specific exceptions, to annually report to CMS information related to payments or other transfers of value made to physicians and teaching hospitals, as well as ownership and investment interests held by physicians and their immediate family members. In addition to this federal requirement, a number of individual