Company: TALK
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0000950170-25-038107
Chunk: 52

Company: Talkspace, Inc.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1A
Chunk 52
---
. The CPRA also creates a new state agency that will be vested with authority to implement and enforce the CCPA and the CPRA. We expect states to continue to enact legislation similar to the CCPA and CPRA that provides consumers with new privacy rights and increases the privacy and security obligations of entities handling certain personal information of such consumers. Laws similar to the CCPA and CPRA have passed in Virginia and Colorado, and have been proposed in other states and at the federal level, reflecting a trend toward more stringent privacy legislation in the United States.

Moreover, we are subject to certain other state laws such as the California Confidentiality of Medical Information Act, which imposes restrictive requirements regulating the use and disclosure of health information and other personal information. Such laws and regulations are not necessarily preempted by HIPAA, particularly if a state affords greater protection to individuals than HIPAA. Where state laws are more protective, we have to comply with the stricter provisions. Further, in addition to fines and penalties imposed upon violators, some of these state laws, such as the CCPA, also afford private rights of action to individuals who believe their personal information has been misused. 

In the aggregate, state-based data privacy and security laws and regulations may impact our business. All of these evolving compliance and operational requirements impose significant costs that are likely to increase over time, may require us to modify our data processing practices and policies, divert resources from other initiatives and projects could restrict the way services involving data are offered and could subject us to additional liabilities, all of which may adversely affect our results of operations, business, and financial condition.

Furthermore, there are numerous foreign laws, regulations and directives regarding privacy and the collection, storage, transmission, use, processing, disclosure and protection of personal information, the scope of which is continually evolving and subject to differing interpretations. If we provide services to users outside the United States, we may be subject to such laws, regulations, directives and obligations in relation to processing of personal information, and we may be subject to significant consequences, including penalties, fines and contractual liability, for our failure to comply. We are subject to the EU GDPR and the UK data privacy regime consisting primarily of the UK General Data Protection Regulation and the UK Data Protection Act 2018 (the “UK GDPR”) (the EU GDPR and the UK GDPR, collectively the “GDPR”), which impose a strict data protection compliance regime including stringent data protection requirements. EU Member States and the UK are also able to legislate separately on sensitive data (i.e., mental