Company: IMRX
Filing Date: 2025-08-13
Form Type: 10-Q
Source: 0001790340-25-000104
Chunk: 153

Company: Immuneering Corp
Filing Date: 2025-08-13
Form: 10-Q
Item: Part I, Item 4
Chunk 153
---
 adverse effect on our business, results of operation, and financial condition.

63

As our operations and business grow, we may become subject to or affected by new or additional data protection laws and regulations and face increased scrutiny or attention from regulatory authorities. For instance, in the U.S., most healthcare providers, including research institutions from which we may obtain patient health information, are subject to privacy and security regulations promulgated under HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, and the regulations promulgated thereunder, or collectively, HIPAA. While we do not believe that we are currently acting as a covered entity or business associate under HIPAA and thus are not directly regulated under HIPAA, any person may be prosecuted under HIPAA’s criminal provisions either directly or under aiding-and-abetting or conspiracy principles. Consequently, depending on the facts and circumstances, we could face substantial criminal penalties if we knowingly receive individually identifiable health information from a HIPAA-covered healthcare provider or research institution that has not satisfied HIPAA’s requirements for disclosure of individually identifiable health information. Certain states have also adopted comparable privacy and security laws and regulations, which govern the privacy, processing and protection of health-related and other personal information. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners.

We are also or may become subject to rapidly evolving data protection laws, rules and regulations in foreign jurisdictions. For example, the European Union General Data Protection Regulation (the "GDPR"), governs certain collection and other processing activities involving personal data about individuals in the European Economic Area (the "EEA"). The GDPR imposes substantial fines for breaches and violations. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies and obtain compensation for damages resulting from violations of the GDPR. Further, since January 1, 2021, companies have to comply with the GDPR and also the UK GDPR, which, together with the amended UK Data Protection Act 2018, retains the GDPR in UK national law. The UK GDPR mirrors the fines under the GDPR. 

The GDPR and UK GDPR regulate cross-border transfers of personal data out of the EEA and the UK respectively. Recent legal developments in Europe have created complexity and uncertainty regarding such transfers, in particular in relation to transfers to the United States. On July 16, 2020, the Court of Justice of the European Union