Company: BLLN
Filing Date: 2025-12-10
Form Type: 10-Q
Source: 0001628280-25-056321
Chunk: 146

Company: BillionToOne, Inc.
Filing Date: 2025-12-10
Form: 10-Q
Item: Part I, Item 4
Chunk 146
---
 products, services, or benefits. We also use AI, including AI/ML in our products and services. The development and use of AI/ML present various privacy and security risks that may impact our business. AI/ML are subject to privacy and data security laws, as well as increasing regulation and scrutiny. While we have implemented robust controls, validations, and human oversight to mitigate the risks of the aforementioned biases and inaccuracies, these measures may not be found sufficient by current or future privacy and data security laws.

Several jurisdictions around the globe, including Europe and certain U.S. states, have proposed enacted, or are considering laws governing the development and use of AI/ML, such as the EU’s AI Act. We expect other 

76

jurisdictions will adopt similar laws. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision making, which may be incompatible with our use of AI/ML. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI/ML, or prevent or limit our use of AI/ML. For example, the FTC has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI/ML where they allege the company has violated privacy and consumer protection laws. If we cannot use AI/ML or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.

In addition, the interpretation and application of consumer, health-related and data protection laws, especially with respect to genetic samples and data, in the United States, European Economic Area (EEA) and elsewhere are often uncertain, contradictory and in flux. The General Data Protection Regulation (GDPR) and other privacy laws and regulations related to the use, transfer, and protection of data impose obligations to the extent we test EU citizens or expand internationally. While we believe that our current processes and practices comply with the GDPR, we may need to expend considerable time and resources, including management attention, to revise our practices to ensure ongoing compliance with GDPR.

Some of the above privacy laws and regulations in many cases may be more restrictive than, and may not be preempted by, HIPAA and its implementing rules. In addition, some countries have stricter consumer notice and/or consent requirements relating to personal data collection, use or sharing, more stringent requirements relating to organizations’ privacy programs and provide