Company: KROS
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001664710-25-000018
Chunk: 296

Company: Keros Therapeutics, Inc.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 296
---
 business operations; reputational harm; loss of revenue or profits; other liabilities and adverse publicity and could negatively affect our operating results and business. Compliance or the failure to comply with such laws and regulations could increase the costs of our products, could limit their use or adoption, and could otherwise negatively affect our operating results and business.

In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) personal data and other sensitive information, including personal data, proprietary and confidential business data, trade secrets, intellectual property and data we collect about trial participants in connection with clinical trials. Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements and other obligations relating to data privacy and security. 

In the United States, numerous federal and state laws and regulations, including federal and state health information privacy laws, state data breach notification laws, and federal and state consumer protection laws (including Section 5 of the Federal Trade Commission Act) and other similar laws (e.g., wiretapping laws), that govern the collection, use, disclosure and protection of health information and other personal information could apply to our operations or the operations of our collaborators. In addition, we obtain health information from third parties, including research institutions from which we obtain clinical trial data, that are subject to privacy and security requirements under HIPAA, as amended by HITECH, which imposes specific requirements relating to the privacy, security, and transmission of individually identifiable protected health information. Depending on the facts and circumstances, we could be subject to civil, criminal and administrative penalties and fines if we violate HIPAA. 

In addition, certain state and foreign laws govern the privacy and security of health information in certain circumstances, some of which are more stringent than U.S. federal law and many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. 

In the past few years, numerous U.S. states—including California, Virginia, Colorado, Connecticut, and Utah—have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures 

83

in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities