Company: TVRD
Filing Date: 2025-01-27
Form Type: S-4/A
Source: 0001104659-25-006050
Chunk: 512

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-01-27
Form: S-4/A
Chunk 512
---
 European Union (EU) and other jurisdictions, such as the California Consumer Privacy Act (CCPA). Although the CCPA exempts certain data processed in the context of clinical trials, the CCPA, to the extent applicable to Tvardi’s business and operations, may increase its compliance costs and potential liability with respect to the personal information Tvardi maintains about California residents. The CCPA creates individual privacy rights for California consumers (as defined in the law), places increased privacy and security obligations on entities handling certain personal information of consumers or households, requires covered companies to provide disclosures to consumers regarding data collection, use and sharing practices, requires covered companies to allow users to opt-out of certain sales or transfers of personal information, and provides consumers with a private right of action for certain data breaches. The CCPA became effective on January 1, 2020, and the California Attorney General’s authority to begin bringing enforcement actions began July 1, 2020. The CCPA may impact Tvardi’s business activities and exemplifies the vulnerability of its business to the evolving regulatory environment related to personal information and protected health information. Further, the California Privacy Rights Act (CPRA), went into effect on January 1, 2023, and became enforceable on July 1, 2023. The CPRA significantly amends the CCPA, and imposes additional data protection obligations on covered companies doing business in California, including additional consumer rights processes and opt-outs for certain uses of sensitive data. It also creates a new California data protection agency specifically tasked to enforce the law, which would likely result in increased regulatory scrutiny of California businesses in the areas of data protection and security. Similar laws have been passed in other states, and are continuing to be proposed at the state and federal level, reflecting a trend toward more stringent privacy legislation in the United States.

<div align='center'>280</div>

Tvardi also are or may become subject to privacy laws in the jurisdictions in which it is established, sell or market its products or run clinical trials. For example, in the EU, Regulation (EU) 2016/679 (the GDPR), governs the collection, control, processing, and other use of personal data (i.e., data relating to an identified or identifiable living individual). The GDPR is directly applicable in each EU and European Economic Area (EEA), Member State; however, it provides that EU and EEA Member States may introduce further conditions, including limitations which could limit Tvardi’s ability to collect, use and share