Company: KROS
Filing Date: 2025-11-05
Form Type: 10-Q
Source: 0001664710-25-000089
Chunk: 402

Company: Keros Therapeutics, Inc.
Filing Date: 2025-11-05
Form: 10-Q
Item: Item 8
Chunk 402
---
 personal data. As applicable, such rights include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, or the CPRA, collectively referred to as the CCPA, applies to personal data of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for fines and allows private litigants affected by certain data breaches to recover significant statutory damages.

Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. These developments further complicate compliance efforts, and increase legal risk and compliance costs for us and the third parties with whom we work. 

Other laws and regulations also apply to our business model. We are subject to new laws governing the privacy of consumer health data. For example, Washington’s My Health My Data Act, or MHMD, broadly defines consumer health data, places restrictions on processing consumer health data (including imposing stringent requirements for consents), provides consumers certain rights with respect to their health data, and creates a private right of action to allow individuals to sue for violations of the law. Other states are considering and may adopt similar laws. Additionally, under various privacy laws and other obligations, we may be required to obtain certain consents to process personal data. For example, some of our data processing practices may be challenged under wiretapping laws, if we obtain consumer information from third parties through various methods, including chatbot and session replay providers, or via third-party marketing pixels. These practices may be subject to increased challenges by class action plaintiffs. Our inability or failure to obtain consent for these practices could result in adverse consequences, including class action litigation and mass arbitration demands.

77

Outside the United States, an increasing number of laws, regulations, and industry standards govern data privacy and security. For example, the EU's General Data Protection Regulation, or EU GDPR, the United Kingdom’s GDPR,