Company: TYRA
Filing Date: 2025-03-27
Form Type: 10-K
Source: 0000950170-25-046124
Chunk: 114

Company: Tyra Biosciences, Inc.
Filing Date: 2025-03-27
Form: 10-K
Item: Item 1A
Chunk 114
---
 operations, and financial condition.

We, our future collaborators and our service providers may be subject to a variety of privacy and data security laws and contractual obligations, which could increase compliance costs and our failure to comply with them could subject us to potentially significant fines or penalties and otherwise harm our business. We are subject to laws and regulations governing the privacy and security of sensitive information, including confidential business and health-related information. The global data protection landscape is rapidly evolving, and we may be affected by or subject to new, amended or existing laws and regulations in the future, including as our operations continue to expand or if we operate in foreign jurisdictions. These laws and regulations may be subject to differing interpretations, which adds to the complexity of processing personal information. Guidance on implementation and compliance practices are often updated or otherwise revised.

In the United States, there are numerous federal and state privacy and data security laws and regulations governing the collection, use, disclosure and protection of personal information, including health information privacy laws, security breach notification laws and consumer protection laws. Each of these laws is subject to varying interpretations and constantly evolving. By way of example, HIPAA imposes privacy and security requirements and breach reporting obligations with respect to individually identifiable health information upon “covered entities” (health plans, health care clearinghouses and certain health care providers), and their respective business associates, individuals or entities that create, received, maintain or transmit protected health information in connection with providing a service for or on behalf of a covered entity, as well as their covered subcontractors. While we do not believe that we are currently acting as a covered entity or business associate under HIPAA and thus are not directly regulated under HIPAA, any person may be prosecuted under HIPAA’s criminal provisions either directly or under aiding-and-abetting or conspiracy principles. Consequently, depending on the facts and circumstances, we could be subject to significant penalties if we knowingly receive individually identifiable health information from a HIPAA-covered healthcare provider or research institution that has not satisfied HIPAA’s requirements for disclosure of individually identifiable health information.

In addition, certain state laws and regulations govern the privacy, processing and security of health-related and other personal information in certain circumstances, some of which are more stringent than HIPAA and many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. By way of example, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the CCPA) requires covered businesses that process the personal information of California residents to, among other things