Company: HCTI
Filing Date: 2025-02-18
Form Type: 10-K/A
Source: 0001213900-25-014503
Chunk: 33

Company: Healthcare Triangle, Inc.
Filing Date: 2025-02-18
Form: 10-K/A
Chunk 33
---
AA and the other exceptions may be applied under the CCPA. The CCPA may increase our compliance costs and potential liability. Many similar privacy laws have been proposed at the federal level and in other states. The GDPR became enforceable on May 25, 2018. The GDPR regulates our processing of personal data, and imposes stringent requirements. The GDPR includes sanctions for violations up to the greater of €20 million or 4.0% of worldwide gross annual revenue and applies to services providers such as us. In addition, from the beginning of 2021(when the transitional period following Brexit expires), we will have to comply with the GDPR and also the UK GDPR, with each regime having the ability to fine up to the greater of €20 million (£17 million) or 4% of global turnover. The relationship between the United Kingdom and the European Union in relation to certain aspects of data protection law remains unclear, for example how data transfers between EU member states and the United Kingdom will be treated and the role of the Information Commissioner’s Office following the end of the transitional period. These changes will lead to additional costs and increase our overall risk exposure. Recent legal developments in Europe have created complexity and uncertainty regarding transfers of personal data from the EEA to the United States, e.g., on July 16, 2020, the Court of Justice of the European Union (“CJEU”) invalidated the EU-US Privacy Shield Framework (“Privacy Shield”) under which personal data could be transferred from the EEA to U.S. entities who had self-certified under the Privacy Shield scheme. While the CJEU upheld the adequacy of the standard contractual clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism, and a potential alternative to the Privacy Shield), it made clear that reliance on them alone may not necessarily be sufficient in all circumstances; this has created uncertainty. At the moment we have not implemented any Privacy Shield procedures or certifications. We also currently rely on the standard contractual clauses to transfer personal data outside the EEA, including to the United States. It may subject us to a lawsuit of a European Union citizen, if we inadvertently process their personally-identifiable information. The United States, the European Union, and other jurisdictions where we operate continue to issue new and enhance existing, privacy and data security protection regulations related to the collection, use, disclosure, disposal, and protection of information about individuals, including medical information. Privacy and data security laws are rapidly evolving both in the United States and internationally, and