Company: VRCA
Filing Date: 2025-03-11
Form Type: 10-K
Source: 0000950170-25-037172
Chunk: 126

Company: Verrica Pharmaceuticals Inc.
Filing Date: 2025-03-11
Form: 10-K
Item: Item 1A
Chunk 126
---
 substantial retention of liability and is subject to limitations and may not cover a significant portion, or any, of the expenses or liabilities we may incur or be subject to in connection with these lawsuits or other litigation to which we are party. The costs we incur in defending ourselves or associated with settling such proceedings, as well as a material final judgment or decree against us, that are not covered by our directors’ and officers’ liability insurance could materially adversely affect our financial condition. In addition, additional lawsuits may be filed, the conclusion of which in a manner adverse to us and for which we incur substantial costs or damages not covered by our directors’ and officers’ liability insurance could have a material adverse effect on our financial condition and business.

We and the third parties with whom we work are subject to stringent and evolving U.S. and foreign laws, regulations, and rules, contractual obligations, industry standards, policies and other obligations related to data privacy and security.  Our actual or perceived failure to comply (or the actual or perceived failure by the third parties with whom we work) with such obligations could lead to regulatory investigations or actions; litigation (including class claims) and mass arbitration demands; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse business consequences. 

In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) personal data and other sensitive 

70

information, including proprietary and confidential business data, trade secrets, intellectual property, data we collect about trial participants in connection with clinical trials, sensitive third-party data, and other sensitive data the Company may process.  Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security. 

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws.  For example, HIPAA, as amended by HITECH, imposes specific requirements relating to the privacy, security, and transmission of individually identifiable protected health information.  

 Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing