Company: SION
Filing Date: 2025-08-11
Form Type: 10-Q
Source: 0002036042-25-000047
Chunk: 554

Company: Sionna Therapeutics, Inc.
Filing Date: 2025-08-11
Form: 10-Q
Item: Part I, Item 2
Chunk 554
---
 to the privacy, security, and transmission of individually identifiable health information. Depending on the facts and circumstances, we could be subject to criminal penalties if we knowingly obtain, use or disclose individually identifiable health information maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA.

At the state level, numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording individuals certain rights concerning their personal data. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. While these states exempt some data processed in the context of clinical trials, these developments may further complicate compliance efforts, and increase legal risk and compliance costs for us and the third parties upon whom we rely. Furthermore, other states have proposed or enacted legislation that is focused on more narrow aspects of privacy. For example, a number of states have passed laws that protect biometric information and a smaller number of states have passed or are considering laws that are specifically focused upon health privacy, such as Washington’s My Health My Data Act. The My Health My Data Act imposes new state restrictions and requirements on the processing and sale of consumer health data and creates a private right of action. The effects of state and federal privacy laws are potentially significant and may require us to modify our data processing practices and policies and to incur substantial costs and potential liability in an effort to comply with such legislation.

Outside the U.S., an increasing number of laws, regulations, and industry standards may govern data privacy and security. For example, if we commence clinical trials in Europe, our processing of personal data in that context would become subject to the European Union’s General Data Protection Regulation (“EU GDPR”), and/or the United Kingdom’s so-called “UK GDPR” (together, the “GDPR”). The GDPR is wide-ranging in scope and imposes numerous requirements on companies that are subject to it, including relating to having a legal basis for processing personal data, relating to the processing of sensitive data (such as health data), obtaining consent of the individuals to whom the personal data relates, providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of personal data, notification of data breaches, requiring data protection impact assessments for high risk processing and taking certain measures when engaging third-party processors. The GDPR also imposes strict rules on the transfer of personal data to countries outside the European Union and the UK, including the