Company: TVRD
Filing Date: 2025-02-14
Form Type: 424B3
Source: 0001104659-25-014310
Chunk: 106

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-02-14
Form: 424B3
Chunk 106
---
, encryption, disclosure of, or access to Cara’s sensitive data or Cara’s information technology systems, or those of the third parties upon whom Cara relies. A security incident or other interruption could disrupt Cara’s ability (and that of third parties upon whom Cara relies) to provide its services.

Cara may expend significant resources or modify its business activities to try to protect against security incidents. Additionally, certain data privacy and security obligations may require Cara to implement and maintain specific security measures or industry-standard or reasonable security measures to protect its information technology systems and sensitive data.

Applicable data privacy and security obligations may require Cara to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences.

If Cara (or a third party upon whom Cara relies) experiences a security incident or is perceived to have experienced a security incident, it may experience material adverse consequences, such as government

<div align='center'>57</div>

TABLE OF CONTENTS

enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive data (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in Cara’s operations (including development and commercialization of any product candidate, should Cara resume development activities in the future, if approved, and availability of data); financial loss; and other similar harms. Security incidents and attendant material consequences may prevent or cause customers to stop using Cara’s services, deter new customers from using Cara’s services, and negatively impact Cara’s ability to grow and operate its business.

Cara’s contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in its contracts are sufficient to protect Cara from liabilities, damages, or claims related to Cara’s data privacy and security obligations. Cara cannot be sure that its insurance coverage will be adequate or sufficient to protect it from or to mitigate liabilities arising out of Cara’s privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.

Risks Related to Cara’s Dependence on Third Parties

Any collaboration arrangements that Cara is a party to or may enter into in the future may not be successful, which, should Cara resume development activities, could adversely affect Cara’s ability