Company: TVRD
Filing Date: 2025-02-14
Form Type: S-4/A
Source: 0001104659-25-013053
Chunk: 525

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-02-14
Form: S-4/A
Chunk 525
---
 be subject to civil and criminal penalties. Even when HIPAA does not apply, according to the FTC, violating consumers’ privacy rights or failing to take appropriate steps to keep consumers’ personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5 of the FTC Act. The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Individually identifiable health information is considered sensitive data that merits stronger safeguards.

Tvardi expects that there will continue to be new proposed laws, regulations and industry standards relating to privacy and data protection in the United States, the European Union (EU) and other jurisdictions, such as the California Consumer Privacy Act (CCPA). Although the CCPA exempts certain data processed in the context of clinical trials, the CCPA, to the extent applicable to Tvardi’s business and operations, may increase its compliance costs and potential liability with respect to the personal information Tvardi maintains about California residents. The CCPA creates individual privacy rights for California consumers (as defined in the law), places increased privacy and security obligations on entities handling certain personal information of consumers or households, requires covered companies to provide disclosures to consumers regarding data collection, use and sharing practices, requires covered companies to allow users to opt-out of certain sales or transfers of personal information, and provides consumers with a private right of action for certain data breaches. The CCPA became effective on January 1, 2020, and the California Attorney General’s authority to begin bringing enforcement actions began July 1, 2020. The CCPA may impact Tvardi’s business activities and exemplifies the vulnerability of its business to the evolving regulatory environment related to personal information and protected health information. Further, the California Privacy Rights Act (CPRA), went into effect on January 1, 2023, and became enforceable on July 1, 2023. The CPRA significantly amends the CCPA, and imposes additional data protection obligations on covered companies

<div align='center'>306</div>

TABLE OF CONTENTS

doing business in California, including additional consumer rights processes and opt-outs for certain uses of sensitive data. It also creates a new California data protection agency specifically tasked to enforce the law, which would likely result in increased regulatory scrutiny of California businesses in the areas of data protection and security. Similar laws have been passed in other