Company: ALGN
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001097149-25-000012
Chunk: 34

Company: ALIGN TECHNOLOGY INC
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1
Chunk 34
---
 states require us to report transfers of value to healthcare professionals that perform services or receive other items from us (e.g., meals, travel, branded promotional or educational items, or other benefits of value). Enforcement actions and associated efforts to respond or defend against enforcement actions can be expensive, and any resulting findings carry the risk of significant civil and criminal penalties.

In addition, we must comply with numerous laws and regulations addressing privacy, data protection, data governance and cyber security. Many of these laws and regulations do or will soon regulate or restrict cross-border data transfers, such as in the United States, the EU, Switzerland, Brazil, China, Vietnam, Japan, Korea, Australia, New Zealand, the Kingdom of Saudi Arabia, Hong Kong and other countries. Further, in the United States, we may be required to comply with laws and regulations addressing the collection, use, security and processing of protected health information and other information relating to individuals, including the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and its implementing rules. The HIPAA Standards for Privacy of Individually Identifiable Health Information (“Privacy Standards”) and the Security Standards for the Protection of Electronic Protected Health Information under HIPAA and the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH Act”) (the “Security Standards”) are the subjects of final and proposed rule amendments, respectively, reflecting the rapidly evolving nature of these laws and regulations. Additionally, many U.S. states maintain laws and regulations addressing privacy, data protection, data governance and cybersecurity. Like many other companies, we must work to ensure our global privacy program framework incorporates applicable requirements of new and modified laws and regulations in relevant jurisdictions to support our efforts to ensure that our product innovations and our associated practices comply with these increasingly complex laws and regulations.

15

Legislatures and regulators globally are proposing, and in certain cases have enacted, new laws or regulations regarding privacy, data protection, data governance and cybersecurity that could require us to modify our policies and practices in order to comply with new and evolving obligations relating to these matters. Information regarding risks associated with data security and privacy may be found in Part I, Item 1A of this Annual Report on Form 10-K under the heading “Risk Factors.”

Environmental Laws and Regulations

We are subject to numerous international, federal, state and local environmental laws, including provisions that regulate the purchase, use, distribution, and environmental impact of hazardous substances used in our operations, contained within our products and the packaging associated with our products. We are