Company: BIAF
Filing Date: 2025-03-31
Form Type: 10-K
Source: 0001641172-25-001840
Chunk: 38

Company: bioAffinity Technologies, Inc.
Filing Date: 2025-03-31
Form: 10-K
Item: Item 1
Chunk 38
---
 Bodies designated for IVDR devices. Further, we will need to contract
a European Authorized Representative (“EAR”) that acts as the Company’s legal representative in the EU. Medical devices
also must be registered with the competent authority in the country in which they are based. In addition to the CE mark and the registration
done by the EAR, there is a need for an administrative national notification with certain member states of the EU.

European
Data Collection

The
collection and use of personal data (including health data) in the European Economic Area (“EEA”) are governed by the
EU General Data Protection Regulations (“EU GDPR”) and national implementing legislation in EEA member states. The EU
GDPR applies to any company established in the EEA and to companies established outside the EEA that process personal data in connection
with the offering of goods or services to data subjects in the EEA or the monitoring of the behavior of data subjects in the EEA. The
EU GDPR establishes stringent requirements applicable to the processing of personal data, including strict requirements relating to the
validity of consent of data subjects, expanded disclosures about how personal data is used, requirements to conduct data protection impact
assessments for “high risk” processing, limitations on retention of personal data, special provisions for “special
categories of personal data” including health and genetic information of data subjects, mandatory data breach notification (in
certain circumstances), “privacy by design” requirements, and direct obligations on service providers acting as processors.
The EU GDPR also prohibits the international transfer of personal data from the EEA to countries outside of the EEA unless made to a
country deemed to have adequate data privacy laws by the European Commission or a data transfer mechanism has been put in place. Failure
to comply with the requirements of the EU GDPR and the related national data protection laws of the EEA states may result in fines up
to 20 million euros or 4% of a company’s global annual revenues for the preceding financial year, whichever is higher. Moreover,
the EU GDPR affords various data protection rights to individuals (i.e., the right to erasure of personal data) in certain circumstances,
and the ability for data subjects to claim material and non-material damages resulting from infringements of the EU GDPR. Given the breadth
and depth of changes in data protection obligations, maintaining compliance with the EU GDPR will require significant time, resources,
and expense, and we may be required to put in place additional mechanisms ensuring compliance with the evolving data protection rules.
This