Company: APM
Filing Date: 2025-07-15
Form Type: DRS
Source: 0001213900-25-063899
Chunk: 129

Company: Aptorum Group Ltd
Filing Date: 2025-07-15
Form: DRS
Chunk 129
---
 by a critical information infrastructure operator in the
course of its operations in mainland China must be stored in mainland China, and if a critical information infrastructure operator purchases
internet products and services that affect or may affect national security, it should be subject to national security review by the CAC
together with competent departments of the State Council. In addition, for critical information infrastructure operators, or the “CIIOs”,
that purchase network-related products and services, the CIIOs shall declare any network-related product or service that affects or may
affect national security to the Office of Cybersecurity Review of the CAC for cybersecurity review. Due to the lack of further interpretations,
the exact scope of what constitutes a “CIIO” remains unclear. Further, the PRC government authorities may have wide discretion
in the interpretation and enforcement of these laws. In addition, the Review Measures stipulates that any online platform operators holding
more than one million users/users’ individual information shall be subject to cybersecurity review before listing abroad. As of
the date hereof, neither we nor our subsidiaries have received any notice from any authorities identifying us or our subsidiaries as a
CIIO or requiring us or our subsidiaries to undertake a cybersecurity review by the CAC. Further, as of the date hereof, neither we nor
our subsidiaries have been subject to any penalties, fines, suspensions, or investigations from any competent authorities for violation
of the regulations or policies that the CAC has issued.

On June 10, 2021, the Standing
Committee of the National People’s Congress promulgated the Data Security Law, which took effect on September 1, 2021. The Data
Security Law requires that data shall not be collected by theft or other illegal means, and it also provides for a data classification
and hierarchical protection system. The data classification and hierarchical protection system protects data according to its importance
in economic and social development, and the damages it may cause to national security, public interests, or the legitimate rights and
interests of individuals and organizations if the data is falsified, damaged, disclosed, illegally obtained or illegally used, which
protection system is expected to be built by the state for data security in the near future. On November 14, 2021, CAC published the
Regulations on the Data Security Administration Draft, or the “Data Security Regulations Draft”, to solicit public opinion
and comments. Under the Data Security Regulations Draft, an overseas initial public offering to be conducted by a data