Company: PFSA
Filing Date: 2025-10-09
Form Type: S-1
Source: 0001213900-25-097860
Chunk: 69

Company: Profusa, Inc.
Filing Date: 2025-10-09
Form: S-1
Chunk 69
---
 to comply with these standards. There are numerous other laws and legislative and regulatory initiatives at the federal and state levels addressing privacy and security concerns. We also remain subject to federal or state privacy-related laws that are more restrictive than the regulations issued under HIPAA. These laws vary and could impose additional penalties. For example, the Federal Trade Commission uses its consumer protection authority to initiate enforcement actions in response to alleged privacy and data security violations. The California Consumer Privacy Act, or CCPA, which came into effect January 1, 2020 and was amended and expanded by the California Privacy Rights Act, or CPRA, which came into effect on January 1, 2023. The CCPA, including as amended by CPRA, among other things, create new data privacy obligations for covered companies and provide new privacy rights to California residents, including the right to opt out of certain disclosures of their information. The CCPA also creates a private right of action with statutory damages for certain data breaches, thereby potentially increasing risks associated with a data breach. As of January 1, 2023, the CCPA applies broadly to California employees and personal information of business contacts, which we anticipate will increase our compliance costs. It remains unclear what, if any, additional modifications will be made to this legislation or how it will be interpreted and regulations implementing CPRA amendments will not be finalized before CPRA amendments come into effect. Therefore, the effects of the CCPA and CPRA are significant and will likely require us to modify our data processing practices, and may cause us to incur substantial costs and expenses to comply, particularly given our base of operations in California. There are also a number of other legislative proposals worldwide, including in the United States at both the federal and state level, that could impose additional and potentially conflicting obligations in areas affecting our business. We are also subject to laws and regulations in foreign countries covering data privacy and other protection of health and employee information that may be more onerous than corresponding U.S. laws, including in particular the laws of Europe. For instance, in the European Union, increasingly stringent data protection and privacy rules that have and will continue to have substantial impact on the use of patient data across the healthcare industry became effective in May 2018. The EU General Data Protection Regulation, or GDPR, applies across the European Union and includes, among other things, a requirement for prompt notice of data breaches to data subjects and supervisory authorities in certain circumstances and significant fines for non-compliance. The GDPR fine framework can be up to 20