Company: BIAF
Filing Date: 2025-05-07
Form Type: 424B4
Source: 0001641172-25-008977
Chunk: 131

Company: bioAffinity Technologies, Inc.
Filing Date: 2025-05-07
Form: 424B4
Chunk 131
---
 encounters problems following initial marketing, or if previously unrecognized problems are subsequently discovered.

European Union

A medical device or diagnostic test must be CE marked to be sold in the EU. The In Vitro Diagnostic Device Regulation (“IVDR”) of the EU defines the necessary pre-conditions that must be fulfilled to CE mark an IVD test or in vitro medical device in the EU. The manufacture of the test and/or device must fulfill all applicable regulatory requirements in the IVDR. Objective evidence of fulfilment of these requirements must be provided by the manufacturer prior to placing a test on the EU market. The manufacturer is required to establish a Quality Management System (“QMS”) as well as processes for manufacturing, importing, distribution, post-market surveillance, and vigilance. Regulations also require that the product is fully documented. In addition, it is likely that our CyPath ®Lung test is classified in a risk class that requires a review by an external party, a Notified Body, prior to placing the test on the EU market. This process is expected to require an additional six to 12 months after required documents and systems are in place. There currently is a general shortage in the EU of available Notified Bodies designated for IVDR devices. Further, we will need to contract a European Authorized Representative (“EAR”) that acts as the Company’s legal representative in the EU. Medical devices also must be registered with the competent authority in the country in which they are based. In addition to the CE mark and the registration done by the EAR, there is a need for an administrative national notification with certain member states of the EU.

European Data Collection

The collection and use of personal data (including health data) in the European Economic Area (“EEA”) are governed by the EU General Data Protection Regulations (“EU GDPR”) and national implementing legislation in EEA member states. The EU GDPR applies to any company established in the EEA and to companies established outside the EEA that process personal data in connection with the offering of goods or services to data subjects in the EEA or the monitoring of the behavior of data subjects in the EEA. The EU GDPR establishes stringent requirements applicable to the processing of personal data, including strict requirements relating to the validity of consent of data subjects, expanded disclosures about how personal data is used, requirements to conduct data protection impact assessments for “high risk” processing, limitations on retention of personal data, special provisions for “special categories of personal data” including health and genetic information of data subjects, mandatory data breach notification (in certain circumstances), “privacy