Company: MIRM
Filing Date: 2025-11-04
Form Type: 10-Q
Source: 0001759425-25-000054
Chunk: 272

Company: Mirum Pharmaceuticals, Inc.
Filing Date: 2025-11-04
Form: 10-Q
Item: Part II, Item 1A
Chunk 272
---
 United States may scrutinize these statements, and if these policies, materials or statements 

60

are found to be deficient, lacking in transparency, deceptive, unfair, misleading or misrepresentative of our practices, we may be subject to adverse consequences.

Obligations related to data privacy and security (and consumers’ data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires significant resources and may necessitate changes to our information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. 

Although we endeavor to comply with our data privacy and security obligations, we may at times fail (or be perceived to have failed) to do so. Moreover, despite our efforts, our personnel or third parties with whom we work may fail to comply with such obligations, which could negatively impact our business operations and compliance posture. 

Our, or the third parties with whom we work, actual or perceived failure to adequately comply with applicable laws and regulations relating to privacy and data protection, or to protect personal data and other data we process or maintain, could result in adverse consequences, including regulatory fines and bans on processing personal data, government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar), litigation (including class action claims), mass arbitration demands, and other liabilities, claims for damages by affected individuals, orders to destroy or not use personal data, imprisonment of company officials, additional reporting requirements and/or oversight, interruptions or stoppages in our business operations (including, as relevant, clinical trials), and damage to our reputation. Any of these consequences could have a material adverse effect on our business, financial condition, results of operations and growth prospects, including but not limited to: loss of customers; interruptions or stoppages in our business operations (including, clinical trials); inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our approved medicines; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the