In the ordinary course of business, Tvardi collects, receives, stores, processes, generates, uses, transfers, discloses, makes accessible, protects, secures, disposes of, transmits, and shares (collectively, process or processing) certain sensitive information, including proprietary and confidential business data, trade secrets, employee data, intellectual property, data it collects about clinical trial participants in connection with clinical trials, and other sensitive third-party data (collectively, sensitive data). The global data protection landscape is rapidly evolving and Tvardi is or may become subject to numerous data privacy and security obligations, such as various state, federal and foreign laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations governing the collection use, disclosure, retention, and security of personal information or otherwise relating to data privacy and security, including as relates to information that Tvardi may collect in connection with clinical trials in the United States and abroad.
Various federal, state, local and foreign legislative and regulatory bodies, or self-regulatory organizations, may expand current laws, rules or regulations, enact new laws, rules or regulations or issue revised rules or guidance regarding data privacy and security. Implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and Tvardi cannot yet determine the impact future laws, regulations, standards, or perception of their requirements may have on its business. This evolution may create uncertainty in Tvardi's business, affect its ability to operate in certain jurisdictions or to collect, store, transfer use and share personal information, necessitate the acceptance of more onerous obligations in its contracts, result in liability or impose additional costs on Tvardi. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the future. Any actual or perceived failure by Tvardi to comply with federal, state or foreign laws or regulations, its internal policies and procedures or its contracts governing the processing of personal information could result in, among other things, negative publicity, government investigations and enforcement actions, claims by third parties and damage to Tvardi's reputation, any of which could have a material adverse effect on its business, results of operation, and financial condition.
In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, data privacy laws, and other similar laws. For example, HIPAA, as amended by HITECH (collectively, HIPAA), imposes among other things, certain requirements relating to the privacy, security, transmission, and breach of individually identifiable health information. Tvardi may obtain health information from third parties (including research institutions from which it obtains clinical trial data) that are subject to privacy and security requirements under HIPAA. Depending on the facts and circumstances, Tvardi could be subject to significant penalties if it violates HIPAA.
Certain states have also adopted comparable privacy and security laws and regulations, which govern the privacy, processing and protection of health-related and other personal information. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for Tvardi and its future customers and strategic partners. For example, the CCPA, went into effect on January 1, 2020 and applies to the personal information of consumers, business representatives, and employees who are California residents, and increases the privacy and security obligations of covered businesses under the CCPA that handle personal information subject to the CCPA, including among other things, requiring such businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights, including the right to opt out of certain disclosures of their information. The CCPA provides for civil penalties as well as a private right of action with statutory damages for certain data breaches, thereby potentially increasing the likelihood of, and risks associated with, data breach litigation. Although the law includes limited exceptions, including for certain information collected as part of clinical trials, the CCPA may impact Tvardi's processing of personal information and increase its compliance costs. Additionally, the California Privacy Rights Act of 2020 (CPRA) went into effect on January 1, 2023, and significantly expands the CCPA, such as by granting additional rights to California residents, including the right to correct personal information and affording opt-out rights for certain uses of sensitive information, and imposes additional data protection obligations on covered businesses, including additional limitations on data uses and new audit requirements for higher risk sensitive information. The CPRA also established the California Privacy Protection Agency which is authorized to issue substantive regulations and could result in increased privacy and information security enforcement. Other states have also passed comprehensive privacy laws, and similar laws are being considered in several other states, as well as at the federal and local levels. While these state privacy laws, like the CCPA, may or do exempt some data processed in the context of clinical trials, these laws could have potentially conflicting requirements that further complicate compliance efforts, and increase legal risk and compliance costs for Tvardi and the third parties upon whom it relies.
In the event that Tvardi is subject to or affected by HIPAA, the CCPA, the CPRA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect its financial condition. In addition to government activity, privacy advocacy groups and technology and other industries are considering various new, additional or different self-regulatory standards that may place additional burdens on Tvardi. In addition to data privacy and security laws, Tvardi is also bound by other contractual obligations related to data privacy and security, and its efforts to comply with such obligations may not be successful.
Each of these laws, rules, regulations and contractual obligations relating to data privacy and security, and any other such changes or new laws, rules, regulations or contractual obligations could impose significant limitations on Tvardi's business, require changes to Tvardi's business, or restrict its collection, use, storage or processing of personal information, which may increase its compliance expenses and make its business more costly or less efficient to conduct. In addition, any such changes could compromise Tvardi's ability to develop an adequate marketing strategy and pursue its growth strategy effectively or even prevent Tvardi from providing certain products in jurisdictions in which it currently operates and in which Tvardi may operate in the future or incur potential liability in an effort to comply with such legislation, which, in turn, could adversely affect its business, financial condition, results of operations and prospects.
Complying with these numerous, complex and often changing obligations is expensive and difficult, and failure to comply with any data privacy or security obligations, whether by Tvardi, one of its CROs, CMOs, partners or another third party, could adversely affect its business, financial condition, results of operations and prospects, including but not limited to: investigation costs; material fines and penalties; compensatory, special, punitive and statutory damages; litigation; consent orders regarding Tvardi's privacy and security practices; requirements that it provides notices, credit monitoring services and/or credit restoration services or other relevant services to impacted individuals; adverse actions against Tvardi's licenses to do business; reputational damage; and injunctive relief. In addition, new regulation or legislative actions regarding data privacy and security (together with applicable industry standards) may increase its costs of doing business.
In this regard, Tvardi expects that there will continue to be new proposed laws, regulations and industry standards relating to privacy and data protection in the United States, the EEA and other jurisdictions, and it cannot determine the impact such future laws, regulations and standards may have on its business. For example, the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places additional restriction on certain data transactions involving countries of concern (e.g., China, Russia, Iran) and covered individuals (i.e., individuals and entities located in or controlled by individuals or entities located in those jurisdictions) that may impact certain business activities such as vendor engagements, sale or sharing of data, employment of certain individuals, and investor agreements. Violations of the rule could lead to significant civil and criminal fines and penalties. The rule applies regardless of whether data is anonymized, key-coded, pseudonymized, de-identified or encrypted, which presents particular challenges for companies like ours and may impact our ability to transfer data in connection with certain transactions or agreements.
Any actual or perceived failure by Tvardi or its third-party service providers to comply with any federal, state or foreign laws, rules, regulations, industry self-regulatory principles, industry standards or codes of conduct, regulatory guidance, orders to which Tvardi may be subject or other legal obligations relating to data privacy, data protection, security or consumer protection could adversely affect Tvardi's reputation, brand and business. Tvardi may also be contractually required to indemnify and hold harmless third parties from the costs or consequences of non-compliance with any laws, rules and regulations or other legal obligations relating to privacy or any inadvertent or unauthorized use or disclosure of data that Tvardi stores or handles as part of operating its business. Any of these events could adversely affect Tvardi's reputation, business, or financial condition, including but not limited to: loss of customers; interruptions or stoppages in its business operations (including clinical trials); inability to process personal information or to operate in certain jurisdictions; limited ability to develop or commercialize its products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to its business model or operations.
Tvardi cannot be certain that its CROs, CMOs or other third-parties with access to its or its suppliers', manufacturers', clinical trial participants' and employees' sensitive information in relation to which Tvardi is responsible will not breach contractual obligations imposed by Tvardi, or that they will not experience data security incidents, which could have a corresponding effect on its business, including putting Tvardi in breach of its obligations under privacy laws and regulations and/or which could in turn adversely affect its business, financial condition, results of operations and prospects. Tvardi cannot be certain that its contractual measures and its own privacy and security-related safeguards will protect Tvardi from the risks associated with the third-party processing of such information. Any of the foregoing could adversely affect its business, financial condition, results of operations and prospects.
Tvardi posts certain of its privacy policies which describe its practices concerning its collection, use, disclosure and other processing of the personal information. Although it endeavors to comply with its public statements and documentation, Tvardi may at times fail to do so or be perceived to have failed to do so. Tvardi's publication of its privacy policies and other statements it publishes that provide promises and assurances about privacy and security can subject Tvardi to potential state and federal action if they are found to be deceptive, unfair or misrepresentative of its actual practices.
Any actual or perceived failure by Tvardi to comply with federal, state or foreign laws, rules or regulations, industry standards, contractual or other legal obligations relating to data privacy or security, or any actual, perceived or suspected cybersecurity incident, whether or not resulting in unauthorized access to, or acquisition, release or transfer of personal information or other data, may result in enforcement actions and prosecutions, private litigation, significant fines, penalties and censure, claims for damages by customers and other affected individuals, regulatory inquiries and investigations or adverse publicity and could cause its relevant stakeholders to lose trust in Tvardi, any of which could adversely affect its business, financial condition, results of operations and prospects.
The successful assertion of one or more large claims against Tvardi that exceeds its available insurance coverage, or results in changes to its insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements), could have an adverse effect on its business. In addition, Tvardi cannot be sure that its existing insurance coverage will continue to be available on acceptable terms or that its insurers will not deny coverage as to any future claim.