In the ordinary course of business, we collect, receive, store, generate, use, disclose, make accessible, protect, maintain and process, and our third-party vendors, collaborators, contractors and consultants maintain and process on our behalf, personal data, and other sensitive information in connection with our commercialization and development activities and our employees. Our data processing activities subject us to the numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and safety security policies, contractual requirements and other obligations relating to data privacy and security. Any actual or perceived failure by us, our third- party vendors, collaborators, contractors and consultants to comply with applicable data privacy and security obligations could result in government enforcement actions (e.g. investigations, fines, penalties, audits, inspections, and similar actions); litigation (including class-action claims), additional reporting requirements and oversight; bans on processing personal data; orders to destroy or not use personal data; fines; imprisonment of company officials and public censure; claims for damages by affected individuals, damage to our reputation and loss of goodwill, any of which could have a material adverse effect on our business, financial condition, results of operations or prospects.
Compliance with health-related and data protection laws, along with any other applicable privacy and data security laws and regulations is a rigorous and time-intensive process, and we may be required to put in place additional mechanisms ensuring compliance with the new data protection rules.
In May 2018, the General Data Protection Regulation (the "EU GDPR"), took effect in the European Economic Area (the "EEA"), where we have growing operations. Further, the United Kingdom has implemented a legislation similar to the EU GDPR, the ("UK GDPR"), including the UK Data Protection Act. The EU and UK GDPR, impose substantial fines for breaches and violations. For example, under the EU GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million euros or 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests.
In the ordinary course of business, we may transfer personal data from the EEA, United Kingdom and other jurisdictions to the United States or other countries. The EEA, United Kingdom and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the EEA and the United Kingdom have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it believes are inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and United Kingdom to the United States in compliance with law, such as the EEA and United Kingdom's standard contractual clauses, and the EU-U.S. Data Privacy Framework (which allows for transfers for relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States.
If there is no lawful manner for us to transfer personal data from the EEA, the United Kingdom or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and United Kingdom to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of the EEA for allegedly violating the EU GDPR's cross-border data transfer limitations.
We are also subject to the EU Network and Information Security ("NIS2") Directive, which regulates resilience and incident response capabilities of entities operating in a number of sectors, including the health sector and imposes stringent cybersecurity risk-management and reporting obligations. Failure to comply with these requirements could result in substantial administrative fines of a maximum of 10 million Euros or up to 2% of our global annual turnover, personal liability for our senior management, and significant reputational damage. Furthermore, our reliance on third-party suppliers who must also comply with these standards introduces additional supply chain risks that could impact our operational continuity.
In the United States, there are numerous federal and state privacy and data security laws and regulations governing the collection, use, disclosure and protection of personal information, including federal and state health information privacy laws, federal and state security breach notification laws, and federal and state consumer protection laws. Each of these constantly evolving laws can be subject to varying interpretations. For example, regulations promulgated pursuant to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH"), establish specific requirements related to the privacy, transmission, and security of individually identifiable health information, that constitutes protected health information. Enforcement of HIPAA and its regulations can result in financial liability and reputational harm, and responses to such enforcement activity can consume significant internal resources. In addition, the U.S. Department of Justice ("DOJ") issued rules on "Preventing Access to U.S. Sensitive Personal Data by Countries of Concern", which became effective on April 8, 2025. Under the DOJ's Final Rule, certain transactions involving sensitive personal data, including human 'omic data (genomic, epigenomic, proteomic, and transcriptomic data) and human biospecimens, as well as personal health data from U.S. persons during clinical trials, are strictly prohibited or restricted if they involve "countries of concern", including China, Russia, Iran, North Korea, Cuba, and Venezuela, or "covered persons" linked to these nations. The rule applies regardless of whether data is anonymized, key-coded, pseudonymized, de-identified or encrypted, which presents particular challenges for companies like ours and may impact our ability to transfer data in connection with certain transactions or agreements. Non-compliance with the rule could lead to civil and criminal penalties, forced termination of critical research and development partnerships and reputational damage and loss of investor confidence due to perceived national security risks.
Further, the California Consumer Privacy Act of 2018 ("CCPA") applies to personal information of consumers, business representatives, and employees, and requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights. The CCPA provides for civil penalties and allows private litigants affected by certain data breaches to recover significant statutory damages. Although the CCPA exempts some data processed in the context of clinical trials, the CCPA increases compliance costs and potential liability with respect to other personal data we maintain about California residents.
In addition, the California Privacy Rights Act of 2020 ("CPRA") expands the CCPA's requirements, including by adding a new right for individuals to correct their personal information and establishing a new regulatory agency to implement and enforce the law. Other states have also passed comprehensive privacy laws, and similar laws are being considered in several other states, as well as at the federal and local levels. While these states, like the CCPA, also exempt some data processed in the context of clinical trials, these developments further complicate compliance efforts, and increase legal risk and compliance costs for us, the third parties upon whom we rely.
Many statutory requirements, both in the United States and abroad, include obligations for companies to notify individuals of security breaches involving certain personal information, which could result from breaches experienced by us or our third-party service providers. For example, laws in all 50 U.S. states and the District of Columbia require businesses to provide notice to consumers whose personal information has been disclosed as a result of a data breach. These laws are not consistent, and compliance in the event of a widespread data breach is difficult and may be costly. Moreover, states have been frequently amending existing laws, requiring attention to changing regulatory requirements. We also may be contractually required to notify customers or other counterparties of a security breach. Any contractual protections we may have from our third-party service providers, contractors or consultants may not be sufficient to adequately protect us from any such liabilities and losses, and we may be unable to enforce any such contractual protections.
Our employees and personnel use generative artificial intelligence and may use agentic artificial intelligence or machine learning (collectively "AI") technologies to perform their work, and the disclosure and use of personal data in generative AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use AI, it could make our business less efficient and result in competitive disadvantages.
We expect that there will continue to be new proposed laws and regulations concerning data privacy and security, and we cannot yet determine the impact such future laws, regulations and standards may have on our business. New laws, amendments to or re-interpretations of existing laws, regulations, standards and other obligations may require us to incur additional costs and restrict our business operations. Because the interpretation and application of health-related and data protection laws, regulations, standards and other obligations are still uncertain, and often contradictory and in flux, it is possible that the scope and requirements of these laws may be interpreted and applied in a manner that is inconsistent with our practices and our efforts to comply with the evolving data protection rules may be unsuccessful. If so, this could result in government-imposed fines or orders requiring that we change our practices, which could adversely affect our business. In addition, these privacy regulations may differ from country to country, and may vary based on whether testing is performed in the United States or in the local country and our operations or business practices may not comply with these regulations in each country.
We have been making constant efforts to comply with the relevant data protection laws and regulations in the PRC and will endeavor to comply with any update in the applicable laws, regulations or guidelines as issued by any relevant regulatory authorities in the PRC. However, we cannot assure you that we are able to comply with any applicable privacy and data security laws, regulations and guidelines in a timely manner, or at all. In addition, certain industry-specific laws and regulations affect the collection, use and transfer of personal data in China. For example, the PRC State Council promulgated Regulations on the Administration of Human Genetic Resources (further amended on March 10, 2024 and became effective from May 1, 2024), which stipulates that foreign organizations, foreign individuals and the institutions established or actually controlled thereby shall not collect or preserve China's human genetic resources within the PRC, and shall not provide China's human genetic resources abroad. Where a foreign organization or an institution established or actually controlled by a foreign organization or foreign individual needs to use China's human genetic resources to conduct scientific research activities, it shall comply with the applicable laws, administrative regulations and relevant provisions in the PRC, and cooperate with China's scientific research institutions, universities, medical institutions and other enterprises provided therein. In this regard, utilization of China's human genetic resources for international cooperation in scientific research, as well as transporting China's human genetic resources materials abroad shall be subject to the approval of the administrative department for health under the State Council. However, no approval is required in international clinical trial cooperation using China's human genetic resources at clinical institutions without export of human genetic resource materials for obtaining the licensing for the listing of relevant drugs and medical devices in the PRC market, provided that the type, quantity and usage of the human genetic resources to be used shall be filed with the administrative department for health under the State Council before conducting the clinical trials. There is no assurance that we can always complete all application, approval or pre-registration processes according to existing or future HGR laws and regulations.
Obligations related to data privacy and security (and consumers' data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us and the third parties with whom we do business to devote significant resources, which may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf.