2.28 Cybersecurity. The Company’s information technology assets and equipment, computers, on-premise and remote systems, networks, hardware, and databases (collectively, “IT Systems”) are reasonably adequate for the operation of the business of the Company as currently conducted. The Company has implemented and maintained commercially reasonable physical, technical and administrative controls, policies, procedures, and safeguards to maintain and protect their material confidential information and the integrity, operation, redundancy and security of all IT Systems and data, including “Personal Data,” used in connection with their businesses. “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, or bank account information; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) “personal data,” “personal information,” or similar term as defined by CCPA (as defined below), CPRA (as defined below), GDPR (as defined below) or any other applicable Privacy Laws; (iv) any information which would qualify as “protected health information” under the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (collectively, “HIPAA”); and (v) any other piece of information that, either alone or in combination with another piece of information, allows for the identification of such natural person, his or her family or household, or a device, or permits the collection or analysis of any data related to an identified person’s health or sexual orientation, and together with all proprietary or confidential information of the Company, “Sensitive Data.” In the past three years, there have been no breaches, violations, outages or unauthorized uses of or accesses to such Sensitive Data or IT Systems, except for those that have been remedied without material cost or liability or the duty to notify any other person or governmental authority under Privacy Laws (as defined below).
2.29 Compliance with Data Privacy Laws. The Company is, and at all prior times were, in material compliance with all applicable foreign, state and federal data privacy and security laws and regulations, including without limitation HIPAA, the European Union General Data Protection Regulation (EU 2016/679) and the United Kingdom General Data Protection Regulation, and all state privacy laws (including the California Consumer Privacy Act, California Privacy Rights Act and similar laws in any other states) (collectively, the “Privacy Laws”). To ensure compliance with the Privacy Laws, the Company has in place, comply with, and take appropriate steps to ensure compliance in all material respects with the Company’s internal and external policies and procedures relating to data privacy and security and the collection, processing, storage, use, disclosure, handling, transfer and analysis of Sensitive Data. The Company further certifies that it: (i) has not received written notice of any actual or potential liability under or relating to, or actual or potential violation of, any of the Privacy Laws; (ii) is not currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action initiated by a governmental authority pursuant to any Privacy Law; or (iii) is not a party to any order, decree, or settlement agreement issued by a governmental authority that imposes any obligation or liability under any Privacy Law.
2.30 Employment Matters. No material labor dispute exists or, to the Company’s knowledge, is imminent with respect to any of the employees of the Company which would have or reasonably be expected to result in a Material Adverse Effect. None of the Company’s employees is a member of a union that relates to such employee’s relationship with the Company, and the Company is not a party to a collective bargaining agreement, and the Company believes that its relationship with its employees is good. No executive officer of the Company (as defined in Rule 501(f) of the Securities Act) has notified the Company that such officer intends to leave the Company or otherwise terminate such officer’s employment with the Company. To the Company’s knowledge, no executive officer is, or is now expected to be, in violation of any term of any material term of any employment contract, confidentiality, disclosure or proprietary information agreement or non-competition agreement, or any other contract or agreement or any restrictive covenant in favor of a third party, and to the Company’s knowledge, the continued employment of each such executive officer does not subject the Company to any liability with respect to any of the foregoing matters. The Company is in compliance with all U.S. federal, state, local and foreign laws and regulations relating to employment and employment practices, terms and conditions of employment and wages and hours, except where the failure to be in compliance would not, individually or in the aggregate, have or reasonably be expected to result in a Material Adverse Effect.
2.31 Use of Proceeds. The Company shall use the net proceeds of the sale of the Shares hereunder for non-clinical and clinical development activities for its product candidates and general corporate purposes.
2.32 Acknowledgment Regarding Purchasers’ Purchase of Securities. The Company acknowledges and agrees that each of the Purchasers is acting solely in the capacity of an arm’s length purchaser with respect to this Agreement and the transactions contemplated hereby. The Company further acknowledges that no Purchaser is acting as a financial advisor or fiduciary of the Company (or in any similar capacity with respect to the Company)
8