knowledge of, any event or condition that could result in, any security incident or breach, violation, outage or unauthorized use or access to the IT Assets and Confidential Data, except as would not reasonably be expected to have a Material Adverse Effect. “Personal Data” means any information that constitutes “personal data”, “personal information”, “personally identifiable information”, “protected health information” under applicable law.
(z) Data Privacy and Security Laws. Except where non-compliance would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries are, and have since February 1, 2020 been, in compliance with all applicable state, federal, and foreign data privacy, security and consumer protection laws and regulations, including without limitation, to the extent applicable, the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”), the California Consumer Privacy Act of 2018 (“CCPA”) and California Privacy Rights Act of 2020 (“CPRA”), the Virginia Consumer Data Protection Act (the “VCDPA”), the Colorado Privacy Rights Act (the “CPA”), the Connecticut Data Privacy Act (“CDPA”), the Utah Consumer Privacy Act (the “UCPA”), and the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679) (collectively, the “Privacy Laws”) and all policies, and contractual obligations relating to the privacy and security of IT Assets and Confidential Data, including the collection, storage, transfer (including, without limitation, any transfer across national borders), processing and/or use of Confidential Data and, and to the protection of such IT Assets and Confidential Data from unauthorized use, access, misappropriation or modification (collectively, with the Privacy Laws, the “Data Protection Requirements”). Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries have since February 1, 2020 made all disclosures to users or customers required by Privacy Laws, and none of such disclosures have, to the knowledge of the Company, been inaccurate or in violation of Privacy Laws. Neither the Company nor any subsidiary: (i) has received written notice of any actual or potential liability, including, but not limited to security or data privacy breaches or other unauthorized or unlawful access to, use of, or destruction of its Confidential Data or Personal Data, under or relating to, or actual or potential violation of, any Data Protection Requirement, and to the Company’s knowledge, no such notices are threatened or pending; (ii) is currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action pursuant to any Data Protection Requirement; or (iii) is a party to any order, decree, or agreement with any governmental, regulatory or supervisory authority or body that imposes any obligation or liability under any Data Protection Requirement.
(aa) No Complaints. There is no complaint to or audit, proceeding, investigation (formal or informal) or claim currently pending against the Company or its subsidiaries, or to the knowledge of the Company, any of its customers (specific to the customer’s use of the products or services of the Company) by any state Attorney General or related office, the Federal Trade Commission, the U.S. Department of Health and Human Services and any office contained therein (“HHS”), or any similar authority in any jurisdiction other than the United States or any other governmental entity, or by any person in respect of the collection, use or disclosure of Personal Data by the Company or its subsidiaries, and, to the knowledge of the Company, no such complaint, audit, proceeding, investigation or claim is threatened.
(bb) FDA Compliance. Except in each case, as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, the Company: (A) is, and has since February 1, 2020 been, in compliance with all applicable statutes, rules or regulations of the FDA relating to the ownership, testing, development, manufacture, packaging, processing, use, distribution, marketing, labeling, promotion, sale, offer for sale, storage, import, export or disposal
11