(“Confidential Data”)) used in connection with their businesses. Except as would not reasonably be expected to have a Material Adverse Effect, there have been no actual or reasonably suspected breaches of, violations of, outages of, or unlawful or unauthorized uses of, destruction of, losses of, alterations of, or accesses to IT Assets and no unlawful or unauthorized uses of, destruction of, losses of, alterations of, or accesses to Confidential Data (A) maintained by the Company or (B) to the knowledge of Company, by any third party, nor any such actual or reasonably suspected incidents under internal review or investigation. The Company and its subsidiaries comply, and since March 1, 2018 have complied in all material respects, with all (i) applicable laws, statutes, regulations, industry standards, and directives concerning the protection, collection, use, disclosure, transfer, storage, disposal, privacy, confidentiality, integrity and security of Confidential Data (including, to the extent applicable, Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”); the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679); the UK Data Protection Act of 2018; and the California Consumer Privacy Act (“CCPA”) (collectively, the “Privacy Laws”)), and (ii) all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, policies, procedures, and contractual obligations relating to the privacy and security of IT Assets and Confidential Data and to the protection of such IT Assets and Confidential Data from unlawful or unauthorized use, destruction, loss, alteration, misappropriation, modification, or access. Except as would not reasonably be expected to have a Material Adverse Effect, the Company and its subsidiaries have (i) made all required disclosures to and obtained all necessary consents from individuals (including, without limitation, clinical trial participants, customers, users, and personnel) for the Company’s and its subsidiaries’ collection, use, and disclosure of Confidential Data, and (ii) complied with all such disclosures and consents. To the knowledge of the Company, none of such disclosures made or contained in any policies or notices have been inaccurate, misleading or incomplete. “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, customer or account number, biometric identifier, medical, health or insurance information, and any information that can identify, relate to, describe, be associated with, or be reasonably capable of being associated with an individual; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; (iv) “personal data” as defined by GDPR; (v) “personal information” as defined by CCPA; and (vi) any other information that constitutes “personal data”, “personal information”, “personally identifiable information”, “nonpublic personal information”, “customer proprietary network information”, “individually identifiable health information”, “protected health information”, or similar information under any Privacy Law.
(z) No Complaints. There has been no complaint or audit, proceeding, investigation (formal or informal) demand or claim made against the Company in the past five (5) years, and none are currently pending against, the Company or its subsidiaries, or to the knowledge of the Company, any of its customers (specific to the customer’s use of the products or services of the Company), by any person, government entity, regulator, group or other party in respect of the collection, use or disclosure of Confidential Data by the Company or its subsidiaries, including without limitation, by any state Attorney General or related office, the Federal Trade Commission, the U.S. Department of Health and Human Services and any office contained therein (“HHS”), or any similar authority in any jurisdiction other than the United States or any other governmental entity, and, no such complaint, audit, proceeding, investigation or claim is or has been threatened.
(aa) FDA Compliance. Except as would not individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, since March 1, 2015, the Company: (A) is and has been in compliance with all statutes, rules or regulations of the FDA and other comparable governmental entities applicable to the ownership, testing, development, manufacture, packaging, processing, use, distribution, marketing, labeling, promotion, sale, offer for sale, storage, import, export or
11