Our business is subject to complex and evolving U.S. and foreign laws and regulations regarding privacy, data protection, content, competition, consumer protection, and other matters. Many of these laws and regulations are subject to change and uncertain interpretation, and could result in claims, changes to our business practices, monetary penalties, increased cost of operations, or declines in user growth or engagement, or otherwise harm our business.
We are subject to a variety of laws and regulations in the United States and abroad that involve matters central to our business, such as privacy, data protection and personal information, rights of publicity, content, intellectual property, advertising, marketing, distribution, data security, data retention and deletion, electronic contracts and other communications, competition, protection of minors, consumer protection, taxation and securities law compliance. Expansion of our activities in certain jurisdictions, or other actions that we may take, may subject us to additional laws, regulations, or other government scrutiny. In addition, foreign data protection, privacy, content, competition, and other laws and regulations can impose different obligations or be more restrictive than those in the United States.
We are currently accepting only members who are resident in the United States, but if we accept European members, the European General Data Protection Regulation (GDPR) will apply to us. The GDPR increases privacy rights for individuals in Europe, extends the scope of responsibilities for data controllers and data processors and imposes increased requirements and potential penalties on companies offering goods or services to individuals who are located in Europe or monitoring the behavior of such individuals (including by companies based outside of Europe). Noncompliance can result in penalties of up to the greater of €20 million, or 4% of global company revenues. See “Description of Business — Government Regulation.”
These U.S. federal and state and foreign laws and regulations, which in some cases can be enforced by private parties in addition to government authorities, are constantly evolving and can be subject to significant change. As a result, the application, interpretation, and enforcement of these laws and regulations are often uncertain, particularly in the newer industry in which we operate, and may be interpreted and applied inconsistently from country to country and inconsistently with our current policies and practices.
These laws and regulations, as well as any associated inquiries or investigations or any other government actions, may be costly to comply with and may delay or impede our international growth, result in negative publicity, increase our operating costs, require significant management time and attention, and subject us to remedies that may harm our business.
The Health Insurance Portability and Accountability Act of 1996 currently does not apply to us, and hence our members’ Member Data will not be protected by that law.
We are not subject to the Health Insurance Portability and Accountability Act of 1996, as amended, commonly known as HIPAA, even though we will have access to, store, process and transmit sensitive personal, health and medical information, because we are not a “covered entity” for purposes of that statute. HIPAA is designed to protect medical records and other personal health information by limiting their use and disclosure, giving patients the right to access, amend and seek accounting of their own health information and limiting most uses and disclosures of health information to the minimum amount reasonably necessary to accomplish the intended purpose. Various government agencies may enforce these provisions of HIPAA and impose civil or criminal penalties for HIPAA violations. Because we are not subject to HIPAA, we will not be subject to the civil and criminal penalties available to government agencies and, accordingly, we may not have the same incentive to protect Member Data as would a covered entity subject to HIPAA’s requirements.
Our current lack of geographic diversity exposes us to risk.
Our operations are currently geographically limited to the United States and we are currently only accepting members who are resident in the United States. As a result of this geographical concentration, our Database may lack data diversification desired by our customers. We plan to expand our operations and member admissions internationally in order to increase the diversity of our Database, and if and when we do, such expansion would subject us to additional laws and regulations, such as data privacy, health and securities laws and regulations, place increased responsibilities on our Manager, divert resources from other operations and expose us to new risks of foreign operations.
-12-