(kk) Cybersecurity. (i) During the past three (3) years, (A), the Company’s and its subsidiary’s information technology assets and equipment, computers, technology systems and other systems, networks, hardware, software, websites, applications, and databases (collectively, “IT Systems”) operate and perform in all material respects as required in connection with the operation of the business of the Company and its subsidiary as currently conducted, free and clear of all material bugs, errors, defects, Trojan horses, time bombs, malware and other corruptants; (B) the Company and its subsidiary have implemented and maintained reasonable controls, policies, procedures, and safeguards designed to maintain and protect its confidential information and the privacy, confidentiality, integrity, operation, and security of all physical storage facilities, IT Systems, and data used by or on behalf of the Company or its subsidiary in connection with the operation of the Company or its subsidiary that is considered “personal information,” “personally identifiable information,” “sensitive personal information,” “protected health information,” or “personal data” under applicable law, sensitive personal data, or confidential information (collectively, the “Protected Information”); and (C) the Company and its subsidiary have taken reasonable steps designed to protect the IT Systems and Protected Information, and have established and maintained commercially reasonable disaster recovery and security plans, procedures and facilities for the business, including, without limitation, for the IT Systems and Protected Information held or used by or for the Company and its subsidiary; and (D) except as would not, individually or in the aggregate, be expected to have a Material Adverse Effect, there have not been any (I) to the Company’s knowledge, security breaches, attacks, or outages of any such IT Systems, (II) actual security breaches resulting in accidental or unlawful destruction, loss, alteration or unauthorized uses or disclosures of Protected Information, or (III) to the Company’s knowledge, other security incidents or compromises of any IT Systems or Protected Information, or (IV) notifications by any third parties to the Company or its subsidiary of any of the foregoing.
(ll) Compliance with Data Privacy Laws. (A) The Company has at all times in the past three (3) years complied, in all material respects, with all (1) data protection, privacy and security policies applicable to the Company, (2) contractual obligations of the Company concerning data protection, privacy, and security with respect to Protected Information, and (3) applicable laws, statutes, regulations, and directives and all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority relating to the privacy and security of IT Systems and Protected Information or to the protection of such IT Systems and Protected Information from unauthorized use, access, misappropriation or modification, including, to the extent applicable, HIPAA, the European Union General Data Protection Regulation and the California Consumer Privacy Act of 2018 (collectively, the “Data Protection Requirements”); (B) the Company has at all times, to the extent required by applicable Data Protection Requirements, provided adequate notice to and obtained any necessary consents from data subjects for any past and present collection, use, disclosure, international transfer and other processing of Protected Information by or for the Company; and (C) the Company (1) has not in the past three (3) years received written notice of any actual liability under or relating to, or actual violation of, any of the Data Protection Requirements; (2) is not currently conducting or paying for, in whole or in part, any investigation, remediation, or other corrective action (I) mandated or requested by any legal or regulatory authority relating to any Data Protection Requirement or (II) necessitated by any kind of security breach of, attack on, or outage of any IT System; and (3) is not a party to any order, decree, or agreement by any court or arbitrator or governmental or regulatory authority that imposes any obligation or liability relating to any Data Protection Requirement.
(mm) Other Underwriting Agreements. The Company is not a party to any agreement with an agent or underwriter for any other “at the market” or continuous equity transaction.
15