(y) IT Assets, Data Privacy and Security. The computers, websites, applications, databases, software, servers, networks, data communications lines, and other information technology systems owned, licensed, leased or otherwise used by the Company and its subsidiaries (excluding any public networks) (collectively, the “IT Assets”) are adequate for, and operate and perform for, the operation of the business of the Company and its subsidiaries as currently conducted and as proposed to be conducted as described in the Registration Statement, the Pricing Disclosure Package and the Prospectus. To the knowledge of the Company, the IT Assets are free and clear of material viruses, vulnerabilities, disabling code or other harmful code that may reasonably be expected to have a Material Adverse Effect. The Company and its subsidiaries have at all times implemented and maintained commercially reasonable controls, policies, procedures, and safeguards to maintain and protect their confidential information and the integrity, continuous operation, redundancy and security of all IT Assets and data (including all Personal Data (defined below), sensitive, confidential, or regulated data (“Confidential Data”)) used in connection with their businesses. With respect to each third party performing services for the Company and its subsidiaries that is or has been permitted to access or process Confidential Data or IT Assets (including contract research organizations and contract manufacturing organizations), the Company has obtained a written agreement from such third party that binds such third party to (A) at least the same restrictions and conditions that apply to the Company with respect to such Confidential Data or IT Assets, (B) implement reasonable and appropriate measures for protecting such Confidential Data or IT Assets from unlawful or unauthorized use, destruction, loss, alteration, or access, and (C) comply with all Privacy Laws. To the knowledge of the Company, there have been no actual or reasonably suspected breaches of, violations of, outages of, or unlawful or unauthorized uses of, destruction of, losses of, alterations of, or accesses to IT Assets and no unlawful or unauthorized uses of, destruction of, losses of, alterations of, or accesses to Confidential Data, nor any such actual or reasonably suspected incidents under internal review or investigation. The Company and its subsidiaries comply, and since April 1, 2018 have complied in all material respects, with (i) applicable laws, statutes, regulations, and directives concerning the protection, collection, use, disclosure, transfer, storage, disposal, privacy, confidentiality, integrity and security of Confidential Data (including, to the extent applicable, the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”); the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679); and the California Consumer Privacy Act (“CCPA”) (collectively, the “Privacy Laws”)), and (ii) all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, internal and external policies and procedures, and contractual obligations relating to the privacy and security of IT Assets and Confidential Data and to the protection of such IT Assets and Confidential Data from unlawful or unauthorized use, destruction, loss, alteration, access, misappropriation or modification. Since April 1, 2018, the Company and its subsidiaries have, to the extent required under applicable Privacy Laws: (i) made all disclosures to and obtained all consents from individuals (including, without limitation, clinical trial participants, customers, users, and personnel) for the Company’s and its subsidiaries’ collection, use, and disclosure of Confidential Data, and (ii) complied with all such disclosures and consents, except where the failure to do so would not, individually or in the aggregate, be reasonably expected to have a Material Adverse Effect. None of such disclosures made or contained in any policies or notices have been inaccurate, misleading or incomplete. “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, customer or account number, biometric identifier, medical, health or insurance information, gender, date of birth, educational or employment information, any religious or political view or affiliation, marital or other status, photograph, face geometry and any information that can identify, relate to, describe, be associated with, or be reasonably capable of being associated with an individual; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; (iv) “personal data” as defined by GDPR; (v) “personal information” as defined by CCPA; and (vi) any other information that constitutes “personal data”, “personal information”, “personally identifiable information”, “nonpublic personal information”, “customer proprietary network information”, “individually identifiable health information”, “protected health information”, or similar information under any Privacy Law.
10