all times implemented and maintained reasonable controls, policies, procedures, and safeguards to maintain and protect their confidential information and the integrity, continuous operation, redundancy and security of all IT Assets and data (including all Personal Data (defined below), sensitive, confidential, or regulated data (“Confidential Data”)) used in connection with their businesses. There have been no actual or reasonably suspected breaches of, violations of, outages of, or unlawful or unauthorized uses of, destruction of, losses of, alterations of, or accesses to IT Assets and no unlawful or unauthorized uses of, destruction of, losses of, alterations of, or accesses to Confidential Data, nor any such actual or reasonably suspected incidents under internal review or investigation. The Company and its subsidiaries materially comply, and have at all times materially complied, with all (i) applicable laws, statutes, regulations, directives, and industry standards concerning the protection, collection, use, disclosure, transfer, storage, disposal, privacy, confidentiality, integrity and security of Confidential Data (including without limitation the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”); the European Union General Data Protection Regulation (“GDPR”) (EU 2016/679); and the California Consumer Privacy Act (“CCPA”) (collectively, the “Privacy Laws”)), and (ii) all judgments, orders, rules and regulations of any court or arbitrator or governmental or regulatory authority, policies, procedures, and contractual obligations relating to the privacy and security of IT Assets and Confidential Data and to the protection of such IT Assets and Confidential Data from unlawful or unauthorized use, destruction, loss, alteration, access, misappropriation or modification and have imposed equivalent contractual obligations on any third parties having direct or indirect access to IT Assets or responsible for any processing Confidential Data. The Company and its subsidiaries have at all times made all required disclosures to and obtained all necessary consents from individuals (including, without limitation, clinical trial participants, customers, users, and personnel) for the Company’s and its subsidiaries’ collection, use, and disclosure of Confidential Data, and complied with all such disclosures and consents. None of such disclosures made or contained in any policies or notices have been materially inaccurate, misleading or incomplete. “Personal Data” means (i) a natural person’s name, street address, telephone number, e-mail address, photograph, social security number or tax identification number, driver’s license number, passport number, credit card number, bank information, customer or account number, biometric identifier, medical, health or insurance information, gender, date of birth, educational or employment information, any religious or political view or affiliation, marital or other status, photograph, face geometry and any information that can identify, relate to, describe, be associated with, or be reasonably capable of being associated with an individual; (ii) any information which would qualify as “personally identifying information” under the Federal Trade Commission Act, as amended; (iii) Protected Health Information as defined by HIPAA; (iv) “personal data” as defined by GDPR; (v) “personal information” as defined by CCPA; and (vi) any other information that constitutes “personal data”, “personal information”, “personally identifiable information”, “nonpublic personal information”, “customer proprietary network information”, “individually identifiable health information”, “protected health information”, or similar information under any Privacy Law.
(x) No Complaints. Except as would not, individually or in the aggregate, reasonably be expected to have a Material Adverse Effect, there has been no complaint or audit, proceeding, investigation (formal or informal) or claim made against the Company in the past five (5) years, and none are currently pending against, the Company or its subsidiaries by any person,
- 12 -