; or (B) the purpose for transferring, selling, sharing, or allowing access to such information is to otherwise add value to the entity that collects consumer health information, for commercial purposes; or (2) transfer, sell, or allow access to any consumer health information collected, stored, recorded, or derived from personal consumer devices to any information broker or any entity outside of the jurisdiction of the United States. (b) Exceptions (1) In general Subject to paragraph (3), the prohibition under subsection (a)(1) shall not apply if— (A) the entity obtains the informed consent of the consumer; (B) the information is provided to a covered entity, as defined in section 160.103 of title 45, Code of Federal Regulations (or any successor regulations); (C) such information is provided to a government organization or agency, including law enforcement or regulators, to comply with applicable laws, regulations, or rules, or requests of law enforcement, regulatory, or other governmental agencies or in response to a legal process in connection with a subpoena, warrant, discovery order, or other request or order from a law enforcement agency; (D) such information is provided to the entity's affiliates or other trusted businesses or persons to process the information as part of the entity's external processing procedures, based on the entity's instructions and in compliance with privacy protections and any other appropriate confidentiality and security measures; (E) such information is provided in connection with a substantial corporate transaction of the entity, such as the transfer of ownership, a merger, consolidation, asset sale, or bankruptcy or insolvency; or (F) such information is provided to academic, medical, research institutions, or other nonprofit organizations acting in the public interest for the purpose of detecting or responding to security incidents; preventing fraud; conducting scientific, historical, or statistical research