What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-03-17 compared with 2024-03-15 · 128 added, 132 removed, 759 unchanged (26% of the section changed)

3 unchanged sentences

The risks and uncertainties described below are not the only ones we face.

risks and uncertainties that we are unaware of, or that we currently believe are not material, may also become important factors that affect us.

Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, may also become important factors that affect us.

If any of the following risks occur, our business, operating results and prospects could be materially harmed.

20 unchanged sentences

Moreover, interim, “top-line,” and preliminary data from our clinical trials that we announce or publish may change, or the perceived product profile may be negatively impacted, as more patient data or additional endpoints (including efficacy and safety) are analyzed.

● If clinical trials of our lead product candidate fail to demonstrate safety and efficacy to the satisfaction of the FDA, or the EMA, or do not otherwise produce favorable results, we may incur additional costs or experience delays in completing, or ultimately be unable to complete the development and commercialization of ibezapolstat or any other product candidate.

● If clinical trials of our lead product candidate fail to demonstrate safety and efficacy to the satisfaction of the FDA, or the European Medicines Agency (“EMA”), or do not otherwise produce favorable results, we may incur additional costs or experience delays in completing, or ultimately be unable to complete the development and commercialization of ibezapolstat or any other product candidate.

● If we experience any of a number of possible unforeseen events in connection with our clinical trials, potential marketing approval or commercialization of our product candidates could be delayed or prevented.

10 unchanged sentences

● The price of our stock may be volatile, and you could lose all or part of your investment.

● Nasdaq may delist our securities from trading on its exchange, which could limit investors’ ability to make transactions in our securities and subject us to additional trading restrictions.

● Our largest stockholders will exercise significant influence over our company for the foreseeable future, including the outcome of matters requiring stockholder approval.

49 unchanged sentences

In November 2023, we entered into a Sales Agreement and established an “At-the-Market" offering (the “ATM Program”), pursuant to which we may offer and sell, from time to time through A.G.P./Alliance Global Partners, as sales agent, shares of our common stock having an aggregate offering price of up to $17.0 million.

As of the year ended December 31, 2023, we sold 698,121 shares of our common stock under the ATM Program, at a weighted-average price of $3.76 per share, raising $2.6 million of gross proceeds and net proceeds of $2.4 million after deducting commissions to the sales agent and other ATM Program related expenses.

There remains approximately $14.4 million available for future sales of shares of common stock under the Sales Agreement.

Other than the Sales Agreement, we currently do not have any commitments to obtain additional funds.

As of the year ended December 31, 2024, we sold a total of 2,830,328 shares of our common stock under the ATM Program, at a weighted-average price of $3.26 per share, raising $9.2 million of gross proceeds and net proceeds of $8.8 million after deducting commissions to the sales agent and other ATM Program related expenses.

There remained approximately $7.8 million available for future sales of shares of common stock under the Sales Agreement.

As of January 6, 2025, we suspended the ATM program.

We believe that, based upon our current operating plan, our existing capital resources, will not be sufficient to fund our anticipated operations for at least 12 months from the issuance of our financial statements for the year ended December 31, 2024.

23 unchanged sentences

If we raise additional funds through strategic partnerships and alliances and licensing arrangements with third parties, we may have to relinquish valuable rights to our technologies or product candidates, or grant licenses on terms unfavorable to us.

If we are unable to raise additional capital through equity or debt financings when needed (including if we are unable to do so as a result of the COVID-19 pandemic), we may be required to delay, limit, reduce or terminate our product development or future commercialization efforts, or grant rights to develop and market product candidates that we would otherwise develop and market ourselves.

If we are unable to raise additional capital through equity or debt financings when needed, we may be required to delay, limit, reduce or terminate our product development or future commercialization efforts, or grant rights to develop and market product candidates that we would otherwise develop and market ourselves.

We are reliant on the success of our lead product candidate, ibezapolstat, which we are developing for the treatment of CDI.

63 unchanged sentences

The FDA can halt clinical trials at any time for safety reasons or because we or our clinical investigators did not follow the FDA’s requirements for conducting clinical trials.

If we are unable to receive clearance to conduct clinical trials or the trials are permanently halted by the FDA, we would not be able to achieve any revenue from such product as it is illegal to sell any drug or medical device for human consumption or use without FDA approval.

medical device for human consumption or use without FDA approval.

Moreover, there is a risk that our clinical trials will fail to meet their primary endpoints, which would make them unacceptable in having the subject product approved by the FDA.

17 unchanged sentences

Notably, the COVID-19 pandemic continues to evolve.

The extent to which COVID-19 impacts our operations or those of our collaborators, contractors, suppliers, CROs, clinical sites, CMOs and other material business relations and governmental agencies will depend on future developments, which are highly uncertain and cannot be predicted with confidence, including the duration and severity of the outbreak, new information that will emerge concerning the severity of the virus and the actions to contain it or treat its impact, among others.

The extent to which COVID-19 impacts our operations or those of our collaborators, contractors, suppliers, CROs, clinical sites, contract manufacturing organizations (“CMOs”) and other material business relations and governmental agencies will depend on future developments, which are highly uncertain and cannot be predicted with confidence, including the duration and severity of the outbreak, new information that will emerge concerning the severity of the virus and the actions to contain it or treat its impact, among others.

Previously, our clinical trial operations were directly and indirectly adversely impacted, and could continue to be directly and indirectly adversely impacted, by the COVID-19 pandemic.

The spread of COVID-19 could also have adverse economic impacts to us.

While the potential economic impact brought by, and the duration of, the COVID-19 pandemic, have been, and continue to be, difficult to assess or predict, the spread of COVID-19 has caused a broad impact globally.

A new pandemic or a resurgence of the COVID-19 pandemic could have adverse economic impacts to us.

Global, market and economic conditions may negatively impact our business, financial condition and share price.

1 unchanged sentence

and global economies are facing growing inflation, higher interest rates and a potential recession.

Furthermore, a severe or prolonged economic downturn, including a recession or depression resulting from the ongoing COVID-19 pandemic or political disruption such as the war between Ukraine and Russia and the conflict involving Israel and Hamas could result in a variety of risks to our business, including weakened demand for our programs and development candidates, if approved, relationships with any vendors or business partners

located in affected geographies and our ability to raise additional capital when needed on acceptable terms, if at all.

Furthermore, a severe or prolonged economic downturn, including a recession or depression resulting from public health crises such as a pandemic or ongoing political disruption such as the war

between Ukraine and Russia and the conflict involving Israel and Hamas could result in a variety of risks to our business, including weakened demand for our programs and development candidates, if approved, relationships with any vendors or business partners located in affected geographies and our ability to raise additional capital when needed on acceptable terms, if at all.

A weak or declining economy or political disruption, including any international trade disputes, could also strain our manufacturers or suppliers, possibly resulting in supply disruption, or cause our customers to delay making payments for our potential products.

18 unchanged sentences

We cannot predict the impact that the high market volatility and instability of the banking sector more broadly could have on economic activity and our business in particular.

In addition, there is a risk that one or more of our current service providers, manufacturers or other third parties with which we conduct business may not survive difficult economic times, including the current global situation resulting from the COVID-19 pandemic, the ongoing conflict between Russia and Ukraine, the war between Israel and Hamas, the instability of the banking sector, and the uncertainty associated with current worldwide economic conditions, which could directly affect our ability to attain our operating goals on schedule and on budget.

In addition, there is a risk that one or more of our current service providers, manufacturers or other third parties with which we conduct business may not survive difficult economic times, including the ongoing conflict between Russia and Ukraine, the war between Israel and Hamas, the instability of the banking sector, and the uncertainty associated with current worldwide economic conditions, which could directly affect our ability to attain our operating goals on schedule and on budget.

Climate change or legal, regulatory or market measures to address climate change may negatively affect our business, results of operations, cash flows and prospects.

75 unchanged sentences

We do not know whether any preclinical tests or clinical trials will begin as planned, will need to be restructured or will be completed on schedule, or at all.

Significant preclinical study or clinical trial delays also could shorten any periods during which we may have the exclusive right to commercialize our product candidates or allow our competitors to bring products to market before we do and impair our ability to successfully commercialize our product candidates and may harm our business and results of operations.

Significant preclinical or clinical trial delays also could shorten any periods during which we may have the exclusive right to commercialize our product candidates or allow our competitors to bring products to market before we do and impair our ability to successfully commercialize our product candidates and may harm our business and results of operations.

If we experience delays or difficulties in the enrollment of patients in our clinical trials, our receipt of necessary marketing approvals could be delayed or prevented.

31 unchanged sentences

Any regulatory approvals that we receive for our product candidates may also be subject to limitations on the approved uses for which the product may be marketed.

Other ongoing regulatory requirements include, among other things, submissions of safety and other post-marketing information and reports, registration and listing, as well as continued maintenance of our marketing application, compliance with cGMP requirements and quality oversight, compliance with post-marketing commitments, and compliance with GCP for any clinical trials that we conduct post-approval.

Other ongoing regulatory requirements include, among other things, submissions of safety and other post-marketing information and reports, registration and listing, as well as continued maintenance of our marketing application, compliance with cGMP requirements and quality oversight, compliance with post-marketing commitments, and compliance with good clinical practice (“GCP”) for any clinical trials that we conduct post-approval.

Failure to comply with these requirements could result in warning or untitled letters, criminal or civil penalties, recalls, or product withdrawals.

2 unchanged sentences

The FDA also has the authority to require a REMS plan after approval, which may impose further requirements or restrictions on the distribution or use of an approved drug.

We, our CMOs, and the manufacturing facilities we use to make our product candidates will also be subject to ongoing assessment of product quality, compliance with cGMP, and periodic inspection by the FDA and potentially other regulatory agencies.

We or our contract manufacturing organizations (“CMOs”), and the manufacturing facilities we use to make our product candidates will also be subject to ongoing assessment of product quality, compliance with cGMP, and periodic inspection by the FDA and potentially other regulatory agencies.

We or our CMOs may not be able to comply with applicable cGMP regulations or similar regulatory requirements outside of the United States.

10 unchanged sentences

Our ability to compete may also be affected in many cases by insurers or other third-party payors seeking to encourage the use of generic products.

The Hatch-Waxman Amendments to the FDCA authorized the FDA to approve generic drugs that are the same as drugs previously approved for marketing under the NDA provisions of the statute pursuant to ANDAs, and also created the Section 505(b)(2) NDA pathway.

An ANDA relies on the preclinical and clinical testing conducted for a previously approved reference listed drug and must demonstrate to the FDA that the generic drug product is identical to the RLD with respect to the active ingredients, the route of administration, the dosage form, and the strength of the drug and also that it is “bioequivalent” to the reference listed drug.

The Hatch-Waxman Amendments to the federal Food, Drug, and Cosmetic Act (“FDCA”) authorized the FDA to approve generic drugs that are the same as drugs previously approved for marketing under the NDA provisions of the statute pursuant to abbreviated new drug applications (“ANDAs”), and also created the Section 505(b)(2) NDA pathway.

An ANDA relies on the preclinical and clinical testing conducted for a previously approved reference listed drug and must demonstrate to the FDA that the generic drug product is identical to the reference listed drug (“RLD”) with respect to the active ingredients, the route of administration, the dosage form, and the strength of the drug and also that it is “bioequivalent” to the reference listed drug.

In contrast, Section 505(b)(2) enables the applicant to rely, in part, on the FDA’s prior findings of safety and efficacy data for an existing product, or published literature, in support of its application.

39 unchanged sentences

government agencies, the manufacturer must extend discounts to entities eligible to participate in the 340B Drug Pricing Program.

The maximum amount that a manufacturer may charge a 340B covered entity for a given product is the average manufacturer price (“AMP”), reduced by the rebate amount paid by the manufacturer to Medicaid for each unit of that product.

The maximum amount that a manufacturer may charge a 340B covered entity for a given

product is the average manufacturer price (“AMP”), reduced by the rebate amount paid by the manufacturer to Medicaid for each unit of that product.

As of 2010, the ACA expanded the types of entities eligible to receive discounted 340B pricing, although, under the current state of the law, with the exception of children’s hospitals, these newly eligible entities will not be eligible to receive discounted 340B pricing on orphan drugs.

In addition, as 340B drug pricing is

determined based on AMP and Medicaid rebate data, the revisions to the Medicaid rebate formula and AMP definition described above could cause the required 340B discount to increase.

In addition, as 340B drug pricing is determined based on AMP and Medicaid rebate data, the revisions to the Medicaid rebate formula and AMP definition described above could cause the required 340B discount to increase.

Moreover, there has been heightened governmental scrutiny over the manner in which manufacturers set prices for their marketed products, which has resulted in several Congressional inquiries and proposed and enacted federal and state legislation designed to, among other things, bring more transparency to product pricing, review the relationship between pricing and manufacturer patient programs, and reform government program reimbursement methodologies for drug products.

For example, the 2021 Consolidated Appropriations Act signed into law on December 27, 2020 incorporated extensive healthcare provisions and amendments to existing laws, including a requirement that all manufacturers of drug products covered under Medicare Part B report the product’s average sales price to CMS beginning on January 1, 2022, subject to enforcement via civil money penalties.

For example, the 2021 Consolidated Appropriations Act signed into law on December 27, 2020 incorporated extensive healthcare provisions and amendments to existing laws, including a requirement that all manufacturers of drug products covered under Medicare Part B report the product’s average sales price to the Centers for Medicare and Medicaid Services (“CMS”) beginning on January 1, 2022, subject to enforcement via civil money penalties.

Department of Health and Human Services (“DHHS”) has also solicited feedback on various measures intended to lower drug prices and reduce the out-of-pocket costs of drugs and has implemented others under its existing authority.

In August 2022, President Biden signed into the law the Inflation Reduction Act of 2022 (the “IRA”).

In August 2022, the Inflation Reduction Act of 2022 (the “IRA”) was signed into law.

The IRA has multiple provisions that may impact the prices of drug products that are both sold into the Medicare program and throughout the United States.

19 unchanged sentences

Changes to the Medicaid program at the federal or state level could also have a material adverse effect on our business.

Proposals that could impact coverage and reimbursement of our products, including giving states more flexibility to manage drugs covered under the Medicaid program and permitting the re-importation of prescription medications from Canada or other countries, could have a material adverse effect by limiting our products’ use and coverage.

Proposals that could impact coverage and reimbursement of our products, including giving states more

flexibility to manage drugs covered under the Medicaid program and permitting the re-importation of prescription medications from Canada or other countries, could have a material adverse effect by limiting our products’ use and coverage.

Furthermore, state Medicaid programs could request additional supplemental rebates on our products as a result of an increase in the federal base Medicaid rebate.

To the extent that private insurers or managed care programs follow Medicaid coverage and payment developments, they could use the enactment of these increased rebates to exert

pricing pressure on our products, and the adverse effects may be magnified by their adoption of lower payment schedules.

To the extent that private insurers or managed care programs follow Medicaid coverage and payment developments, they could use the enactment of these increased rebates to exert pricing pressure on our products, and the adverse effects may be magnified by their adoption of lower payment schedules.

Other proposed regulatory actions affecting manufacturers could have a material adverse effect on our business.

26 unchanged sentences

Furthermore, the raw materials for our product candidates are sourced, in some cases, from a single-source supplier although other sources are available.

For example, drug

substance and drug product are sourced from our principal supplier, Piramal Pharma Solutions, in Ennore, India and Ahmedabad, India, respectively.

For example, drug substance and drug product are sourced from our principal supplier, Piramal Pharma Solutions, in Ennore, India and Ahmedabad, India, respectively.

Chemical raw materials used for drug substance manufacture are sourced locally in India and are generally available.

19 unchanged sentences

In addition, we do not have control over the ability of our contract manufacturers to maintain adequate quality control, quality assurance and qualified personnel.

If the FDA, EMA or a comparable foreign regulatory authority does not approve these facilities for the manufacture of our product candidates or if it withdraws any such approval in the future, we may need to find alternative manufacturing facilities, which would significantly impact our ability to develop, obtain marketing approval for or market our product candidates, if approved.

candidates, if approved.

Our failure, or the failure of our third-party manufacturers, to comply with applicable regulations could subject us and our third-party manufacturers to warning letters or other enforcement-related letters, holds on clinical trials or could result in further sanctions being imposed on us or our third-party manufacturers, including fines, injunctions, civil penalties, delays, suspension or withdrawal of approvals, license revocation, seizures or recalls of product candidates or drugs, operating restrictions and criminal prosecutions, any of which could significantly and adversely affect supplies of our product candidates or drugs and harm our business and results of operations.

18 unchanged sentences

Moreover, our ability to commercialize our product candidates will depend in part on the extent to which appropriate reimbursement levels for the cost of such products and related treatments are obtained by governmental authorities, private health insurers and other organizations, such as HMOs.

Consumers and third-party payers are increasingly challenging the prices charged for medical drugs and services.

Consumers and third-party payers are

increasingly challenging the prices charged for medical drugs and services.

Also, the trend toward managed healthcare in the U.S.

11 unchanged sentences

● the Federal Food, Drug, and Cosmetic Act, which, among other things, strictly regulates drug product marketing, prohibits manufacturers from marketing drug products for off-label use and regulates the distribution of drug samples;

● state and foreign law equivalents of each of the above federal laws, such as anti-kickback and false claims laws, which may apply to sales or marketing arrangements and claims involving healthcare items or services reimbursed by non-governmental third-party payors, including private insurers, state laws requiring pharmaceutical companies to comply with the pharmaceutical industry’s voluntary compliance guidelines and the relevant compliance guidance promulgated by the federal government and which may require drug manufacturers to report information related to payments and other transfers of value to physicians and other healthcare providers or marketing expenditures, and state and foreign laws governing the privacy and security of health information in specified circumstances, many of which differ from each other in significant ways and often are not preempted by federal laws such as HIPAA, thus complicating compliance efforts.

the relevant compliance guidance promulgated by the federal government and which may require drug manufacturers to report information related to payments and other transfers of value to physicians and other healthcare providers or marketing expenditures, and state and foreign laws governing the privacy and security of health information in specified circumstances, many of which differ from each other in significant ways and often are not preempted by federal laws such as HIPAA, thus complicating compliance efforts.

Efforts to ensure that our business arrangements with third parties will comply with applicable healthcare laws and regulations will involve substantial costs.

22 unchanged sentences

A court may also issue an injunction against us preventing us from manufacturing and bringing our products to market.

In addition, there could be public announcements of the results of hearings, motions or other interim proceedings or developments and if securities analysts or investors perceive these results to be negative, it could have a substantial adverse effect on the price of our common stock.

In addition, there could be public announcements of the results of hearings, motions or other interim proceedings or developments and if securities analysts or investors perceive these

results to be negative, it could have a substantial adverse effect on the price of our common stock.

Such litigation or proceedings could substantially increase our operating losses and reduce the resources available for development activities or any future sales, marketing or distribution activities.

1 unchanged sentence

Some of our competitors may be able to sustain the costs of such litigation or proceedings more effectively than we can because of their greater financial resources.

Uncertainties

resulting from the initiation and continuation of patent litigation or other proceedings could compromise our ability to compete in the marketplace.

Uncertainties resulting from the initiation and continuation of patent litigation or other proceedings could compromise our ability to compete in the marketplace.

We may need to license certain intellectual property from third parties, and such licenses may not be available or may not be available on commercially reasonable terms.

23 unchanged sentences

In addition to seeking patents for some of our technology and products, we will also rely on trade secrets, including unpatented know-how, technology and other proprietary and confidential information, to maintain our competitive position.

We will seek to protect these trade secrets, in part, by entering into non-disclosure and confidentiality agreements with parties who have access to them, such as our employees, corporate collaborators, outside scientific collaborators, contract manufacturers, consultants, advisors and other third parties.

We will seek to protect these trade secrets, in part, by entering into non-disclosure and confidentiality

agreements with parties who have access to them, such as our employees, corporate collaborators, outside scientific collaborators, contract manufacturers, consultants, advisors and other third parties.

However, we cannot guarantee that we will have executed these agreements with each party that may have or have had access to our trade secrets or that the agreements we do execute will provide adequate protection.

Any party with whom we have executed such an agreement could breach that agreement and disclose our proprietary or confidential information, including our trade secrets, and we

may not be able to obtain adequate remedies for such breaches.

Any party with whom we have executed such an agreement could breach that agreement and disclose our proprietary or confidential information, including our trade secrets, and we may not be able to obtain adequate remedies for such breaches.

Enforcing a claim that a party illegally disclosed or misappropriated a trade secret is difficult, expensive and time-consuming, and the outcome is unpredictable.

22 unchanged sentences

For as long as we continue to be an emerging growth company, we intend to take advantage of exemptions from various reporting requirements that are applicable to other public companies that are not emerging growth companies, including:

● being permitted to provide only two years of audited financial statements, in addition to any required unaudited interim financial statements, with correspondingly reduced “Management’s Discussion and Analysis of Financial Condition and Results of Operations” disclosure in this Form 10-K;

● being permitted to provide only two years of audited financial statements, in addition to any required unaudited interim condensed financial statements, with correspondingly reduced “Management’s Discussion and Analysis of Financial Condition and Results of Operations” disclosure in this Form 10-K;

● not being required to comply with the auditor attestation requirements of Section 404 of the Sarbanes-Oxley Act;

40 unchanged sentences

● significant lawsuits, including patent or stockholder litigation;

● general political and economic conditions, many of which are beyond our control, such as military conflicts between Russia and Ukraine or Israel and Hamas, and

● general political, economic and market conditions, many of which are beyond our control, such as military conflict between Russia and Ukraine as well as the conflict in the Middle East between Israel and Hamas;

● other events or factors, many of which are beyond our control.

14 unchanged sentences

Nasdaq may delist our securities from trading on its exchange, which could limit investors’ ability to make transactions in our securities and subject us to additional trading restrictions.

Should we fail to satisfy the Nasdaq’s continued listing requirements, such as the corporate governance requirements or the minimum closing bid price requirement, Nasdaq may take steps to delist our common stock.

On February 24, 2025, we received a letter from The Nasdaq Stock Market (“Nasdaq”) notifying us that for the preceding 31 consecutive business days our common stock did not maintain a minimum closing bid price of $1.00 per share as required by Nasdaq Listing Rule 5550(a)(2) (the “Minimum Bid Price Requirement”).

In accordance with Nasdaq Listing Rule 5810(c)(3)(A), we have a grace period of 180 calendar days, or until August 25, 2025, to regain compliance with Nasdaq Listing Rule 5550(a)(2).

Compliance can be achieved automatically and without further action if the closing bid price of our common stock is at or above $1.00 for a minimum of 10 consecutive business days at any time during the 180-day compliance period, in which case Nasdaq will notify us of our compliance and the matter will be closed.

If, however, we do not achieve compliance with the Minimum Bid Price Requirement by August 25, 2025, we may be eligible for additional time to comply.

In order to be eligible for such additional time, we will be required to meet the continued listing requirement for market value of publicly held shares and all other initial listing standards for The Nasdaq Capital Market, with the exception of the Minimum Bid Price Requirement, and must notify Nasdaq in writing of our intention to cure the deficiency during the second compliance period, by effecting a reverse stock split, if necessary.

However, if it appears to Nasdaq that we will not be able to cure the deficiency, or if we are otherwise not eligible, Nasdaq will provide notice that our common stock will be subject to delisting.

We would then be entitled to appeal that determination to a Nasdaq hearings panel.

Should we fail to satisfy additional continued listing requirements, such as the corporate governance requirements or the Minimum Bid Price Requirement, Nasdaq may take steps to delist our common stock.

Such a delisting would likely have a negative effect on the price of our common stock, and would impair your ability to sell or purchase our common stock when you wish to do so.

10 unchanged sentences

Compliance with these rules and regulations has increased, and will likely continue to increase our legal and financial compliance costs, make some activities more difficult, time-consuming or costly, and place significant strain on our personnel, systems and resources.

In addition, changing laws, regulations and standards relating to corporate governance

and public disclosure are creating uncertainty for public companies, increasing legal and financial compliance costs and making some activities more time consuming.

In addition, changing laws, regulations and standards relating to corporate governance and public disclosure are creating uncertainty for public companies, increasing legal and financial compliance costs and making some activities more time consuming.

These laws, regulations and standards are subject to varying interpretations, in many cases due to their lack of specificity, and, as a result, their application in practice may evolve over time.

12 unchanged sentences

We cannot assure you that our data protection efforts will prevent significant breakdowns, data leakages, breaches in our systems, or those of our third-party vendors and other contractors and consultants, or other cyber incidents that could have a material adverse effect upon our reputation, business, operations, or financial condition.

For example, if such an event were to occur and cause interruptions in our operations, or those of our third-party vendors and other contractors and consultants, it could result in a material disruption of our programs and the development of our services and technologies could be delayed.

For example, if such an

event were to occur and cause interruptions in our operations, or those of our third-party vendors and other contractors and consultants, it could result in a material disruption of our programs and the development of our services and technologies could be delayed.

Furthermore, significant disruptions of our internal information technology systems or those of our third-party vendors and other contractors and consultants, or security breaches could result in the loss, misappropriation, and/or unauthorized access, use, or disclosure of, or the prevention of access to, confidential information (including trade secrets or other intellectual property, proprietary business information, and personal information), which could result in financial, legal, business, and reputational harm to us.

19 unchanged sentences

Further, as regulatory focus on privacy issues continues to increase and laws and regulations concerning the protection of personal information expand and become more complex, these potential risks to our business could intensify.

Changes in laws or regulations associated with the enhanced protection of certain types of sensitive data, for the treatment of genetic data, along with increased customer demands for enhanced data security infrastructure, could greatly increase our cost of providing our products, decrease demand for our products, reduce our revenues and/or subject us to additional liabilities.

Changes in laws or regulations associated with the enhanced protection of certain types of sensitive data, for the treatment of genetic data,

along with increased customer demands for enhanced data security infrastructure, could greatly increase our cost of providing our products, decrease demand for our products, reduce our revenues and/or subject us to additional liabilities.

We may fail to comply with evolving privacy and data protection laws, which could adversely affect our business, results of operations and financial condition.

In California, the California Consumer Privacy Act (“CCPA”), which became effective in 2020, broadly defines personal information, gives California residents expanded individual privacy rights and protections and provides for civil penalties for violations and a private right of action for data breaches.

Further, the California Privacy Rights Act (the “CPRA”), which became effective in 2023 and amends the CCPA, creates additional obligations with respect to processing and storing personal information.

We will continue to monitor developments related to the CCPA and anticipate additional costs and expenses associated with CPRA compliance.

While there is an exception for protected health information that is subject to HIPAA and clinical trial regulations, the CCPA may impact our business activities if we become a “Business” regulated by the CCPA.

Unlike other state privacy laws, the CCPA also regulates personal information collected in a business to business and in human resources contexts.

Further, there continues to be some uncertainly about how certain provisions of the CCPA will be interpreted and how the law will be enforced.

In addition to the CCPA, broad consumer privacy laws recently went into effect in Virginia on January 1, 2023, in Colorado and Connecticut on July 1, 2023, and in Utah on December 31, 2023.

New privacy laws will also become effective in Florida, Montana and Texas in 2024, in Tennessee and Iowa in 2025, and in Indiana in 2026 and numerous

other states are considering new privacy laws.

Furthermore, other U.S.

states, such as New York, Massachusetts, and Utah have enacted stringent data security laws and numerous other states have proposed similar privacy laws.

New privacy and data security laws have been proposed in more than half of the states in the U.S.

1 unchanged sentence

Congress, reflecting a trend toward more stringent privacy legislation in the U.S., which trend may accelerate with increasing concerns about individual privacy.

The existence of comprehensive privacy laws in different states in the country will make our compliance obligations more complex and costly and may require us to modify our data processing practices and policies and to incur substantial costs and potential liability in an effort to comply with such legislation.

In the EU and the U.K., we may also face particular privacy, data security, and data protection risks in connection with requirements of EU’s General Data Protection Regulation (“GDPR”), the GDPR as it existed on December 31, 2020 but subject to certain U.K.

specific amendments incorporated into U.K.

law on January 1, 2021 under the U.K.

GDPR and other data protection requirements.

The GDPR applies to any company established in the EU as well as to those outside the EU if they collect and use personal data in connection with the offering of goods or services to individuals in the EU or the monitoring of their behavior.

We currently conduct clinical trials and engage in regulatory and commercial operations in the European Economic Area (the “EEA”), and the U.K.

As a result, we are subject to additional privacy laws, including the GDPR and U.K.

GDPR, collectively referred to as GDPR.

The GDPR imposes a broad range of data protection obligations on companies subject to the GDPR, including, for example, imposing obligations on companies around how they process personal data, stricter requirements relating to processing health and other sensitive data, ensuring there is a legal basis to justify the processing of personal data, stricter requirements relating to obtaining consent of individuals, expanded disclosures about how personal information is to be used, limitations on retention of information, mandatory data breach notification requirements, implementing safeguards to protect the security and confidentiality of personal data, taking certain measures on engagement with third parties, restrictions on transfers outside of the EU to third countries deemed to lack adequate privacy protections (such as the U.S.), and has created onerous new obligations and liabilities on services providers or data processors.

Non-compliance with the GDPR may result in monetary penalties of up to €20 million or 4% of worldwide revenue, whichever is higher.

The existence of comprehensive privacy laws in different states in the U.S.

may make our compliance obligations more complex and costly, may require us to modify our data processing practices and policies, and may require us to incur substantial costs and potential liability in an effort to comply.

In California, the California Consumer Privacy Act (“CCPA”), which became effective in 2020, broadly defines personal information, gives California residents expanded individual privacy rights and protections, provides for civil penalties for violations and gives California residents a private right of action for data breaches in certain cases.

Further, the California Privacy Rights Act (“CPRA”), which became effective in 2023 and amends the CCPA, imposes additional obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data.

It also created a new California Privacy Protection Agency authorized to issue substantive regulations and is expected to result in increased privacy and information security enforcement.

The CPRA also extends the provisions of both the CCPA and the CPRA to the personal information of California-based employees.

While there is an exception for certain health information, including protected health information that is subject to HIPAA, and clinical trial data, the CCPA may impact our business activities if we become a “Business” regulated by the CCPA.

Further, there continues to be some uncertainly about how certain provisions of the CCPA will be interpreted and how some areas of the law will be enforced .

We will continue to monitor developments related to the CCPA and anticipate additional costs and expenses associated with compliance.

In addition to the CCPA, broad consumer privacy laws recently went into effect in Virginia on January 1, 2023, in Colorado and Connecticut on July 1, 2023, and in Utah on December 31, 2023.

New privacy laws will also become effective in Florida, Montana, Oregon and Texas in 2024, in Delaware, Iowa, New Hampshire, New Jersey, and Tennessee in 2025, and in Indiana in 2026.

In addition, numerous other states are considering new comprehensive privacy laws.

states, such as New York and Massachusetts have enacted stringent data security laws and numerous other states have proposed similar laws.

Additionally, various states, such as California and Massachusetts, have implemented similar privacy laws and regulations, such as the California Confidentiality of Medical Information Act, that impose restrictive requirements regulating the use and disclosure of health information and other personally identifiable information.

These laws and regulations are not necessarily preempted by HIPAA, particularly if a state affords greater protection to individuals than HIPAA.

Where state laws are more protective, we have to comply with the stricter provisions.

In addition to fines and penalties imposed upon violators, some of these state laws also afford private rights of action to individuals who believe their personal information has been misused.

California’s patient privacy laws, for example, provide for penalties of up to $250,000 and permit injured parties to sue for damages.

Similarly, as discussed above, the CCPA allows consumers a private right of action when certain personal information is subject to unauthorized access and exfiltration, theft or disclosure due to a business’ failure to implement and maintain reasonable security procedures.

Furthermore, over the past few years, the number of privacy-related enforcement actions in the U.S., and in many cases the fines, have steadily increased.

Failure to comply with these current and future laws, policies, industry standards, or legal obligations.

or any data breach involving personal information, may result in government enforcement actions, litigation, fines, and penalties, private litigation, or adverse publicity, and could cause our customers, business partners, and investors to lose trust in us which could have a material adverse impact on our business, results of our operations, and our financial condition.

We continue to face uncertainty as to the exact interpretation of the new requirements on our clinical trials and we may be unsuccessful in implementing all measures required by data protection authorities or courts in interpretation of the new law.

The interplay of federal and state laws may be subject to varying interpretations by courts and government agencies, creating complex compliance issues for us and data we receive, use and share, potentially exposing us to additional expense, adverse publicity and liability.

In the European Union (“EU”) and the United Kingdom (“UK”), we may face particular privacy, data security, and data protection risks in connection with requirements of EU’s General Data Protection Regulation (“GDPR”), the GDPR as it existed on December 31, 2020 but subject to certain UK specific amendments incorporated into UK law on January 1, 2021 under the UK GDPR and other data protection requirements.

The regulatory framework for collecting, using, safeguarding, sharing, transferring and other processing of information worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future.

The withdrawal of the UK from the EU and the subsequent separation of the data protection regimes of these territories means we are required to comply with separate data protection laws in the EU and the UK, which may lead to additional compliance costs and could increase our overall risk.

Similar laws and regulations govern our processing of personal data, including the collection, access, use, analysis, modification, storage, transfer, security breach notification, destruction and disposal of personal data.

For example, the collection, use, disclosure, transfer, or other processing of personal data regarding individuals in the EU, including personal health data, is subject to the GDPR, which took effect across all Member States of the European Economic Area (“EEA”) on May 25, 2018, and as still in effect in the UK as the “UK GDPR”.

On June 28, 2021, the EU Commission adopted decisions on the UK’s adequacy under the EU GDPR, and the UK continues to operate under this adequacy decision.

The GDPR applies to any company established in the EU as well as to those outside the EU that process personal data in connection with the offering of goods or services to individuals in the EU or the monitoring of their behavior.

The GDPR imposes a broad range of data protection obligations on controllers and/or processors, as applicable, that must be complied with when processing personal data subject to the GDPR, including, for example, providing expanded disclosures about how their personal data will be used;

higher standards for organizations to demonstrate that they have obtained valid consent or have another legal basis in place to justify their data processing activities;

the obligation to appoint data protection officers in certain circumstances;

new rights for individuals to be “forgotten” and rights to data portability, as well as enhanced current rights (e.g., access requests);

the principal of accountability and demonstrating compliance through policies, procedures, training and audit;

limitations on retention of information;

mandatory data breach notification requirements;

safeguards to protect the security and confidentiality of personal data;

restrictions on transfers of personal data outside of the EU to third countries deemed to lack adequate privacy protections (such as the U.S.), and onerous new obligations and liabilities on services providers or data processors.

In particular, medical or health data, genetic data and biometric data are all classified as “special category” data under the GDPR and afford greater protection and require additional compliance obligations.

Further, the UK and EU member states have a broad right to impose additional conditions—including restrictions—on these data categories.

This is because the GDPR allows EU member states to derogate from the requirements of the GDPR mainly in regard to specific processing situations (including special category data and processing for scientific or statistical purposes).

Non-compliance with the GDPR may result in monetary penalties of up to €20 million or 4% of worldwide revenue, whichever is greater.

Moreover, data subjects can claim damages resulting from infringement of the GDPR.

The GDPR further grants non-profit organizations the right to bring claims on behalf of data subjects.

The GDPR further grants non-profit organizations and consumer organizations the right to bring claims on behalf of data subjects.

The GDPR and other changes in laws or regulations associated with the enhanced protection of certain types of personal data, such as healthcare data or other sensitive information, could greatly increase our cost of providing our products and services or even prevent us from offering certain services in jurisdictions that we may operate in.

The GDPR may increase our responsibility and liability in relation to personal data that we process where such processing is subject to the GDPR, and we may be required to put in place additional mechanisms to ensure compliance with the GDPR, including as implemented by individual countries.

Compliance with the GDPR will be a rigorous and time-intensive process that may increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation, and reputational harm in connection with our European activities.

In addition, further to the U.K.’s exit from the EU on January 31, 2020, the GDPR ceased to apply in the U.K.

at the end of the transition period on December 31, 2020.

However, as of January 1, 2021, the U.K.’s European Union (Withdrawal) Act 2018 incorporated the U.K.

GDPR into U.K.

GDPR and the U.K.

Data Protection Act 2018 set out the U.K.’s data protection regime, which is independent from but, currently, aligned to the EU’s data protection regime.

Non-compliance with the U.K.

GDPR may result in monetary penalties of up to £17.5 million or 4% of worldwide revenue, whichever is higher.

In addition, on June 28, 2021, the EC adopted an adequacy decision in respect of transfers of personal data to the U.K.

for a four-year period (until June 27, 2025).

Similarly, the U.K.

has determined that it considers all of the EEA to be adequate for the purposes of data protection.

This ensures that data flows between the U.K.

and the EEA remain unaffected.

Government has also now introduced a Data Protection and Digital Information Bill (or the UK Bill) into the UK legislative process with the intention for this bill to reform the U.K.’s data protection regime following Brexit.

If passed, the final version of the U.K.

Bill may have the effect of further altering the similarities between the U.K.

and EU data protection regime and threaten the U.K.

Adequacy Decision from the EU Commission.

This may lead to additional compliance costs and could increase our overall risk.

Over the past few years, the number of enforcement actions and the fines have both steadily increased.

data privacy laws, such as the CCPA, and others that may be passed, similarly introduce requirements with respect to personal information, and non-compliance with the CCPA may result in liability through private actions (subject to defined statutory damages in the event of certain data breaches) and enforcement.

Failure to comply with these current and future laws, policies, industry standards, or legal obligations or any security incident resulting in the unauthorized access to, corruption of, or acquisition, release, or transfer of personal information may result in government enforcement actions, litigation, fines, and penalties, or adverse publicity and could cause our customers, business partners, and investors to lose trust in us which could have a material adverse impact on our business and results of our operations.

We continue to face uncertainty as to the exact interpretation of the new requirements on our trials and we may be unsuccessful in implementing all measures required by data protection authorities or courts in interpretation of the new law.

In particular, member states of the EEA, or the Member States, have implemented national laws which may partially deviate from the GDPR and impose different and more restrictive obligations from country to country, so that we do not expect to operate in a uniform legal landscape in the EU.

Also, as it relates to processing and transfer of genetic data, the GDPR specifically allows the Member States to enact laws that impose additional and more specific requirements or restrictions, and European laws have historically differed quite substantially in this field, leading to additional uncertainty.

In addition, we must also ensure that we maintain adequate safeguards to enable the transfer of personal data outside of the EEA or the U.K., in particular to the U.S., in compliance with EEA and U.K.

data protection laws.

We expect that we will continue to face uncertainty as to whether our efforts to comply with our obligations under European privacy laws will be sufficient.

In some cases, we rely upon the recently updated standard contractual clauses (new standard contractual clauses) to legitimize transfers of personal data out of the EEA from controllers or processors established outside the EEA (and not subject to the GDPR).

Transition to the new standard contractual clauses requires significant effort and cost particularly given the burdensome requirements of transfer impact assessments and the substantial obligations that the new standard contractual clauses impose upon exporters.

is not subject to the EC's new standard contractual clauses but has published its own transfer mechanism, the International Data Transfer Agreement, which enables transfers from the U.K.

On June 28, 2021, the EC announced a decision of “adequacy” concluding that the U.K.

ensures an equivalent level of data protection to the GDPR, which provides some relief regarding the legality of continued personal data flows from the EEA to the U.K.

Some uncertainty remains, however, as this adequacy determination must be renewed after four years and may be modified or revoked in the interim.

Government has confirmed that transfers from the U.K.

to the EEA may currently continue to flow freely.

Changes with respect to any of these matters may lead to additional costs and increase our overall risk exposure.

The EU and U.S.

have adopted its adequacy decision for the EU U.S.

Data Privacy Framework (the “Framework"), which enters into force on July 11, 2023.

This Framework provides that the protection of personal data transferred between the EU and the U.S.

is comparable to that offered in the EU.

This provides a further avenue to ensuring transfers to the US are carried out in line with GDPR.

The Framework could be challenged like its predecessor frameworks.

If we are investigated by a European data protection authority, we may face fines and other penalties.

Any such investigation or charges by European data protection authorities could have a negative effect on our existing business and on our ability to attract and retain new clients or pharmaceutical partners.

We may also experience hesitancy, reluctance, or refusal by European or multi-national clients or pharmaceutical partners to continue to use our products due to the potential risk exposure because of the current (and future) data protection obligations imposed on them by certain data protection authorities in interpretation of current law, including the GDPR.

Compliance with the GDPR is a rigorous and time-intensive process that may increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation, and reputational harm in connection with any activities in the EU.

Further, as referenced above, following the UK’s withdrawal from the EU (i.e., Brexit), and the expiry of the Brexit transition period, which ended on December 31, 2020, the EU GDPR has been implemented in the UK (as the UK

The UK GDPR sits alongside the UK Data Protection Act 2018 which implements certain derogations in the EU GDPR into UK law.

Under the UK GDPR, companies not established in the UK but who process personal data in relation to the offering of goods or services to individuals in the UK, or to monitor their behavior will be subject to the UK GDPR – the requirements of which are (at this time) largely aligned with those under the EU GDPR and as such, may lead to similar compliance and operational costs.

Non-compliance with the UK GDPR may result in monetary penalties of up to £17.5 million or 4% of worldwide revenue, whichever is higher.

In addition, we may be unable to transfer personal data from the EU, UK, and other jurisdictions to U.S.

or other countries due to limitations on cross-border data flows.

In particular, the EEA and the UK have significantly regulated the transfer of personal data to the U.S.

and other countries whose privacy laws it believes are inadequate.

Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws.

Although there are currently various mechanisms that may be used to transfer personal data from the EEA and the UK to the U.S.

in compliance with law, such as the EEA and UK’s standard contractual clauses and the newly- adopted Data Privacy Framework, these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the U.S.

If there is no lawful manner for us to transfer personal data from the EEA, the UK or other jurisdictions to the U.S., or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business.

Additionally, companies that transfer personal data out of the EEA and the UK to other jurisdictions, particularly to the U.S., are subject to increased scrutiny from regulators, individual litigants, and activist groups.

If we are investigated by an EEA or UK data protection authority, we may face fines and other penalties, which could have a negative effect on our existing business and on our ability to attract and retain new clients or pharmaceutical partners.

We may also experience hesitancy, reluctance, or refusal by EEA, UK, or multi-national clients or pharmaceutical partners to continue to use our products due to the potential risk exposure because of the current (and future) data protection obligations imposed on them by certain data protection authorities in interpretation of current law, including the GDPR and UK GDPR.

Such clients or pharmaceutical partners may also view any alternative approaches to compliance as being too costly, too burdensome, too legally uncertain, or otherwise objectionable and therefore decide not to do business with us.

Any of the foregoing could materially harm our business, prospects, financial condition, and results of operations.

In addition, many jurisdictions outside of Europe are also considering and/or enacting comprehensive data protection legislation.

In addition, many jurisdictions outside of the EEA and the UK are also considering and/or enacting comprehensive data protection legislation.

For example, as of August 2020, the Brazilian General Data Protection Law imposes stringent requirements similar to GDPR with respect to personal information collected from individuals in Brazil.

In China, there have also been recent significant developments concerning privacy and data security.

The Data Security Law of the People’s Republic of China (“Data Security Law”), which took effect on September 1, 2021, requires data processing (which includes the collection, storage, use, processing, transmission, provision and publication of data), to be conducted in a legitimate and proper manner.

The Data Security Law imposes data security and privacy obligations on entities and individuals carrying out data processing activities and also introduces a data classification and hierarchical protection system based on the importance of data in economic and social development and the degree of harm it may cause to national security, public interests, or legitimate rights and interests of individuals or organizations if such data are tampered with, destroyed, leaked, illegally acquired or illegally used.

The appropriate level of protection measures is required to be taken for each respective category of data.

Also in China, the Personal Information Protection Law, which took effect on November 1, 2021, introduced stringent protection requirements for processing personal information, which are in many ways akin to the requirements of the GDPR.

We may be required to make further significant adjustments to our business practices to comply with the personal information protection laws and regulations in China including the Personal Information Protection Law.

We also continue to see jurisdictions imposing data localization laws.

These regulations may interfere with our intended business activities, inhibit our ability to expand into those markets or prohibit us from continuing to offer services in those markets without significant additional costs.

Because the interpretation and application of many privacy and data protection laws (including the GDPR), commercial frameworks, and standards are uncertain, it is possible that these laws, frameworks, and standards may be interpreted and applied in a manner that is inconsistent with our existing data management practices and policies.

If so, in addition to the possibility of fines, lawsuits, breach of contract claims, and other claims and penalties, we could be required to fundamentally change our business activities and practices or modify our solutions, which could have an adverse effect on our business.

Any inability to adequately address privacy and security concerns, even if unfounded, or comply with applicable privacy and security or data security laws, regulations, and policies, could result in additional cost and liability to us, damage our reputation, inhibit our ability to conduct trials, and adversely affect our business.

Because the interpretation and application of many domestic and international privacy and data protection laws, commercial frameworks, and standards are uncertain, it is possible that these laws, frameworks, and standards may be interpreted and applied in a manner that is inconsistent with our existing data management practices and policies.

It is also possible that by complying with one law, we may be violating another.

In addition to the possibility of fines, lawsuits, breach of contract claims, and other claims and penalties, we could be required to fundamentally change our business activities and practices or modify our solutions, which could have an adverse effect on our business.

Failure to comply with current and future privacy and data protection laws and regulations could result in government enforcement actions (including the imposition of significant penalties), criminal and civil liability for us and our officers and directors, private litigation and/or adverse publicity that negatively affects our business.

Any inability to adequately respond to privacy and security concerns, even if unfounded, or to comply with applicable privacy and data protection laws, regulations, and policies, could result in additional cost and liability to us, damage our reputation, inhibit our ability to conduct trials, and adversely affect our business.

Our issuance of additional capital stock in connection with potential future financings, acquisitions, investments, our stock incentive plans or otherwise will dilute all other stockholders.

13 unchanged sentences

Such misconduct could also involve the improper use of information obtained during clinical studies that could result in regulatory sanctions and cause serious harm to our reputation.

in protecting us from governmental investigations or other actions or lawsuits stemming from a failure to comply with these laws or regulations.

It is not always possible to identify and deter employee misconduct, and the precautions we take to detect and prevent this activity may not be effective in controlling unknown or unmanaged risks or losses or in protecting us from governmental investigations or other actions or lawsuits stemming from a failure to comply with these laws or regulations.

If any such actions are instituted against us and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business, including the imposition of significant fines or other sanctions.

9 unchanged sentences

The estimates and judgments we make, or the assumptions on which we rely, in preparing our financial statements could prove inaccurate.

Our financial statements have been prepared in accordance with U.S.

Our financial statements have been prepared in accordance with GAAP.

The preparation of these financial statements requires us to make estimates and judgments that affect the reported amounts of our assets, liabilities, revenues and expenses, the amounts of charges accrued by us and related disclosure of contingent assets and liabilities.

40 unchanged sentences

Unless we consent in writing to the selection of an alternative forum, the federal district courts of the U.S.

of America shall, to the fullest extent permitted by applicable law, be the sole and exclusive forum for the resolution of

any complaint asserting a cause of action arising under the Securities Act.

of America shall, to the fullest extent permitted by applicable law, be the sole and exclusive forum for the resolution of any complaint asserting a cause of action arising under the Securities Act.

The choice of forum provision may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or our directors, officers or other employees, which may discourage such lawsuits against us and our directors, officers and other employees.

1 unchanged sentence

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors