What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2026-03-19 compared with 2025-03-20 · 393 added, 218 removed, 703 unchanged (46% of the section changed)

1 unchanged sentence

Our pipeline includes multiple clinical-stage investigational therapies, including:

(1) two helicase-primase inhibitors (HPI) targeting recurrent genital herpes;

(1) two long-acting helicase-primase inhibitors (HPIs) for the treatment of recurrent genital herpes;

(2) an orally bioavailable hepatitis delta virus (HDV) entry inhibitor;

and (3) a highly potent next-generation capsid assembly modulator (CAM) designed to disrupt the replication cycle of hepatitis B virus (HBV) at several key points.

Our pipeline also includes a novel, oral broad-spectrum non-nucleoside polymerase inhibitor (NNPI) targeting transplant-related herpesviruses, which is currently undergoing studies to enable a regulatory filing, and we have additional research programs against multiple antiviral targets.

Our current business strategy focuses on applying our deep research and development expertise in virology to bring next-generation therapeutics to patients in areas of high unmet medical need and significant market opportunities and rapidly advance our portfolio towards near-term clinical readouts:

• Recurrent Genital Herpes (HSV-1, HSV-2) – Advancing two investigational long-acting HPI candidates, (1) ABI-5366 (5366) and (2) ABI-1179 (1179), through on-going Phase 1a/1b clinical studies, with interim Phase 1b results evaluating dosing in participants with recurrent genital herpes for both 5366 and 1179 anticipated in fall 2025.

• HDV – Advancing an orally bioavailable HDV entry inhibitor, ABI-6250 (6250), through an ongoing Phase 1a clinical study, with interim safety, pharmacokinetics (PK) and biomarker data expected in the third quarter of 2025.

• HBV – Advancing our novel next-generation CAM, ABI-4334 (4334), through an ongoing Phase 1b clinical study, with efficacy, safety and PK data expected in the first half of 2025.

• Transplant-Associated Herpesviruses – Advancing ABI-7423 (7423), our oral broad-spectrum NNPI targeting transplant-associated herpesviruses through studies to enable a regulatory filing.

• Research and Discovery – Continue to leverage the expertise of our research team to identify new viral targets and novel compounds to address significant unmet medical needs.

Our pipeline also includes a novel, oral broad-spectrum non-nucleoside polymerase inhibitor (NNPI) for the treatment of transplant-related herpesviruses, which is currently undergoing studies to enable a regulatory filing, and we have additional research programs against multiple antiviral targets.

In December 2025, pursuant to our collaboration (Gilead Collaboration) with Gilead Sciences, Inc.

(Gilead), Gilead exercised its option to license our HPI program for the treatment of recurrent genital herpes, including our long-acting investigational candidates ABI-1179 (1179) and ABI-5366 (5366).

For additional information regarding Gilead’s exercise of its option, see “Collaboration and License Agreement—Gilead Sciences, Inc.—Option Exercise.”

Our current business strategy focuses on applying our deep research and development expertise in virology to discover, develop and advance next-generation therapeutics to patients in areas of high unmet medical need with significant market opportunities to market.

We continue to rapidly advance our portfolio toward near-term clinical readouts, highlighted by the following on-going and future activities by doing the following:

• Recurrent Genital Herpes (HSV-1, HSV-2) – Transitioning our HPI program, including 5366 and 1179 to Gilead and, upon receiving a clinical development plan and budget from Gilead, deciding whether to opt in to the Profit-Share (as defined below under the heading “Collaboration and License Agreement—Gilead Sciences, Inc.—Option Exercise”).

• HDV – Completing Phase 2 preparation activities and studies of ABI-6250 (6250), with Phase 2 initiation expected in the fourth quarter of 2026.

• HBV – Evaluating partnering opportunities for ABI-4334 (4334), for which we have initiated a structured process to find potential partners to further advance the program.

• Transplant-Associated Herpesviruses – Advancing ABI-7272 (7272), our oral broad-spectrum NNPI for the treatment of transplant-associated herpesviruses through nonclinical studies to enable a regulatory filing.

• Research and Discovery – Continuing to leverage our research team's expertise to identify and nominate new viral targets and novel compounds to address significant unmet medical needs.

We have recruited an accomplished leadership team and research and development organization, with a collective team track record of over 15 approved drugs across multiple viral diseases.

Our collaboration with Gilead Sciences, Inc.

(Gilead and the Gilead Collaboration) also brings us an industry-leading partner and brings together the teams’ expertise in virology and provides an established partner for late-stage development and commercialization.

In addition, our collaboration with Gilead also brings us an industry-leading partner and brings together the teams’ expertise in virology and provides an established partner for late-stage development and commercialization.

For additional information regarding the Gilead Collaboration, see “Collaboration and License Agreements—Gilead Sciences, Inc.”

Our Clinical Programs and Regulatory Filing-Enabling Program

Since the beginning of 2024, we have initiated:

(1) both the Phase 1a and Phase 1b portions of a Phase 1a/b study of 5366, long-acting HPI for recurrent genital herpes;

(2) the Phase 1a portion of a Phase 1a/b study of 1179, also a long-acting HPI for recurrent genital herpes;

(3) a Phase 1a study of 6250, an orally bioavailable HDV entry inhibitor;

and (4) a Phase 1b study of 4334, a highly potent, next-generation CAM for chronic HBV infection.

We expect to initiate the Phase 1b portion of the Phase 1a/b study of 1179 in the first half of 2025.

We announced interim results from the Phase 1a portion of the 5366 study in September 2024, interim results from the Phase 1b study of 4334 in December 2024 and interim results from the Phase 1a portion of the 1179 study in February 2025.

In addition, during December 2024, we identified a development candidate, 7423, in our broad-spectrum NNPI program targeting transplant-associated herpesviruses.

2025 was a pivotal year for us, as we reported positive data readouts for 5366, 1179, 4334 and 6250 as follows:

• February 2025:

o 1179 – Positive Phase 1a interim results in the Phase 1a/b study

o 4334 – Positive Phase 1b topline results

• August 2025:

o 5366 – Positive Phase 1b interim results from the weekly dosing cohorts in the Phase 1a/b study

o 6250 – Positive Phase 1a interim results

• December 2025:

o 1179 – Positive Phase 1b interim results in the Phase 1a/b study

o 5366 – Positive Phase 1b interim results from the monthly dosing cohorts in the Phase 1a/b study

In addition, during December 2024, we identified a development candidate, ABI-7423 (7423), in our broad-spectrum NNPI program targeting transplant-associated herpesviruses.

7423 is a prodrug of the parent molecule 7272, and in October 2025, we transitioned our development from 7423 to 7272.

7272 is currently in regulatory filing enabling studies.

Recurrent Genital Herpes/HSV-1 and HSV-2

4 unchanged sentences

While genital herpes can be caused by either HSV-1 or HSV-2, recurrences are more likely to be experienced by individuals infected by HSV-2.

Genital herpes recurrence can cause painful genital lesions that can lead to increased transmission and debilitate patients, and symptoms may become more serious with additional episodes.

Genital herpes recurrence can cause painful genital lesions that can lead to increased transmission and debilitate individuals, and symptoms may become more serious with additional episodes.

Additional complications include increased risk of HIV infection, as 30% of HIV infections acquired through sexual transmission are attributable to HSV-2 infection.

In addition, people with recurrent genital herpes often experience associated psychosocial impacts, including anxiety, concerns about transmission, depression and social stigma.

Immunocompromised patients may experience more severe and prolonged symptoms due to increased recurrence rates.

Immunocompromised individuals may experience more severe and prolonged symptoms due to increased recurrence rates.

HPIs are antiviral agents in development for the treatment of recurrent genital herpes, with a clinically-validated mechanism of action.

4 unchanged sentences

Furthermore, HPIs are active against TK-deficient HSV-1 and HSV-2, which is a major mechanism of resistance to nucleoside analogs.

Most people with initial symptomatic genital herpes who are infected with HSV-2 have frequent recurrences, generally between three and 15 per year, including over four million people in the United States and France, Germany, Italy and Spain (collectively, the EU4) and the United Kingdom (UK).

Most people with initial symptomatic genital herpes who are infected with HSV-2 have frequent recurrences, generally between three and 15 per year, impacting over four million people in the United States and France, Germany, Italy and Spain (collectively, the EU4) and the United Kingdom (UK).

Currently, there are three antiviral drugs (all nucleoside analogs) that have been approved in the United States and the EU4/UK for the treatment of genital herpes.

5 unchanged sentences

There are still high titer (greater than 10 4 HSV-2 DNA copies/mL) shedding episodes under this current standard of care for recurrent genital herpes, which can lead to recurrent episodes and transmission of genital herpes.

In addition, nucleoside analogs also carry a high pill burden as a lifelong daily treatment, with doses ranging from one to three times daily.

There is also high treatment variability among those taking nucleoside analogs, as many seeking care may not consistently receive suppressive therapy.

Based on the limitations of current therapies, we see a path to advancing the treatment paradigm for people suffering from recurrent genital herpes.

To reach that goal, we discovered and are developing a novel, potent, long-acting HPI for recurrent genital herpes, 5366, which demonstrated low nanomolar potency in vitro against both HSV-1 and HSV-2 clinical isolates and a favorable nonclinical safety profile in the U.S.

Food and Drug Administration's (FDA) Good Laboratory Practice (GLP) toxicology studies, with high safety margins and minimal potential for off-target effects.

In addition, we are developing a second novel, potent, long-acting HPI for genital herpes, 1179, which was in-licensed to us as part of our collaboration with Gilead.

To reach that goal, we discovered and began the clinical development of a novel, potent, long-acting HPI for recurrent genital herpes, 5366, which demonstrated low nanomolar potency in vitro against both HSV-1 and HSV-2 clinical isolates and a favorable nonclinical safety profile in the U.S.

Food and Drug Administration's (FDA) Good Laboratory Practice (GLP) toxicology studies.

In addition, we began development of a second novel, potent, long-acting HPI for genital herpes, 1179, which was in-licensed to us as part of our collaboration with Gilead.

As Gilead has exercised its option to exclusively license our HPI program, including 5366 and 1179, development will be in Gilead’s sole control following completion of the Phase 1a/b studies of 5366 and 1179, which we are managing until they are complete.

For additional information regarding the option exercise, see “Collaboration and License Agreements—Gilead Sciences, Inc.—Option Exercise.”

During the first quarter of 2024, we filed a Clinical Trial Application (CTA) to support initiation of a Phase 1a/b clinical study for 5366, which was approved in April 2024, and we dosed our first participant in the Phase 1a portion of this study during the second quarter of 2024.

In September 2024, we announced positive interim data for the Phase 1a portion of the 5366 study.

Interim results exceeded our objectives for this Phase 1a study and support 5366’s progression into Phase 1b, which we initiated during the third quarter of 2024.

In September 2024, we announced positive interim data for the Phase 1a portion of the 5366 study and complete data was presented at the STI & HIV 2025 World Congress in July 2025.

Results exceeded our objectives for this Phase 1a study and supported 5366’s progression into Phase 1b, which we initiated during the third quarter of 2024.

Across the Part A (Phase 1a) cohorts evaluated, 5366 had a mean half-life of approximately 20 days when dosed orally, supporting once-weekly oral dosing, the target profile for 5366, as well as showing the potential for once-monthly oral dosing.

We plan to explore both once-weekly and once-monthly oral dosing regimens in the Part B (Phase 1b) portion of the study.

In the Part A cohorts, 5366 has been well-tolerated with a favorable safety profile observed with exposure of up to 70 days.

Treatment-emergent adverse events (AEs) were all mild to moderate in intensity and all were considered not related to study treatment by the study investigators;

there have been no serious AEs in any dose arm.

There were no treatment-related Grade 3 or 4 laboratory abnormalities and no protocol-defined stopping criteria were met.

There were no clinically significant electrocardiogram (ECG) abnormalities or patterns of AEs or laboratory abnormalities noted.

We expect interim data from the Phase 1b portion of the 5366 study to be available in fall 2025.

In addition to 5366, we are also advancing 1179, a structurally-differentiated HPI with single digit nanomolar potency against HSV-1 and HSV-2 and a nonclinical PK and safety profile to date that is supportive of a potential long-acting treatment by once-weekly oral administration.

We submitted the CTA for a Phase 1a/b study of 1179 in September 2024, which was approved in October 2024.

In the Phase 1a cohorts, 5366 was well-tolerated with a favorable safety profile, with exposures of up to 99 days.

We reported interim data from the Phase 1b portion of the 5366 study in August 2025, focused on two different oral doses of 5366 administered on a once-weekly basis.

For the powered antiviral endpoint, HSV-2 shedding rate, highly potent antiviral activity was observed with a 94% reduction compared to placebo (p<0.01) over the 29-day evaluation period in the cohort evaluating a 350 mg weekly dose.

This reduction exceeded our target for the study of an 80-85% reduction in the rate of HSV-2 shedding.

For a secondary clinical endpoint of genital lesion rate, a 94% reduction compared to placebo (p<0.01) was observed with the 350 mg weekly dose.

The rate of genital swabs with high viral load (i.e., >10 4 copies/mL HSV DNA), a potential surrogate for HSV-2 transmission and a secondary endpoint, was reduced by 98% compared to placebo (p<0.05) in this cohort.

We reported additional interim data from the Phase 1b portion of the 5366 study in December 2025, which included data from a monthly oral dosing regimen.

In the 5366 monthly dose cohort, potent antiviral activity was observed, with a 76% reduction in HSV-2 shedding rate compared to placebo (p<0.01) over the 29-day evaluation period.

The majority of positive swabs (89%) were collected in the last two weeks of the evaluation period when drug levels were declining.

We observed an 88% reduction in virologically confirmed genital lesion rate (p=0.01), along with an 81% reduction in the number of samples with high viral load (p<0.01) compared to placebo in the monthly dose cohort.

Across the two weekly oral dose cohorts and the monthly oral dose cohort of the Phase 1b study, 5366 demonstrated a pharmacokinetic (PK) profile that continues to support once-weekly and potentially once-monthly dosing.

5366 was observed to be well-tolerated at all dose levels tested in the Phase 1b portion of the study.

The two weekly oral cohorts are complete and unblinded safety data has been reported;

the oral monthly cohort is ongoing and safety data remains blinded.

Across all cohorts, the proportion of participants reporting treatment-emergent adverse events (AEs) was similar between 5366 and placebo recipients, and all were Grade 1 or Grade 2.

One Grade 3 AE was reported, hypertriglyceridemia, in a participant with relevant medical history who had Grade 4 elevated triglycerides pre-dose on Day 1.

This AE resulted in study discontinuation but was not considered treatment related.

The proportion of participants reporting treatment-emergent lab abnormalities was similar in 5366 and placebo recipients with the majority being Grade 1 or Grade 2.

In the unblinded weekly oral dose cohorts:

there were three participants with treatment-emergent Grade 3 lab abnormalities, all of which are considered unrelated to assigned treatment;

one participant with exercise-associated elevation in creatine kinase (150/30 mg QW);

one participant with an elevation of cholesterol in the follow up period, which participant had a Grade 2 elevation at baseline (350 gm QW);

and one participant, who was dosed with placebo, with decreased neutrophils.

There did not appear to be a dose-response relationship in either the frequency or severity of the treatment-emergent AEs or lab abnormalities.

No serious AEs have been reported to date.

All participants in the Phase 1b portion of the 5366 study have completed dosing and follow up.

The observed PK profile continues to support once-weekly dosing and the potential for once-monthly oral dosing regimens.

Additionally, all chronic toxicology studies have been completed.

With these data, 5366 is ready to move into a Phase 2 clinical study.

A late-breaking oral presentation of the interim 5366 Phase 1b data reported in August 2025 was presented at the 38th Congress of the International Union Against Sexually Transmitted Infections – Europe, which took place in October 2025 in Athens, Greece.

The 5366 data reported in August and December 2025 will be presented at the Congress of the European Society of Clinical Microbiology and Infectious Diseases (ESCMID) taking place in Munich, Germany in April 2026.

In addition to 5366, we have also begun the clinical development of 1179, a structurally-differentiated HPI with single digit nanomolar potency against HSV-1 and HSV-2 and a nonclinical PK and safety profile to date that is supportive of a potential long-acting treatment by once-weekly oral administration.

We submitted the CTA for the study in September 2024, which was approved in October 2024.

We dosed our first participant in the Phase 1a portion of this study during the fourth quarter of 2024.

In February 2025, we announced positive interim data for the Phase 1a portion of the 1179 study.

Interim results exceeded our objectives for this Phase 1a study and support 1179’s progression into Phase 1b, and we plan to move directly into the Phase 1b study in participants with recurrent genital herpes.

Across the Part A (Phase 1a) cohorts evaluated as of the February 13, 2025 data cutoff date, 1179 had a mean half-life of approximately four days when dosed orally, supporting once-weekly oral dosing, the target profile for 1179.

In all cohorts as of the February 13, 2025 data cutoff date, 1179 has been well-tolerated with a favorable safety profile observed.

Treatment-emergent AEs were all mild in intensity and all were considered not related to study treatment by the study investigators;

there have been no serious AEs in any dose cohort.

One self-limited Grade 2 alanine transaminase elevation was observed in a cohort evaluating the highest dose of 300 mg.

There were no treatment-related Grade 3 or 4 laboratory abnormalities and no protocol-defined stopping criteria were met.

There were no clinically significant ECG abnormalities or patterns of AEs or laboratory abnormalities noted.

We expect interim data from the Phase 1b portion of the 5366 study to be available in fall 2025.

The Phase 1b study of 1179 study will be conducted concurrently with the ongoing Phase 1b evaluation of 5366, our other long-acting helicase-primase inhibitor candidate that began dosing in Phase 1b in the fourth quarter of 2024.

The studies are anticipated to be conducted at the same sites using equivalent eligibility criteria and outcome measures for both candidates.

We plan to report interim data for both candidates together in fall 2025.

In February 2025, we announced positive interim data for the Phase 1a portion of the 1179 study, and in July 2025, we announced additional data for the Phase 1a portion of the study at the STI & HIV 2025 World Congress.

Results exceeded our objectives for this Phase 1a study and supported 1179’s progression into Phase 1b.

We dosed our first participant in the Phase 1b portion of the study in participants with recurrent genital herpes during the second quarter of 2025.

We submitted an Investigational New Drug (IND) application in May 2025 to support expansion of the Phase 1b study to sites in the United States, and we received clearance for the IND in June 2025.

In all three single-dose Phase 1a cohorts (50 mg, 100 mg and 300 mg), 1179 was well-tolerated with a favorable safety profile observed.

Treatment-emergent AEs were generally Grade 1 in intensity and all were considered not related to study treatment by the study investigators;

there were no serious AEs in any dose cohort.

A single, self-limited Grade 2 alanine transaminase (ALT) elevation was observed in a subject receiving the highest dose of 300 mg.

There were no clinically significant ECG abnormalities, no significant treatment-related laboratory abnormalities and no protocol-defined stopping criteria were met.

Plasma concentrations exceeded necessary protein-adjusted EC 50 for inhibition of HSV replication at all dose levels and the observed half-life of approximately four days supports weekly dosing, the target profile for 1179.

We reported interim data from two oral weekly dose cohorts in the Phase 1b portion of the 1179 study in December 2025.

For the powered antiviral endpoint, HSV-2 shedding rate, highly potent antiviral activity was observed with a 98% reduction in HSV-2 shedding rate compared to placebo (p<0.01) over the 29-day evaluation period in the 50 mg weekly dose cohort.

This reduction exceeded our target for the study of an 80-85% reduction in HSV-2 shedding rate.

Further, data revealed a 91% reduction in virologically confirmed lesion rate compared to placebo (p<0.01) with the 50 mg weekly dose.

There was also a >99% reduction in the number of samples with high viral load, a potential surrogate for HSV-2 transmission and a secondary endpoint.

Across both oral weekly dose cohorts, 1179 demonstrated a PK profile that continues to support once-weekly dosing.

1179 was observed to be well-tolerated at both doses.

Overall, the proportion of participants reporting treatment-emergent AEs was similar between 1179 and placebo recipients.

Of the treatment-emergent AEs reported, the majority were Grade 1 or Grade 2.

The most common AEs were upper respiratory tract infection and headache.

There have been no serious AEs reported to date.

One Grade 3 AE of migraine was reported in a participant enrolled in the 20 mg/placebo cohort.

All participants in the Phase 1b portion of the 1179 study have completed dosing and follow up.

With these data, 1179 is ready to move into Phase 2 enabling studies for a once-weekly treatment regimen, subject to completion of chronic toxicology studies, which are currently underway.

The completion of the Phase 1b studies of both 5366 and 1179 constitute an option triggering point under the terms of the Gilead Collaboration Agreement, as defined below under "Collaboration and License Agreement — Gilead Sciences, Inc." The 1179 data reported in December 2025 will be presented at ESCMID in April 2026.

In December 2025, Gilead exercised its option early to license our HPI program for the treatment of recurrent genital herpes, including 5366 and 1179.

We expect to receive Gilead’s development plan and budget for the HPI program and make our decision regarding the Profit-Share by mid-2026.

We anticipate Gilead will initiate a Phase 2 clinical study for the HPI program in 2026.

For more information regarding Gilead’s exercise of its option, see “Collaboration and License Agreement—Gilead Sciences, Inc.—Option Exercise.”

Our HBV and HDV Programs

1 unchanged sentence

HBV is a leading global cause of chronic liver disease and liver transplants, and the WHO estimates that 1.1 million people died in 2022 from HBV, mostly due to cirrhosis and hepatocellular carcinoma.

As of 2022, of the 254 million people living with chronic HBV infection, only approximately 33 million, or 13%, were aware of their infection, and only approximately 7 million, or 3%, of those diagnosed received treatment.

Of the 254 million people living with chronic HBV infection, only approximately 33 million, or 13%, were aware of their infection, and only approximately 7 million, or 3%, of those diagnosed received treatment.

HBV is a highly prevalent disease that infects almost three times the number of people infected with hepatitis C virus and HIV infections combined, according to the WHO.

7 unchanged sentences

While HDV is less prevalent in the United States, it is a significant and serious health problem with inadequate treatment in many parts of Europe, Africa, the Middle East, East Asia and parts of South America.

HDV may be significantly underdiagnosed, because there were no HDV-targeted therapies approved until very recently, and the first therapy approved is only approved in Europe.

HDV may be significantly underdiagnosed, because there were no HDV-targeted therapies approved until very recently, and the first therapy approved is only approved in the European Union (EU), Australia and Canada.

HDV is known to accelerate disease progression and increase the incidence of liver cirrhosis and liver cancer, which results in higher morbidity and mortality rates than HBV alone.

The current standard of care treatment for HDV is off-label pegylated interferon-α (IFN-α) injected weekly or, in Europe, a large, complex peptide inhibitor that requires daily injections, bulevirtide.

There are no approved HDV treatments in the United States, and the large, complex peptide blocker is the only approved HDV treatment in the Europe.

The current standard of care treatment for HDV is off-label pegylated interferon-α (IFN-α) injected weekly or, in the EU, Australia and Canada, a large, complex peptide inhibitor that requires daily injections, bulevirtide.

There are no approved HDV treatments in the United States.

We believe a safe and effective oral small molecule entry inhibitor would be a significant innovation for people living with HDV, who face a significant and immediate disease burden.

5 unchanged sentences

The inhibition of HBV and HDV infection by molecules that bind NTCP has been demonstrated in vitro, in animal models and clinically.

Notably, bulevirtide, a peptide blocker of NTCP, is the only approved therapy for HDV (approved in Europe).

6250 uses the same clinically-validated MOA as bulevirtide.

Notably, bulevirtide, a peptide blocker of NTCP, is the only approved therapy for HDV.

6250 has the same clinically-validated MOA as bulevirtide.

The binding of NTCP-targeted HBV/HDV entry inhibitors to NTCP has also been shown to inhibit the transport of certain bile acids into cells, which results in plasma elevations of bile acids;

2 unchanged sentences

We believe a safe and effective oral small molecule entry inhibitor would be a significant innovation for people living with HDV and could significantly improve treatment uptake and diagnosis rates, especially when compared with currently available injectable products.

In September 2023, we nominated 6250, a novel, orally bioavailable small molecule designed to inhibit entry of HBV and HDV by targeting NTCP.

In nonclinical studies, 6250 demonstrated low nanomolar potency against all tested HBV/HDV genotypes, favorable selectivity for NTCP versus other bile acid transporters, good oral bioavailability and a PK profile in nonclinical species projected to support once-daily oral dosing.

In GLP toxicology studies, 6250 demonstrated a favorable nonclinical safety profile with wide safety margins.

At the European Association for the Study of the Liver's International Liver Congress TM in June 2024 and the International HBV Meeting in September 2024, we presented nonclinical profiling of 6250.

In addition, 6250 was featured in an oral presentation at the Science of HBV Cure Meeting 2024.

We initiated a Phase 1a clinical study of 6250 during the fourth quarter of 2024, and we expect interim safety, PK and biomarker data from single-ascending and multiple-ascending doses cohorts in healthy participants in the third quarter of 2025.

A Phase 1a clinical study of 6250 was initiated in the fourth quarter of 2024, and in August 2025, we announced interim PK, biomarker and safety data from single-ascending and multiple-ascending doses cohorts in healthy participants.

Across the cohorts evaluated to date, a mean half-life of approximately four days was observed for 6250 when dosed orally, supporting the once-daily oral dosing profile target.

Given this half-life, accumulation was observed in the multiple-dose cohorts with exposures on the last day of dosing generally reaching six- to seven-fold higher than the exposure seen after the first dose.

Dose-dependent elevations of total serum bile acids (TBAs) were observed for both the 5 mg and 25 mg single-dose cohorts, indicative of NTCP target engagement.

In the highest single-dose cohort of 25 mg, coproporphyrin I (CP-1), a biomarker for off-target engagement of the organic anion transporters, OATP1B1 and/or OATP1B3, was also elevated.

CP-1 elevation was not noted at the other doses.

Given the predicted 6250 accumulation driven by the long half-life and the observed elevations of TBAs for the single-dose cohorts, doses at and below 1 mg daily were selected for the multiple-dose cohorts to characterize the lower end of the dose-response curve.

Elevation of TBAs was observed for both the 0.2 mg and 1 mg daily multiple-dose cohorts, consistent with the respective 6250 exposures.

Minimal TBA elevation was observed in the 0.05 mg daily multiple-dose cohort.

Treatment-emergent AEs and laboratory abnormalities were all Grade 1 or 2 in severity with the majority being Grade 1.

There were no serious AEs in any dose cohort.

No protocol defined stopping criteria were met.

There were no clinically significant electrocardiogram (ECG) abnormalities or patterns of AEs noted.

One Grade 2 ALT elevation was observed in the cohort evaluating the highest single-dose level of 25 mg.

In this cohort, off-target engagement of other liver transporters was also seen as indicated by elevated CP-1 levels.

Grade 1 ALT elevations were observed at a low frequency across the other cohorts.

All ALT elevations were self-limited, and none were accompanied with elevations in bilirubin or other markers of liver injury.

The elevations resolved in the study period with ongoing drug exposure due to 6250's four-day half-life.

We have completed enrollment and the follow-up period in the Phase 1a study, as well as the chronic toxicology studies to enable longer term dosing and we are preparing for Phase 2 clinical studies, with Phase 2 initiation expected in the fourth quarter of 2026.

6250 Phase 1a data will be presented at the European Association for the Study of the Liver (EASL) Congress taking place in Barcelona, Spain in May 2026.

Capsid Assembly Modulator

1 unchanged sentence

No currently approved oral therapies target cccDNA activity directly.

we have worked to discover and develop compounds targeting the core protein, a viral protein involved in numerous aspects of the HBV replication cycle, including the generation of HBV cccDNA.

As a result, we have worked to discover and develop compounds targeting the core protein, a viral protein involved in numerous aspects of the HBV replication cycle, including the generation of HBV cccDNA.

A benchmark for therapeutic agents aiming to decrease cccDNA levels is the use of several key viral antigens as surrogate biomarkers of active cccDNA.

4 unchanged sentences

As a next-generation CAM, 4334 was optimized to potently disrupt viral replication (MOA #1) and prevent the establishment and replenishment of new cccDNA (MOA #2).

In contrast, while active against MOA #1, first-generation CAMs have not demonstrated adequate potency to sufficiently block cccDNA formation (MOA #2).

Further, the current standard of care, NrtIs, impacts the viral life cycle after establishment of cccDNA and can only inhibit production of new viral particles, and it does so incompletely.

In contrast, while active against MOA #1, first-generation CAMs have not demonstrated adequate potency to sufficiently block MOA #2.

Further, the current standard

of care, NrtIs, impacts the viral life cycle after establishment of cccDNA and can only inhibit production of new viral particles, and it does so incompletely.

The chemical scaffold of 4334 is novel and distinct from all our prior CAM candidates.

2 unchanged sentences

A Phase 1a study demonstrated that 4334 was well-tolerated when administered orally as single or multiple doses.

In addition, the PK data support 4334 as a once daily oral therapy and predicts best-in-class activity against both MOA #1 and MOA #2.

During the second quarter of 2024, we dosed our first participant in a Phase 1b clinical study of 4334.

We reported interim clinical results from the initial 150 mg cohort in December 2024, which indicated that 4334 maintained clinical exposures multiple folds above those anticipated to be required for potent viral activity and inhibition of cccDNA formation.

A mean decline in HBV DNA of 2.9 log 10 IU/mL was observed in a population of predominately HBeAg negative participants.

Among the subset of participants with detectable HBV RNA at baseline, a mean decline of 2.5 log 10 U/mL for HBV RNA was observed.

We reported interim clinical results from the initial 150 mg cohort in December 2024, and topline clinical results including a subsequent 400 mg cohort in June 2025.

In both the 150 mg and 400 mg cohorts, 4334 continued to show a half-life supportive of once-daily oral dosing.

In addition, results for both cohorts indicated that 4334 maintained clinical exposures multiple folds above those anticipated to be required for potent viral activity and inhibition of cccDNA formation.

Mean declines in HBV DNA of 2.9 log 10 IU/mL and 3.2 log 10 IU/mL were observed over 28 days in a population of predominately HBeAg negative participants receiving 150 mg and 400 mg, respectively.

Among the subset of participants with detectable HBV RNA at baseline, mean declines of 2.5 log 10 U/mL and 2.3 log 10 U/mL were observed over 28 days in the participants receiving 150 mg and 400 mg, respectively.

As anticipated, limited changes in viral antigens were observed for the study population over the 28-day treatment period.

These initial antiviral data are consistent with the high potency seen preclinically for 4334.

The interim safety data also demonstrated that 4334 was well-tolerated with a favorable safety profile observed.

Enrollment is ongoing for the second cohort, evaluating an oral once-daily 400 mg dose of 4334.

Based on the strong antiviral activity observed in the first cohort, we expect that the 400 mg cohort will be the final cohort for this Phase 1b study.

We anticipate releasing data from the 400 mg cohort in the first half of 2025.

These antiviral data are consistent with the high potency seen preclinically for 4334.

The safety data also demonstrated that 4334 was well-tolerated with a favorable safety profile observed.

The 400 mg cohort was the final cohort for this Phase 1b study and final data was presented at the American Association for the Study of Liver Disease, The Liver Meeting® in November 2025.

The completion of the Phase 1b study of 4334 constitutes an option-triggering point under the terms of the Gilead Collaboration Agreement, as defined below under "Collaboration and License Agreement — Gilead Sciences, Inc."

In March 2026, Gilead declined to either exercise its option to license 4334 or defer its option until completion of Phase 2 studies.

As a result, the Company retains full control of 4334, including the right to evaluate partnering opportunities for 4334 outside of the Gilead Collaboration.

We are actively evaluating partnering opportunities for 4334 and have initiated a structured process to find potential partners.

We do not plan to advance 4334 further without a partner.

Transplant-Associated Herpesviruses

4 unchanged sentences

These viruses establish lifelong latent infections and frequently reactivate in transplant patients due to the use of immunosuppressive drugs following transplantation.

These uncontrolled viral infections increase the risk of severe disease and serious complications, including organ rejection, graft loss and death, and impacted approximately 95,000 people receiving transplants in 2021 in the United States and Europe.

These uncontrolled herpesvirus infections increase the risk of severe disease and serious complications, including organ rejection, graft loss and death, and impacted approximately 95,000 people receiving transplants in 2021 in the United States and Europe.

While there are approved antivirals that are administered in a transplant setting, currently approved antivirals are not active against a broad spectrum of transplant-associated herpesviruses and pose the risk of potentially serious side effects and drug-drug interactions.

As a result of these limitations, we identified an opportunity to develop an oral, broad-spectrum NNPI for transplant-associated herpesvirus infections, which could greatly advance treatment.

In December 2024, we nominated 7423 as our development candidate to undergo CTA-enabling studies, which are ongoing.

In December 2024, we nominated 7423, a prodrug, as our development candidate to undergo regulatory filing-enabling studies.

In October 2025, we transitioned our discovery and development from 7423 to its parent molecule, 7272, which is currently in regulatory filing-enabling nonclinical studies.

Research Programs

In addition to our investigational therapy programs that have nominated development candidates and have advanced into clinical studies or CTA-enabling studies, our research team continues to actively focus on proprietary research to discover and develop novel antivirals to treat serious viral diseases.

In addition to our investigational therapy programs that have nominated development candidates and have advanced into clinical studies or regulatory filing-enabling studies, our research team continues to actively focus on proprietary research to discover and nominate novel antivirals to treat serious viral diseases.

Collaboration and License Agreement

1 unchanged sentence

In October 2023, we entered into an Option, License and Collaboration agreement (the Gilead Collaboration Agreement) with Gilead pursuant to which Gilead (1) exclusively licensed to us its HPI program and its NNPI program, while retaining opt-in rights to these programs, and (2) has an option to take an exclusive license, on a program-by-program basis, to all of our other current and future pipeline programs.

During the 12-year collaboration term (subject to payment of certain extension fees) and for a specified period thereafter, Gilead may exercise its opt-in rights, on a program-by-program basis, at one of two timepoints—completion of a certain Phase 1 study or completion of a certain Phase 2 study for the first product within the program—upon payment of an opt-in fee ranging from $45.0 million to $125.0 million per program depending on the type of program and when the option is exercised.

During the 12-year collaboration term (subject to payment of certain extension fees) and for a specified period thereafter, Gilead may exercise its opt-in rights, on a program-by-program basis, at one of two timepoints—completion of a certain Phase 1 study or, upon payment of a deferral fee and completion of a certain Phase 2 study for the first product within the program—upon payment of an opt-in fee ranging from $45.0 million to $125.0 million per program depending on the type of program and when the option is exercised.

Pursuant to the Gilead Collaboration Agreement, Gilead made an $84.8 million upfront cash payment to us.

2 unchanged sentences

The $10.0 million payment received in connection with the First Amendment to the Gilead Collaboration Agreement is creditable towards future collaboration-related payments payable by Gilead.

This credit was applied toward Gilead’s opt-in fee paid for the HPI program in December 2025.

If Gilead exercises its opt-in right to any current or future program under the collaboration, we are eligible to receive up to $330.0 million in potential regulatory and commercial milestones on that program, in addition to royalties ranging from the high single-digits to high teens, depending on the clinical stage of the program at the time of the opt-in.

1 unchanged sentence

Prior to Gilead’s potential exercise of its opt-in, we are primarily responsible for all discovery, research and development on both our programs and the two Gilead-contributed programs.

Following Gilead’s opt-in, Gilead will control the further discovery, research, development, and commercialization on any optioned programs.

During the term, Gilead will continue to support the collaboration through extension fees of $75.0 million in each of the third, fifth and seventh years of the collaboration.

Following Gilead’s opt-in, Gilead will control the further discovery, research, development and commercialization on any optioned programs, and is responsible for all related costs unless we opt in to share 40% of all costs and profits in the United States.

During the term, Gilead will continue to support the collaboration through extension fees of $75.0 million in each of the third, fifth and seventh anniversaries of the collaboration.

The Gilead Collaboration Agreement is subject to termination by either party for the other party’s uncured, material breach or insolvency.

5 unchanged sentences

The terms of the Gilead Equity Agreements provided Gilead the right to elect to purchase additional shares of common stock from us at a premium in an amount that results in Gilead owning 29.9% of our then-outstanding voting common stock.

This right was exercised in December 2024, at a purchase price of $21.37 per share, which represents a 35% premium to the 30-trading day volume weighted average price immediately prior to the date of purchase.

The Gilead Equity Agreements also include a three-year standstill provision and a two-year lockup provision, each with customary exceptions, and

provide Gilead with certain other stock purchase rights and registration rights, as well as the right to designate two directors (or, alternatively, board observers at Gilead’s election) to our board of directors.

This right was exercised in December 2024, at a purchase price of $21.37 per share, which represents a 35% premium to the

30-trading day volume weighted average price immediately prior to the date of purchase.

The Gilead Equity Agreements also include a three-year standstill provision and a two-year lockup provision, each with customary exceptions, and provide Gilead with certain other stock purchase rights and registration rights, as well as the right to designate two directors (or, alternatively, board observers at Gilead’s election) to our board of directors.

In December 2023, Gilead designated Tomas Cihlar, Ph.D.

5 unchanged sentences

Subject to certain exceptions, neither Gilead nor its affiliates may exercise any portion of the warrant to the extent that Gilead would own more than 19.9% of the number of our shares of common stock outstanding immediately after giving effect to such exercise.

Gilead also participated in a financing transaction in August 2025 on the same terms as the new investors.

We and Gilead entered into a Securities Purchase Agreement for the issuance and sale, in a private placement, of 2,295,920 shares of our common stock at a combined purchase price of $19.60 per shares and accompanying one-half of one Class A Warrant and one-half of one Class B Warrant (collectively, the August 2025 Private Placement).

The common stock, the Class A Warrant and the Class B Warrant were sold to Gilead pursuant to the terms of the Investor Rights Agreement.

The Class A Warrant and the Class B Warrant each provide for the right to purchase up to 1,147,960 shares of our common stock.

The Class A Warrant has an exercise price of $21.60 per share, became immediately exercisable on the date of issuance and will expire on or prior to the earlier of (a) August 11, 2030 (five years from the date of issuance) and (b) the date that is 30 days after the public announcement that we have completed enrollment of at least 200 patients total for our Phase 2 clinical study evaluating 5366 versus valacyclovir.

The Class B Warrant has an exercise price of $21.60 per share and is exercisable between November 15, 2026 and December 31, 2026.

Notwithstanding the foregoing, if, prior to November 15, 2026, we publicly announce that we have received at least $75.0 million in the aggregate of non-dilutive capital in connection with a collaboration agreement, then the Class B Warrant automatically terminates in full.

In October 2025, as required under the registration rights terms of the Investor Rights Agreement, we filed a registration statement on Form S-3 (the Registration Statement) with the Securities and Exchange Commission (SEC) to register all of the shares of our common stock that have been issued and sold to Gilead, as well as all of the shares of common stock underlying the warrants that have been issued and sold to Gilead.

The SEC declared the Registration Statement effective in November 2025.

Option Exercise

In December 2025, Gilead exercised its option to exclusively license our HPI program for the treatment of recurrent genital herpes, including 5366 and 1179.

This is the first program that Gilead will advance under the Gilead Collaboration.

Under the terms of the Gilead Collaboration Agreement, we received a $35 million payment in connection with Gilead’s exercise of our HPI program.

The $35 million payment reflects a $45 million option fee, net of $10 million in accelerated funding that we received under the First Amendment to the Gilead Collaboration Agreement, which was creditable against future payments.

Gilead received an exclusive license to 5366 and 1179 and will have the sole right and responsibility for further clinical development and commercialization of the HPI program.

We remain eligible to receive up to $330 million in regulatory and commercial milestones, as well as tiered royalties on net sales ranging from the high single-digits to low teens.

We will also have the right to opt in to share 40% of all costs and profits in the United States (the Profit-Share) in lieu of receiving milestones and royalties for that program in the United States after receipt of a development plan and budget from Gilead.

Intellectual Property

We own a published international Patent Cooperation Treaty (PCT) patent application relating to compositions of matter and methods of using 5366 and derivatives/analogs thereof to treat HSV.

We own published and nationalized international Patent Cooperation Treaty (PCT) patent applications relating to compositions of matter and methods of using 5366 and derivatives/analogs thereof to treat HSV.

Any patents issuing therefrom are expected to expire in 2043.

We also own provisional, unpublished and published PCT patent applications relating to synthetic processes, crystal forms and pharmaceutical formulations of 5366.

We also own unpublished, published and nationalized PCT patent applications relating to synthetic processes, crystal forms and pharmaceutical formulations of 5366.

Any patents issuing therefrom are expected to expire in 2043 to 2045.

We have acquired rights to a published PCT patent application relating to compositions of matter and methods of using 1179 and derivatives/analogs thereof to treat HSV.

Any patents issuing therefrom are expected to expire in 2043.

We also have rights to unpublished PCT patent applications related to crystalline forms and pharmaceutical formulations of 1179.

Any patents issuing therefrom are expected to expire in 2044 and 2045, respectively.

We own a published PCT patent application relating to compositions of matter and methods of using compound 6250 and derivatives/analogs thereof to treat HDV and HBV.

We own a published and nationalized PCT patent application relating to compositions of matter and methods of using compound 6250 and derivatives/analogs thereof to treat HDV and HBV.

Any patents issuing therefrom are expected to expire in 2044.

We also own a provisional patent application relating to crystalline forms of 6250.

We also own a published PCT patent application relating to crystalline forms of 6250.

Any patents issuing therefrom are expected to expire in 2045.

We own a published PCT patent application which has entered the national phase, relating to compositions of matter and methods of using compound 4334 and derivatives/analogs thereof to treat HBV.

We own a published nationalized PCT patent application relating to compositions of matter and methods of using compound 4334 and derivatives/analogs thereof to treat HBV.

Any patents issuing therefrom are expected to expire in 2041.

We also own published PCT patent applications, which have entered the national phase, relating to processes for preparing 4334 and crystalline forms of 4334.

We also own published and nationalized PCT patent applications relating to processes for preparing 4334 and crystalline forms of 4334.

Any patents issuing therefrom are expected to expire in 2042.

Finally, we own a provisional patent application relating to compositions of matter and methods of using broad-spectrum NNPIs to treat various herpes viruses.

Finally, we own a published PCT patent application relating to compositions of matter and methods of using broad-spectrum NNPIs to treat various herpes viruses.

Government Regulation

4 unchanged sentences

Failure to comply with the applicable U.S.

partial suspension of production or distribution, injunctions, fines, refusals of government contracts, restitution, disgorgement of profits or civil or criminal penalties.

requirements at any time during the product development process, approval process or after approval may subject an applicant or sponsor to a variety of administrative or judicial sanctions, such as the FDA’s imposition of a clinical hold, refusal to approve pending applications, withdrawal of an approval, license revocation, imposition of a clinical hold, issuance of warning letters and untitled letters, product recalls, product seizures, total or partial suspension of production or distribution, injunctions, fines, refusals of government contracts, restitution, disgorgement of profits or civil or criminal penalties.

The process required by the FDA before a drug may be marketed in the United States generally involves the following:

• completion of nonclinical laboratory tests and animal studies in compliance with the FDA’s GLP regulations and applicable requirements for the humane use of laboratory animals or other applicable requirements;

• submission to the FDA of an investigational new drug application (IND) which must become effective before human clinical studies may begin;

• submission to the FDA of an IND application, which must become effective before human clinical studies may begin;

• approval by an independent institutional review board (IRB) or ethics committee at each clinical site before each trial may be initiated;

8 unchanged sentences

The conduct of nonclinical studies is subject to federal regulations and requirements, including GLP regulations for safety/toxicology studies.

An IND sponsor must submit the results of the nonclinical tests, together with manufacturing information, analytical data, any available clinical data or literature and plans for clinical studies, among other things, to the FDA as part of an IND.

Some long-term nonclinical testing, such as animal tests of reproductive AEs and carcinogenicity, may continue after the IND is submitted.

7 unchanged sentences

A protocol for each clinical study and any subsequent protocol amendments must be submitted to the FDA as part of the IND.

In addition, an IRB at each institution participating in the clinical study must review and approve the plan for any clinical study before it

commences at that institution, and the IRB must conduct continuing review.

In addition, an IRB at each institution participating in the clinical study must review and approve the plan for any clinical study before it commences at that institution, and the IRB must conduct continuing review.

The IRB must review and approve, among other things, the study protocol and informed consent information to be provided to study subjects.

6 unchanged sentences

The drug is initially introduced into healthy human subjects or patients with the target disease or condition and tested for safety, dosage tolerance, absorption, metabolism, distribution, excretion and, if possible, to gain an early indication of its effectiveness.

The drug is administered to a limited patient population to identify possible adverse effects and safety risks, to preliminarily evaluate the efficacy of the product for specific targeted diseases and to determine dosage tolerance and optimal dosage.

determine dosage tolerance and optimal dosage.

Multiple Phase 2 clinical trials may be conducted to obtain information prior to beginning larger and more expensive Phase 3 clinical trials.

7 unchanged sentences

Similarly, an IRB can suspend or terminate approval of a clinical study at its institution if the clinical study is not being conducted in accordance with the IRB’s requirements or if the drug has been associated with unexpected serious harm to patients.

A manufacturer of an investigational drug for a serious disease or condition is required to make available, such as by posting on its website, its policy regarding evaluating and responding to requests for individual patient access to such investigational drug.

This requirement applies on the earlier of the first initiation of a Phase 2 or Phase 3 trial of the investigational drug or, as applicable, 15 days after the drug receives a designation as a breakthrough therapy, Fast Track product, or regenerative advanced therapy.

14 unchanged sentences

The review process may be extended by the FDA for three additional months to consider certain information or clarification regarding information already provided in the submission.

Despite these review goals, it is not uncommon for FDA review of an NDA to extend beyond the goal date.

The FDA may also refer applications for novel drugs or products that present difficult questions of safety or efficacy to an advisory committee, typically a panel that includes clinicians and other experts, for review, evaluation and a recommendation as to whether the application should be approved.

1 unchanged sentence

Before approving an NDA, the FDA typically will inspect the facility or facilities where the product is manufactured.

The FDA will not approve an application unless it determines that the manufacturing processes and facilities are in compliance with cGMP requirements and adequate to assure consistent production of the product within required specifications.

specifications.

In addition, before approving an NDA, the FDA will typically inspect one or more clinical sites to assure compliance with GCP and integrity of the clinical data submitted.

18 unchanged sentences

Priority review

Under FDA policies, a product candidate may be eligible for priority review, a review generally completed within a six-month time frame from the date a complete application is filed.

Under FDA policies, a product candidate may be eligible for priority review, which means the review is generally completed within a six-month time frame from the date a complete application is filed.

Products generally are eligible for priority review if they are intended for treatment of a serious or life-threatening disease or condition and provide a significant improvement in safety or effectiveness compared to marketed products in the treatment, diagnosis or prevention of a serious disease or condition.

3 unchanged sentences

Surrogate endpoints can often be measured more easily or more rapidly than clinical endpoints.

A product candidate approved on this basis is subject to rigorous post-marketing compliance requirements, including the completion of Phase 4 or post-approval clinical studies to confirm the effect on the clinical endpoint.

candidate approved on this basis is subject to rigorous post-marketing compliance requirements, including the completion of Phase 4 or post-approval clinical studies to confirm the effect on the clinical endpoint.

Failure to conduct required post-approval studies, or confirm a clinical benefit during post-marketing studies, would allow the FDA to withdraw the drug from the market on an expedited basis.

9 unchanged sentences

Under the Orphan Drug Act, as amended, the FDA may grant orphan drug designation to drugs intended to treat a rare disease or condition, which is generally defined as a disease or condition that affects fewer than 200,000 individuals in the United States or that affects more than 200,000 individuals in the United States and for which there is no reasonable expectation that the cost of developing and making available the drug for the disease or condition will be recovered from sales of the product in the United States.

Orphan drug designation must be requested before submitting an NDA.

After the FDA grants orphan drug designation, the identity of the product and its potential orphan use are disclosed publicly by the FDA.

Orphan drug designation must be requested before submitting an NDA for the application to be eligible to receive orphan drug exclusivity upon approval.

After the FDA grants orphan drug designation, the identity of the product and its potential orphan indication are disclosed publicly by the FDA.

Orphan drug designation does not shorten the duration of the regulatory review and approval process.

If a product that has orphan designation subsequently receives the first FDA approval for a particular

active ingredient for the disease or condition for which it has such designation, the product is entitled to Orphan Drug exclusivity, which means that the FDA may not approve other applications to market the same product for the same indication for seven years, except in limited circumstances, such as a showing of clinical superiority to the product with orphan drug exclusivity.

If a product that has orphan designation subsequently receives the first FDA approval for a particular active ingredient for the disease or condition for which it has such designation, the product is entitled to Orphan Drug exclusivity, which means that the FDA may not approve other applications to market the same product for the same indication for seven years, except in limited circumstances, such as a showing of clinical superiority to the product with orphan drug exclusivity.

A drug will be considered clinically superior if it is shown to be safer, more effective or makes a major contribution to patient care.

16 unchanged sentences

Once an approval is granted, the FDA may withdraw the approval if compliance with regulatory requirements and standards is not maintained or if problems occur after the product reaches the market.

Later discovery of previously unknown problems with a product, including AEs of unanticipated severity or frequency, or with manufacturing processes, or failure to comply with regulatory requirements, may result in revisions to the approved labeling to add new safety information, imposition of post-market studies or clinical studies to assess new safety risks or imposition of distribution or other restrictions under a REM program.

Other potential consequences include, among other things:

• restrictions on the marketing or manufacturing of the product, complete withdrawal of the product from the market or product recalls;

• fines, warning letters or holds on post-approval clinical studies;

• fines, warning letters or clinical holds on post-approval studies;

• refusal of the FDA to approve pending applications or supplements to approved applications, or suspension or revocation of product approvals;

10 unchanged sentences

Foreign Regulation

In order to market any product outside of the United States, we would need to comply with numerous and varying regulatory requirements of other countries regarding safety and efficacy and governing, among other things, clinical studies, marketing authorization, commercial sales and distribution of our products.

studies, marketing authorization, commercial sales and distribution of our products.

Whether or not we obtain FDA approval for a product, we would need to obtain the necessary approvals by the comparable regulatory authorities of foreign countries before we can commence clinical studies or marketing of the product in those countries.

15 unchanged sentences

Some countries may require the completion of additional studies that compare the cost-effectiveness of a particular product candidate to currently available therapies.

For example, the European Union (EU) provides options for its member states to restrict the range of drug products for which their national health insurance systems provide reimbursement and to control the prices of medicinal products for human use.

EU member states may approve a specific price for a drug product or may instead adopt a

system of direct or indirect controls on the profitability of us placing the drug product on the market.

For example, the EU provides options for its member states to restrict the range of drug products for which their national health insurance systems provide reimbursement and to control the prices of medicinal products for human use.

EU member states may approve a specific price for a drug product or may instead adopt a system of direct or indirect controls on the profitability of us placing the drug product on the market.

Other member states allow companies to fix their own prices for drug products but monitor and control company profits.

7 unchanged sentences

For example the Affordable Care Act of 2010, as amended by, the Health Care and Education Reconciliation Act (collectively, ACA), among other things, imposed an annual fee on any entity that manufactures or imports certain branded prescription drugs, increased the minimum Medicaid rebates owed by most manufacturers under the Medicaid Drug Rebate Program, and established the Medicare Part D coverage gap discount program.

In addition to these provisions, the ACA established a number of bodies whose work may have a future impact on the market for certain pharmaceutical products, including the Patient-Centered Outcomes Research Institute, established to oversee, identify priorities in, and conduct comparative clinical effectiveness research, and the Center for Medicare and Medicaid Innovation within the Centers for Medicare and Medicaid Services, established to test innovative payment and service delivery models to lower Medicare and Medicaid spending.

Innovation within the Centers for Medicare and Medicaid Services, established to test innovative payment and service delivery models to lower Medicare and Medicaid spending.

Since its enactment, there have been executive, judicial, and Congressional challenges to certain aspects of the ACA.

For example, during his first administration, President Trump issued directives designed to delay the implementation of certain ACA provisions or otherwise circumvent requirements for health insurance mandated by the ACA, and Congress has considered legislation that would repeal, or repeal and replace all or part of the ACA.

For example, the administration has issued directives designed to delay the implementation of certain ACA provisions or otherwise circumvent requirements for health insurance mandated by the ACA, and Congress has considered legislation that would repeal, or repeal and replace all or part of the ACA.

While Congress has not passed comprehensive repeal legislation, several bills affecting the implementation of certain taxes under the ACA have been signed into law.

2 unchanged sentences

Supreme Court dismissed a challenge on procedural grounds that argued the ACA is unconstitutional in its entirety because the “individual mandate” was repealed by Congress.

In January 2025, the U.S.

Supreme Court granted certiorari to review a lower court's decision that the ACA's requirement that group health plans and health insurance issuers cover certain preventative services without cost-sharing is unconstitutional.

More recently, in June 2025, the U.S.

Supreme Court upheld the constitutionality of the ACA's requirement that group health plans and health insurance issuers cover certain preventative services without cost-sharing is unconstitutional.

In addition, other legislative changes have been proposed and adopted since the ACA was enacted.

These changes included aggregate reductions to Medicare payments to providers of up to 2% per fiscal year, which will remain in effect through 2032, unless Congress takes additional action.

Further, in January 2013, then President Obama signed into law the American Taxpayer Relief Act of 2012, which, among other things, reduced Medicare payments to several providers, and increased the statute of limitations period for the government to recover overpayments to providers from three to five years.

These changes included aggregate reductions to certain Medicare payments to providers of up to 2% per fiscal year, which will remain in effect through 2032, unless Congress takes additional action.

These and other laws may result in additional reductions in Medicare and other healthcare funding and otherwise affect the prices we may obtain for any of our product candidates for which we may obtain regulatory approval or the frequency with which any such product candidate is prescribed or used.

2 unchanged sentences

For example, the Inflation Reduction Act of 2022 (IRA) enacted on August 16, 2022, seeks to reduce prescription drug costs by, among other provisions, allowing Medicare to negotiate prices for certain high-cost prescription drugs in Medicare Parts B and D, imposing an excise tax on pharmaceutical manufacturers that refuse to negotiate pricing with Medicare, and requiring inflation rebates to limit annual drug price increases in Medicare.

These provisions began taking effect progressively starting in 2023, and, in January 2025, CMS announced the 15 drugs selected for the second cycle of Medicare drug price negotiations.

Beginning in 2025, the IRA also eliminates the coverage gap under Medicare Part D by significantly lowering the enrollee maximum out-of-pocket cost and imposing on new manufacturer discount program.

However, various industry stakeholders, including certain pharmaceutical companies and industry trade organizations have

initiated lawsuits against the federal government asserting that the price negotiation provisions of the IRA are unconstitutional.

These provisions began taking effect progressively starting in 2023, and, in January 2026, CMS announced the 15 drugs selected for the third cycle of Medicare drug price negotiations.

Beginning in 2025, the IRA also eliminated the coverage gap under Medicare Part D by significantly lowering the enrollee maximum out-of-pocket cost and imposing a new manufacturer discount program.

However, various industry stakeholders, including certain pharmaceutical companies and industry trade organizations have initiated lawsuits against the federal government asserting that the price negotiation provisions of the IRA are unconstitutional.

The impact of these judicial challenges and future government reform measures on us and the pharmaceutical industry as a whole is unclear.

4 unchanged sentences

If the program is ultimately approved, it will be the first such program authorized in the United States.

Although a number of these and other proposed measures may require authorization through additional legislation to become effective, and the current Trump administration may reverse or otherwise change measures implemented by the prior administration, both the Trump administration and Congress have indicated that they will continue to take action to control drug costs.

At the state level, individual states are increasingly aggressive in passing legislation and implementing regulations designed to control pharmaceutical product pricing, including price or patient reimbursement constraints, discounts, restrictions on certain product access and marketing cost disclosure and transparency measures.

Although a number of these and other proposed measures may require authorization through additional legislation to become effective, and the current administration may reverse or otherwise change measures implemented by the prior administration, both the current administration and Congress have indicated that they will continue to take action to control drug costs.

restrictions on certain product access and marketing cost disclosure and transparency measures.

These measures could reduce the ultimate demand for our products, if approved, or put pressure on our product pricing.

10 unchanged sentences

The Anti-Kickback Statute has been interpreted to apply to arrangements between pharmaceutical manufacturers on the one hand and patients, prescribers, purchasers, and formulary managers on the other;

• federal civil and criminal false claims laws, including the federal False Claims Act, which can be enforced by private citizens through civil qui tam actions, and civil monetary penalty laws that prohibit individuals or entities for, among other things:

knowingly presenting, or causing to be presented, to the federal government, claims for payment that are false or fraudulent;

1 unchanged sentence

or knowingly concealing or knowingly and improperly avoiding or decreasing an obligation to pay money to the federal government.

In addition, the government may assert that a claim including items and services resulting from

a violation of the federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the False Claims Act.

In addition, the government may assert that a claim including items and services resulting from a violation of the federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the False Claims Act.

Pharmaceutical manufacturers can be held liable under the False Claims Act even when they do not submit claims directly to government payors if they are deemed to “cause” the submission of false or fraudulent claims;

15 unchanged sentences

There are ambiguities as to what is required to comply with these state requirements and if we fail to comply with an applicable state law requirement, we could be subject to penalties.

In addition, regulators globally are also imposing greater monetary fines for privacy violations.

In respect of our engagement of European contract research organizations (CROs) in the context of clinical trials, the General Data Protection Regulation (EU GDPR), which went into effect on May 25, 2018, applies.

The EU GDPR applies to any

company established in the EU as well as to those outside the EU if they collect and use personal data in connection with the offering goods or services to individuals in the EU or the monitoring of their behavior.

The EU GDPR enhances data protection obligations for processors and controllers of personal data, including, for example, expanded disclosures about how personal information is to be used, limitations on retention of information, mandatory data breach notification requirements and onerous new obligations on services providers.

Privacy and Data Security Laws

There are several privacy and data security laws that may impact our business activities, in the United States and in other jurisdictions where we conduct trials or where we may do business in the future.

These laws are evolving and may increase both our obligations and our regulatory risks in the future.

As described above, in Other Healthcare Laws , in the health care industry generally, under HIPAA, the U.S.

Department of Health and Human Services has issued regulations to protect the privacy and security of protected health information, or PHI, used or disclosed by covered entities including certain healthcare providers, health plans and healthcare clearinghouses.

HIPAA may apply to us in certain circumstances and may also apply to our business partners in ways that may impact our relationships with them.

In addition to federal privacy regulations under HIPAA, there are a number of state laws in the United States governing confidentiality and security of information that may be applicable to our business.

At the state level, California enacted the California Consumer Privacy Act (CCPA), which went into effect on January 1, 2020.

The CCPA creates new individual privacy rights for California consumers (as defined in the law) and places increased privacy and security obligations on entities handling personal data of consumers or households.

The CCPA requires covered companies to provide certain disclosures to consumers about its data collection, use and sharing practices, and to provide affected California residents with ways to opt-out of certain sales or transfers of personal information.

Additionally, the California Privacy Rights Act (CPRA), which went into effect on January 1, 2023, significantly expanded the CCPA, imposing additional obligations on companies covered by the legislation and expanding consumers’ rights with respect to certain sensitive personal information, among other things.

The CPRA also creates a new state agency that will be vested with authority to implement and enforce the CCPA and the CPRA.

While there is currently an exception for protected health information that is subject to HIPAA and clinical trial regulations, as currently written, the CCPA may apply to some of our business activities or those of our business partners.

In addition to California, at least twenty other states have passed comprehensive consumer data privacy laws.

Like the CCPA and CPRA, these laws create obligations related to the processing of personal information, as well as special obligations for the processing of “sensitive” data (which includes health data in some cases).

There are also states that are actively considering comprehensive privacy laws.

Additional states may consider such laws in the future, and Congress has also been debating passing a federal privacy law.

These laws may impact our business activities or those of our business partners, including identification of research subjects, relationships with business partners and ultimately the marketing and distribution of our products.

Privacy laws such as the EU General Data Protection Regulation (EU GDPR) and the UK General Data Protection Regulation (UK GDPR) impose strict obligations on lawful processing, transparency and cross-border transfers of personal data (i.e., information which identifies an individual or from which an individual is identifiable).

In respect of our engagement of European contract research organizations (CROs) in the context of clinical trials, the EU GDPR and UK GDPR apply.

The EU GDPR applies to any company established in the EU as well as to those outside the EU if they process personal data in connection with the offering of goods or services to EU residents or the monitoring of their behavior within the EU, wherever such processing occurs.

The EU GDPR includes operational requirements for companies that receive or process personal data of EU residents.

Noncompliance with the EU GDPR may result in monetary penalties of up to €20 million or 4% of worldwide revenue, whichever is higher.

In addition, violations of the EU GDPR could result in regulatory investigations, reputational damage, orders to cease and/or change our processing activities, enforcement notices and/or assessment notices (for compulsory audit).

This is as the EU GDPR confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations.

The EU GDPR may increase our responsibility and liability in relation to personal data that we process where such processing is subject to the EU GDPR, and we may be required to put in place additional mechanisms to ensure compliance with the EU GDPR, including as implemented by individual countries.

The EU GDPR (covering the EEA) imposes strict rules on the transfer of personal data out of the EU to a "third country," including the United States.

In July 2020, the EU-US Privacy Shield was invalidated as a valid personal data transfer mechanism and on June 27, 2021, the European Commission published a new set of modular standard contractual clauses (New SCCs).

The New SCCs must be used for all relevant transfers of personal data outside the European Economic Area (EEA) (since December 27, 2022).

On July 11, 2023, the European Commission entered into force its adequacy decision for the EU-US Data Privacy Framework (a new framework for transferring personal information from the EEA to the United States), having determined that such framework ensures that the protection of personal information transferred from the EEA to the US will be comparable to the protection offered in the EU.

However, this decision is subject to legal challenges and ultimately may be invalidated by the Court of Justice of the European Union (CJEU) just as the EU-US Privacy Shield was.

The EU GDPR may increase our responsibility and liability in relation to personal data that we process where such processing is subject to the EU GDPR, and we may be required to implement additional mechanisms to ensure compliance with the EU GDPR, including as implemented by individual countries.

In addition to the foregoing, a breach of the EU GDPR could result in regulatory investigations, reputational damage, fines and sanctions, orders to change the processing activities of our personal data, enforcement notices or assessment notices (for a compulsory audit).

We may also face civil claims, including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities as well as associated costs, diversion of internal resources and reputational harm as the EU GDPR confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations.

The European Economic Area (EEA) and UK impose rules with respect to cross-border transfers of personal data outside of the EEA and the UK to third countries including the United States.

In July 2020, the EU-US Privacy Shield was invalidated as a valid personal data transfer mechanism between the EU and the U.S., and on June 4, 2021, the European Commission finalized new versions of the Standard Contractual Clauses (New SCCs), which apply to the transfer of personal data outside of the EU to a country not approved by the EU as providing an adequate level of protection for the processing of personal data.

The New SCCs must be used for all relevant transfers of personal data outside the EEA (since December 27, 2022).

On March 21, 2022, the UK implemented its own UK-specific international data transfer agreement and addendum to the New SCCs (collectively, the SCCs).

Effective July 11, 2023, the new EU-US Data Privacy Framework (DPF) has been recognized as adequate under EU law (a new framework to allow transfers of personal data from the EU to certified companies in the United States).

The UK has also approved a UK extension to the EU-US Data Privacy Framework, which was laid before Parliament on September 21, 2023, and came into force on October, 12 2023.

However, the DPF is subject to further legal challenge just as the EU-US Privacy Shield was, which could cause the legal requirements for personal data transfers from the EU to the U.S.

to become uncertain once again.

EU data protection authorities have and may again block the use of certain U.S.-based services that involve the transfer of personal data to the U.S.

In the EU and other markets, potential new rules and restrictions on the flow of personal data across borders could increase the cost and complexity of doing business in those regions.

We currently rely on the New SCCs for both intragroup and third-party data transfers from the EEA, however the cross-border data transfer landscape in the EEA is continually developing, and we are monitoring these developments.

We may, in addition to other impacts, experience additional costs associated with increased compliance burdens and be required to engage in new contract negotiations with third parties that aid in processing data on our behalf or localize certain data.

California enacted the California Consumer Privacy Act (CCPA), which creates new individual privacy rights for California consumers (as defined in the law) and places increased privacy and security obligations on entities handling personal data of consumers or households.

The CCPA will require covered companies to provide certain disclosures to consumers about its data collection, use and sharing practices, and to provide affected California residents with ways to opt-out of certain sales or transfers of personal information.

While there is currently an exception for protected health information that is subject to HIPAA and clinical trial regulations, as currently written, the CCPA may impact our business activities.

Additionally, the California Privacy Rights Act (CPRA), which went into effect on January 1, 2023, imposes additional obligations on companies covered by the legislation and expands consumers’ rights with respect to certain sensitive personal information, among other things.

The CPRA also creates a new state agency that will be vested with authority to implement and enforce the CCPA and the CPRA.

Other states, including Virginia and Colorado have similarly passed data privacy laws that will regulate how businesses collect and share personal information.

Following the UK’s departure from the EU, commonly referred to as “Brexit”, the UK GDPR exists alongside the UK Data Protection Act 2018, which implements certain derogations in the UK GDPR into UK law.

Under the UK GDPR, companies not established in the UK but who process personal data in relation to the offering of goods or services to

individuals in the UK, or to monitor their behavior will also be subject to the UK GDPR and will be required to appoint a data protection representative in the UK, provided certain exceptions are not met.

While the EU GDPR and the UK GDPR remain substantially similar for the time being, the government of the UK has adopted reforms to its data privacy and cybersecurity legal framework in its Data Use and Access Act 2025, which became law on June 19, 2025 (phasing in between June 2025 and June 2026).

Compliance with the EU GDPR and UK GDPR and other changes in laws or regulations associated with the enhanced protection of certain types of personal data, such as healthcare data or other sensitive information, could greatly increase our cost of developing our products or even prevent us from offering certain products in jurisdictions that we may operate in.

Because of the breadth of these laws and the narrowness of the statutory exceptions and regulatory safe harbors available under such laws, it is possible that some of our current or future business activities or those of our business partners, including certain clinical research, sales and marketing practices and the provision of certain items and services to our customers, could be subject to challenge under one or more privacy and data security laws.

The heightening compliance environment and the need to build and maintain robust and secure systems to comply with different privacy compliance and/or reporting requirements in multiple jurisdictions could increase the possibility that a company may fail to comply fully with one or more of these requirements.

If our operations are found to be in violation of any of the privacy or data security laws or regulations described above that are applicable to us, or any other laws that apply to us, we may be subject to penalties, including potentially significant criminal, civil and administrative penalties, damages, fines, contractual damages, reputational harm, diminished profits and future earnings, additional reporting requirements and/or oversight if we become subject to a consent decree or similar agreement to resolve allegations of non-compliance with these laws, and the curtailment or restructuring of our operations, any of which could adversely affect our ability to operate our business and our results of operations.

New Legislation and Regulations

3 unchanged sentences

We are conscious of the extensive and evolving regulatory frameworks in the jurisdictions in which we operate.

There are changes in the regulatory landscape relating to new and emerging technologies such as artificial intelligence (AI), which we use in a limited capacity solely to assist our employees in selecting chemical compounds to evaluate.

EU has developed a standalone law to govern the offering and use of AI systems in the EU (AI Act), which entered into force on August 1, 2024.

There are changes in the regulatory landscape relating to new and emerging technologies such as artificial intelligence (AI), which we use in a limited capacities, including to assist our employees in selecting chemical compounds to evaluate, as well as office-related tasks.

The EU has developed a standalone law to govern the offering and use of AI systems in the EU (AI Act), which entered into force on August 1, 2024.

The AI Act imposes regulatory requirements onto AI system providers, importers, distributors, and deployers, in accordance with the level of risk involved with the AI system (“unacceptable,” “high,” “limited,” and “minimal” risk).

3 unchanged sentences

We are actively assessing the scope of application, impact, and risk of these developments in the EU and the UK on our business and will continue to assess this moving forward.

In November 2025, the European Commission proposed a Digital Omnibus package (Digital Omnibus), which would make targeted amendments to several existing EU digital laws, including the AI Act, the EU GDPR, the NIS 2 Directive, the EU’s Data Act (EU Data Act), and other related frameworks, with the stated aim of simplifying and streamlining aspects of the EU digital regulatory landscape.

Although the proposal is intended to reduce administrative burden, any amendments to these frameworks may require us to reassess certain compliance positions and adjust technical or legal practices accordingly, which could affect our operations in the EU.

The European Health Data Space (EHDS) Regulation entered into force on March 26, 2025, and introduces stricter requirements for the collection, processing, and sharing of electronic health data across the EU.

The phased implementation of the EHDS Regulation runs until March 2034, with requirements that may significantly impact our ability to conduct clinical trials, particularly those relying on real-world data, patient registries, or cross-border research collaborations.

The EU Data Act is, at this stage, primarily a forward-looking regulatory consideration rather than a current material risk to our business.

The EU Data Act has applied since

September 12, 2025, and establishes new requirements concerning access to, use of and sharing of data generated by connected products and related services, as well as certain business-to-business and business-to-government data sharing arrangements.

While our current core business is not the primary focus of the regime, the EU Data Act may become relevant to our operations as our research and development activities evolve, particularly if we decide to develop connected medical or health devices in the future.

Any such expansion could require us to adapt our data governance, operational processes and contractual arrangements, which may increase compliance costs and administrative complexity.

We are actively assessing the potential application and impact of the EU Data Act on our business but currently view it as a forward-looking consideration.

The proposed European Health Data Space (EHDS) Regulation introduces stricter requirements for the collection, processing, and sharing of electronic health data across the EU.

7 unchanged sentences

Additionally, new entrants may potentially enter the market.

Potential competitors include GlaxoSmithKline plc, Enanta Pharmaceuticals, Inc., Arbutus Biopharma Corporation, Vir Bio, Bluejay Therapeutics, Huahui Health, Aligos Therapeutics and AiCuris Anti-infective Cures AG, among others.

Potential competitors include GlaxoSmithKline plc, Enanta Pharmaceuticals, Inc., Arbutus Biopharma Corporation, Vir Bio, Mirum Pharmaceuticals, Huahui Health, Aligos Therapeutics, Innovative Molecules and AiCuris Anti-infective Cures AG (Asahi Kasei, following its pending acquisition of AiCuris), among others.

Additionally, we may face competition from currently available HBV treatments.

14 unchanged sentences

We routinely review our employees’ base salaries to ensure they remain market competitive.

performance-based cash bonuses and long-term equity compensation increase as a percentage of total compensation based on employees’ levels of responsibility.

performance-based cash bonus targets and long-term equity compensation increase based on employees’ levels of responsibility.

We also offer comprehensive benefits packages to all of our employees, including:

11 unchanged sentences

The Reverse Stock Split was effective as of February 9, 2024, our common stock began trading on the Nasdaq Global Select Market on an as-split basis on February 12, 2024, and the Company regained compliance with the minimum bid price requirement of the Nasdaq Listing Rules on February 27, 2024, by having the closing bid price of our common stock exceed $1.00 for a minimum of ten consecutive trading days during the compliance period.

All share and per share amounts of our common stock presented in this Annual Report on Form 10-K have been adjusted to reflect the 1-for-12 Reverse Stock Split.

Corporate History

12 unchanged sentences

We use this website as a means of disclosing material information in compliance with our disclosure obligations under Regulation FD.

Accordingly, investors should monitor the “Investors” section of our website, in addition to following our press releases, Securities and Exchange Commission (SEC) filings, presentations and webcasts.

Accordingly, investors should monitor the “Investors” section of our website, in addition to following our press releases, SEC filings, presentations and webcasts.

We make available free of charge through our website our press releases, Annual Reports on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K and all amendments to those reports as soon as reasonably practicable after electronically filed with or furnished to the SEC.

1 unchanged sentence

The reports filed with the SEC by us and by our officers, directors and significant stockholders are available for review on the SEC’s website at www.sec.gov.

R isk Factors

Risk Fact ors

You should carefully consider the following risk factors, together with all other information in this report, including our consolidated financial statements and notes thereto, and in our other filings with the SEC.

5 unchanged sentences

We and our collaborators are not permitted to market or promote any products in the United States, Europe, China or other countries before we receive regulatory approval from the FDA or comparable foreign regulatory authorities, and we may never receive such regulatory approval for our current product candidates.

We have not submitted a new drug application (NDA) to the FDA or comparable applications to other regulatory authorities and do not expect to be in a position to do so in the near future.

We have not submitted an NDA to the FDA or comparable applications to other regulatory authorities and do not expect to be in a position to do so in the near future.

All our product candidates are in clinical development or in varying stages of nonclinical development.

Data supporting our clinical development programs are derived from nonclinical data that support our early stage clinical programs, which will determine whether pivotal studies are appropriate.

These pivotal studies are necessary to support regulatory approval, and it may be years before these larger, pivotal studies are completed, if ever.

Data supporting our clinical development programs are derived from nonclinical data that support our early stage clinical programs, which will determine whether larger, pivotal studies are appropriate.

These pivotal studies are necessary to support regulatory approval, and it may be years before these studies are completed, if ever.

In addition to our current product pipeline, we may identify, license or otherwise acquire rights to other technologies or product candidates.

5 unchanged sentences

All operations and capital expenditures will be funded from cash on hand, securities offerings, debt financings and payments we may receive from out-licenses, collaborations or other strategic arrangements.

Adverse geopolitical and macroeconomic developments, such as ongoing military conflicts, related sanctions, actual and anticipated changes in interest rates, economic inflation and the responses by central banking authorities to control such inflation, could affect our ability to access capital as and when needed.

Adverse geopolitical and macroeconomic developments, such as potential worsening global economic conditions or economic downturn, ongoing military conflicts, related sanctions, actual and anticipated changes in interest rates, economic inflation and the responses by central banking authorities to control such inflation, and tariffs or the imposition and enforceability of tariffs, trade wars, barriers or restrictions, or threats of such actions and the related uncertainty thereof including uncertainties regarding the ability to obtain refunds for previously paid tariffs that have subsequently been invalidated, could affect our ability to access capital as and when needed.

There is no assurance that we will be successful in raising any necessary additional capital on terms that are acceptable to us, or at all.

If we are unable to develop and commercialize any product candidates and generate sufficient revenue or raise capital, we could be forced to reduce staff, delay, scale back or discontinue product development and clinical studies, sacrifice attractive business opportunities, cease operations entirely and sell, or otherwise transfer, all or substantially all of our remaining assets, which would likely have a material adverse impact on our business, results of operations, financial condition and share price.

If we are unable to develop and commercialize any product candidates and generate sufficient revenue or raise capital, we could be forced to reduce staff, delay, scale back or discontinue product development and clinical studies, forego business opportunities, cease operations entirely and sell, or otherwise transfer, all or substantially all of our remaining assets, which would likely have a material adverse impact on our business, results of operations, financial condition and share price.

We expect our collaboration with Gilead to be a critical part of the development, manufacture and commercialization of our product candidates.

If this collaboration is unsuccessful, our business could be adversely affected.

to take an exclusive license, on a program-by-program basis, to all of our other current and future pipeline programs during the collaboration term.

In October 2023, we entered into the Gilead Collaboration Agreement with Gilead, whereby Gilead exclusively licensed to us its HPI program and NNPI program, while retaining opt-in rights to these programs, and has an option to take an exclusive license, on a program-by-program basis, to all of our other current and future pipeline programs during the collaboration term.

In connection with the entry into the Gilead Collaboration Agreement, we and Gilead also entered into a common stock purchase agreement and an investor rights agreement, which were both amended in June 2024.

1 unchanged sentence

In December 2024, Gilead purchased additional shares of our common stock at a premium pursuant to the terms of the common stock purchase agreement, and we amended the Gilead Collaboration Agreement in connection with an updated development plan for 6250.

In August 2025, Gilead purchased additional shares of our common stock and warrants to purchase additional shares of our common stock.

In December 2025, Gilead exercised its option and took an exclusive license to our HPI program, and in March 2026, Gilead declined to exercise its option to license 4334 or defer its option until completion of Phase 2 studies.

Our agreements and relationship with Gilead pose a number of risks, including, but not limited to, the following:

3 unchanged sentences

If we do not receive the funding we expect under these agreements, development of our investigational products could be delayed and we may need additional resources to develop our investigational products.

• We will be heavily dependent on Gilead for further development and commercialization of the investigational products from the programs that it opts into.

• We will be heavily dependent on Gilead for further development and commercialization of the investigational products from the programs that it opts into, including our HPI program, and transition of these programs to Gilead could delay these programs' clinical and approval timelines.

• We may not be successful in this collaboration due to various other factors, including our ability to demonstrate proof of concept in one or more clinical studies so that Gilead will exercise its option to these programs.

8 unchanged sentences

To meet these requirements, we must conduct extensive nonclinical and sufficient, well-controlled clinical studies.

The results of nonclinical studies may not be representative of disease behavior in a clinical setting and may not be predictive of the outcomes of our clinical studies.

The results of nonclinical studies may not be representative of the product candidates' behavior in a clinical setting and may not be predictive of the outcomes of our clinical studies.

In addition, the results of early clinical studies of product candidates may not be predictive of the results of later-stage clinical studies.

Conducting nonclinical and clinical studies is a lengthy, time consuming and expensive process.

The length of time varies substantially according to the type, complexity, novelty, and intended use of the product candidate, and often can be several years or more.

The length of time

varies substantially according to the type, complexity, novelty, and intended use of the product candidate, and often can be several years or more.

In addition, failure or delays can occur at any time during the nonclinical and clinical study process, resulting in additional operating expenses or harm to our business.

3 unchanged sentences

• failure to demonstrate efficacy or the emergence of unforeseen safety issues;

• insufficient quantities of qualified materials made using current good manufacturing practice (cGMP) for use in clinical studies due to manufacturing challenges, delays or interruptions in the supply chain;

• insufficient quantities of qualified materials made using cGMP for use in clinical studies due to manufacturing challenges, delays or interruptions in the supply chain;

• slower than expected rates of participant recruitment or failure to recruit a sufficient number of eligible participants, which may be due to a number of reasons, including the size of the participant population, the proximity of participants to clinical sites, the eligibility criteria for the study, the design of the clinical study, and other potential drug candidates being studied;

• fewer available study sites due to changes in government funding of clinical research;

• fewer available study sites and academic lab facilities due to changes in government funding of clinical research;

• delays in participants completing participation in a study or return for post-treatment follow-up for any reason, including, product side effects or disease progression;

• modification of clinical study protocols;

• problems with the integrity of data collected in the study;

• delays, suspension, or termination of clinical studies by the institutional review board or ethics committee responsible for overseeing the study at a particular study site;

8 unchanged sentences

Our reliance on CROs reduces our control over these activities but does not relieve us of our responsibilities.

For example, we are responsible for ensuring that each of our studies is conducted in accordance with the applicable protocol, legal and regulatory requirements and scientific standards, including, in the case of clinical studies, good clinical practices, even if the study is conducted by a CRO.

In the event CROs fail to perform their duties in such a fashion or we are unable to retain or continue with CROs on acceptable terms, we may be unable to complete our clinical studies and may fail to obtain regulatory approval for our product candidates.

1 unchanged sentence

CRO personnel are not our employees, and except for remedies available to us under our agreements with such third parties, we cannot control whether they devote sufficient time and resources to our clinical and nonclinical studies.

If these CROs do not successfully carry out their contractual duties or obligations or meet expected deadlines, if they need to be replaced or if the quality or accuracy of the clinical data they obtain is compromised due to the failure to adhere to our clinical protocols, regulatory requirements, including good clinical practices, or for other reasons, our research, nonclinical or clinical studies may be extended, delayed or terminated and we may not be able to obtain, or may be delayed in obtaining, regulatory approvals for our product candidates, any of which could materially harm our business, prospects, financial condition and results of operations.

If these CROs do not successfully carry out their contractual duties or obligations or meet expected deadlines, if they need to

be replaced or if the quality or accuracy of the clinical data they obtain is compromised due to the failure to adhere to our clinical protocols, regulatory requirements, including GCPs, or for other reasons, our research, nonclinical or clinical studies may be extended, delayed or terminated and we may not be able to obtain, or may be delayed in obtaining, regulatory approvals for our product candidates, any of which could materially harm our business, prospects, financial condition and results of operations.

Furthermore, we are exposed to a number of risks related to our CROs, vendors, suppliers and other service providers that are located outside of the United States, many of which may be beyond our control.

These risks include:

• business interruptions resulting from geopolitical actions such as the war between Russia and Ukraine, the conflicts in the Middle East, the rising tensions between China and Taiwan, as well as tariffs, other wars, acts of terrorism, natural disasters or outbreaks of disease;

• different regulatory requirements for drug approvals or increased scrutiny on CROs located in foreign countries, including China;

• business interruptions resulting from geopolitical actions such as the war between Russia and Ukraine, the conflicts in the Middle East, including the recent hostilities involving Iran, and in Venezuela, tensions between China and Taiwan, as well as trade tension and/or the imposition and enforceability of tariffs (including tariffs that have been or may be in the future imposed by the United States and other countries and uncertainties regarding the ability to obtain refunds for previously paid tariffs that have subsequently been invalidated), other wars, acts of terrorism, natural disasters or outbreaks of disease;

• increased scrutiny or prohibitions on CROs located in foreign countries, including China;

• different regulatory requirements for drug approvals;

• different standards of care in various countries that could complicate the evaluation of our product candidates;

3 unchanged sentences

• reduced protection for intellectual property rights in certain countries;

• Changes in economic policies by the U.S.

or foreign governments, which may result in new or unexpected changes in tariffs, trade barriers or regulatory requirements;

• changes in trade, economic or other policies by the U.S.

or foreign governments, which may result in new or unexpected changes in tariffs, trade wars, barriers or restrictions, or regulatory requirements;

• compliance with the United States Foreign Corrupt Practices Act (the FCPA) and other anti-corruption and anti-bribery laws;

2 unchanged sentences

• foreign currency fluctuations and compliance with foreign currency exchange rules, which could result in increased operating expenses and reduced revenues, and other obligations incident to doing business in another country.

The ongoing shutdown of the U.S.

Department of Homeland Security (DHS) could prevent the U.S.

Customs and Border Protection (CBP) from performing normal business functions on which the operation of our business relies, which could negatively impact our business.

The ongoing DHS shutdown has resulted in agencies, such as CBP, have been deemed “essential” and are continuing to operate.

Disruptions at the CBP and other agencies, including furloughs and reductions in workforce, are subject to the political process, which is inherently unpredictable.

Although we have yet to encounter significant delays at ports of entry due to the shutdown, in past government shutdowns, CBP delays were common in areas requiring manual review or discretionary approvals.

If the current shutdown continues, the resulting delays and other disruptions could have a material adverse effect on our business.

Our clinical studies require shipping clinical samples from our clinical study sites around the world to the United States for analysis and processing.

CBP delays in import operations and CBP delays in inspecting imports, including difficulties with these samples clearing customs, may delay or otherwise adversely affect our ongoing clinical studies and their timelines, many of which have been communicated publicly.

Top-line, preliminary or interim data may not accurately reflect the final results of a particular study.

17 unchanged sentences

• Any third-party manufacturers with whom we contract might be unable to formulate and manufacture our product candidates in the volume and quality required to meet our nonclinical, clinical and, if approved, commercial needs in a timely manner.

• Any third-party manufacturers with whom we contract might be unable to manufacture or obtain from other third parties the active pharmaceutical ingredient needed to manufacture the finished dosage form of our product candidates.

• Any third-party manufacturers with whom we contract might not perform as agreed or might not remain in the contract manufacturing business for the time required to supply our products.

6 unchanged sentences

regulatory authorities and the commercialization of our product candidates.

Furthermore, reductions in workforce at the FDA may lead to delays in inspecting facilities and, in turn, delayed FDA approvals for manufacturing changes.

Furthermore, workforce reductions at the FDA, and any future reductions of staffing or other resources at the FDA, may lead to delays in inspecting facilities and, in turn, delayed FDA approvals for manufacturing changes.

This could result in higher costs or deprive us of potential product revenues and materially harm our business, financial condition and results of operations.

20 unchanged sentences

If we are unable to reach agreement on favorable terms with a suitable collaboration partner for any of our product candidates that Gilead declines to opt into, we may need to limit the number of our product candidates to advance through further nonclinical or clinical development.

Failure to achieve such successful collaborations would limit our options for support of the development and commercialization of our programs and for financing and would likely have a material adverse impact on our business, results of operations, financial condition and share price.

Failure to achieve such successful collaborations would limit our

options for support of the development and commercialization of our programs and for financing and would likely have a material adverse impact on our business, results of operations, financial condition and share price.

We rely on data provided by third parties that has not been independently verified and could prove to be false, misleading, or incomplete.

1 unchanged sentence

If these third parties provide inaccurate, misleading, or incomplete data, our business, prospects, and results of operations could be materially and adversely affected.

Significant disruptions of information technology systems or breaches of data security, including cybersecurity incidents, could materially and adversely affect our business, results of operations and financial condition.

We collect and maintain information in digital form and are increasingly dependent on information technology systems and infrastructure to operate our business.

In the ordinary course of our business, we collect, store and transmit large amounts of confidential information, including intellectual property, proprietary business information and personal information.

It is critical that we do so in a secure manner to maintain the confidentiality and integrity of such confidential information.

We have outsourced elements of our information technology infrastructure and, as a result, a number of third-party vendors may or could have access to our confidential information.

Our internal information technology systems and infrastructure, and those of our current and any future collaborators, contractors and consultants and other third parties on which we rely, are vulnerable to damage from computer viruses, malware, natural disasters, system outages, terrorism, war, telecommunication and electrical failures, cyberattacks, cybersecurity

incidents or cyber intrusions over the Internet, attachments to emails, persons inside our organization, or persons with access to systems inside our organization.

The risk of a cybersecurity incident or security breach or disruption, particularly through cyberattacks or cyber intrusion, has escalated as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased.

In addition, the prevalent use of mobile devices that access confidential information increases the risk of data security breaches, which could lead to the loss of confidential information or other intellectual property.

The costs to us to mitigate network security problems, bugs, viruses, worms, malicious software programs, system outages and security vulnerabilities or incidents could be significant, and our efforts to address these problems may not be successful.

If unsuccessful, these problems could cause interruptions, delays, cessation of service and other harm to our business and our competitive position, including material disruption of our product development programs.

For example, any loss of clinical study data from completed or ongoing or planned clinical studies could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data.

If a computer security breach affects our systems or results in the unauthorized release of personally identifiable information, our reputation could be materially damaged.

In addition, such a breach may require notification to governmental agencies, the media or individuals pursuant to various federal, state and non-U.S.

privacy and security laws, if applicable, including the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Clinical Health Act of 2009, and its implementing rules and regulations, as well as regulations promulgated by the Federal Trade Commission, state breach notification law and the European Union (EU) General Data Protection Regulation (EU GDPR).

We would also be exposed to a risk of loss or litigation and potential liability, which could materially adversely affect our business, results of operations and financial condition.

Research, development and commercialization goals, including data releases, may not be achieved in the timeframes that we publicly estimate, which could have an adverse impact on our business and could cause our stock price to decline.

13 unchanged sentences

Moreover, our success depends upon physicians prescribing, and their patients being willing to receive, treatments that involve the use of our product candidates we may develop in lieu of, or in addition to, existing treatments with which they are already familiar and for which more clinical data may be available.

Adverse events in our nonclinical or clinical studies or those of our competitors or of academic researchers utilizing the same MOA as our product candidates, even if not ultimately attributable to our product candidates, and any resulting publicity could result in increased governmental regulation, larger, more complex, or an increased number of clinical trial requirements, unfavorable public perception, potential regulatory delays in the testing or approval of our product candidates, stricter labeling requirements for our product candidates that are approved, if any, and a decrease in demand for any such products.

Adverse events (AEs) in our nonclinical or clinical studies or those of our competitors or of academic researchers utilizing the same MOA as our product candidates, even if not ultimately attributable to our product candidates, and any resulting publicity could result in increased governmental regulation, larger, more complex, or an increased number of clinical trial requirements, unfavorable public perception, potential regulatory delays in the testing or approval of our product candidates, stricter labeling requirements for our product candidates that are approved, if any, and a decrease in demand for any such products.

We collect and maintain information in digital form and are increasingly dependent on information technology systems and infrastructure to operate our business.

In the ordinary course of our business, we collect, store and transmit large

amounts of confidential information, including trade secrets, other proprietary business information and confidential personal data.

We rely on information technology systems that we or our third-party providers operate to process, transmit and store electronic information and otherwise to conduct our day-to-day operations (including confidential business, personal and patient health information in connection with our preclinical and clinical studies and our employees), which information technology systems may become subject to cyberattacks and other security breaches, and system outages.

The information technology systems and infrastructure of our current and any future collaborators, contractors and consultants and other third parties on which we rely, are also vulnerable to such incidents.

The risk of a cybersecurity incident or security breach or disruption, particularly through cyberattacks or cyber intrusion, has escalated as the frequency, intensity and sophistication of attempted attacks and intrusions from around the world have increased, become increasingly difficult to detect and could be enhanced or facilitated by artificial intelligence.

In addition, the prevalent use of mobile devices that access confidential information increases the risk of data security breaches.

A successful cyberattack could cause serious negative consequences for us, including, without limitation, the disruption of operations, the theft, misappropriation, destruction or other compromises of confidential or proprietary information (including financial information, corporate strategic plans, trade secrets and other intellectual property and data), improper access to, use or disclosure of personal and patient health information, other misappropriation of assets, and financial loss.

Although we devote resources to protect our information systems, we realize that cyberattacks remain a threat, and there can be no assurance that our efforts (or those of our employees, contractors, consultants and the third-party providers on which we rely) will prevent security breaches that would result in business, legal, financial or reputational harm to us, or would have a material adverse effect on our results of operations and financial condition.

In addition, although we carry cyber insurance, in the event of a material security incident, such coverage may not be sufficient to cover all losses.

Any failure to prevent or mitigate security breaches or improper access to, use of, or disclosure of our clinical data or patients’ personal data could result in significant liability under various U.S.

state and federal laws and regulations and laws of foreign jurisdictions regarding data privacy and security (or require notification to governmental agencies, the media or individuals pursuant to such laws) and may cause a material adverse impact to our reputation, affect our ability to use collected data, conduct new studies and potentially disrupt our business.

Our internal computer systems, or those of our third-party CROs or other contractors or consultants, may fail or suffer other disruptions, which could result in a material disruption of our current or future product candidates’ development programs.

Despite the implementation of security, business continuity and back-up measures, in addition to cyberattacks and security incidents described above, our internal computer systems and those of our third-party CROs and other contractors and consultants are vulnerable to damage from natural disasters, terrorism, war and telecommunication and electrical failures.

While we have not experienced any such system failure, or accident to date, if such an event were to occur and cause interruptions in our operations (or those of our business partners or other third parties on which we rely), it could result in a material disruption of our programs.

To the extent that any such disruption results in a loss of or damage to our data or applications, other data or applications relating to our technology or current or future product candidates, or inappropriate disclosure of confidential or proprietary information, we could incur liabilities and the further development of our current or future product candidates could be delayed.

Our ability to use our net operating loss and credit carryforwards and certain other tax attributes may be limited.

2 unchanged sentences

Under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended (the Code), a corporation that undergoes an “ownership change” (generally defined as a greater than 50% change (by value) in its equity ownership over a three-year period) is subject to annual limitations on its ability to use its pre-change net operating loss carryforwards and other pre-change tax attributes (such as research tax credits) to offset its post-change income or taxes.

We have experienced ownership changes in the past, and future equity issuances may result in additional ownership change.

We have experienced ownership changes in the past, most recently in August 2025, and future equity issuances may result in additional ownership change.

Accordingly, some of our net operating losses or credits could expire unutilized, and our ability to utilize our net operating losses or credits to offset U.S.

4 unchanged sentences

Our product candidates are subject to extensive and rigorous domestic government regulation, including regulation by the FDA, the Centers for Medicare and Medicaid Services, other divisions of the U.S.

Department of Health and Human Services, the U.S.

Department of Health and Human Services (HHS), the U.S.

Department of Justice, state and local governments, and their respective foreign equivalents.

23 unchanged sentences

The FDA has substantial discretion in the approval process and might require us to conduct additional nonclinical and clinical testing, perform post-marketing studies or otherwise limit or impose conditions on any approval we obtain.

The ability of the FDA to review and approve new products can be affected by a variety of factors, including government budget and funding levels, authorization and payment of user fees, the ability to hire and retain key personnel, as well as other statutory, regulatory and policy changes.

The ability of the FDA to review and approve new products has been in the past and may in the future be affected by a variety of factors, including government budget and funding levels, authorization and payment of user fees, the ability to hire and retain key personnel, as well as other statutory, regulatory and policy changes.

In addition, funding of other government agencies that support research and development activities that pertain to FDA review, such as research to understand new technologies or establish new standards, can shift in response to changing administrative policies and priorities.

Such policy shifts, including efforts to downsize the federal workforce, remove job elimination protections for federal workers, limit certain communications, and potentially interfere with user fee reauthorization, may affect the FDA review process and average review times at the FDA may fluctuate as a result.

If a prolonged government shutdown or a widespread freeze on federal funding occurs, it could significantly impact the ability of the FDA to timely review and process our regulatory submissions, the National Institutes of Health to conduct research or provide grants, or other agencies that support the FDA to slow their work.

Such policy shifts, including, for example, the recent efforts to downsize the federal workforce by restructuring the HHS and eliminating positions at the FDA, including teams critical to the FDA's ability to conduct regular inspections, reviews and other regulatory activities, such as issuing guidance for industry and regulations, and

other federal agencies, may affect the timelines, completeness or duration of the FDA review process.

In addition, the HHS may change the user fee reauthorization process or fail to reauthorize user fee programs.

As a result, average review times at the FDA may fluctuate, and the outcome of any such review process may be impacted.

A prolonged government shutdown or a widespread freeze on federal funding could also significantly impact the ability of the FDA to timely review and process our regulatory submissions and the National Institutes of Health to conduct research or provide grants, or cause other agencies that support the FDA to slow their work.

In addition, if future legislation or administrative action or changes in FDA policy prevent the FDA or other regulatory authorities from conducting routine inspections, reviews, or other regulatory activities, it could significantly impact the ability of the FDA to timely review and process our regulatory submissions, which could have a material adverse effect on our business.

7 unchanged sentences

We cannot assure you that we will receive the approvals necessary to commercialize our product candidates for sale outside the United States.

We and our third-party partners and service providers are subject to stringent privacy laws, information security laws, regulations, policies and contractual obligations related to data privacy and security, and compliance with such laws, regulations, policies and contractual obligations could result in additional costs and liabilities to us and failure to comply could adversely affect our business, financial condition, results of operations and prospects.

We maintain and process certain confidential, sensitive, or personal information in the operation of our business, and rely on certain third-party vendors to process confidential, sensitive or personal information on our behalf, including in the conduct of our clinical trials.

We and our third party partners and service providers, including our CROs and other vendors and contractors, are subject to data privacy and security laws and regulations that govern the collection, transmission, storage, use, processing, destruction, retention and security of personal information, including additional laws or regulations relating to health information.

The legislative and regulatory landscape for privacy and data protection continues to evolve in jurisdictions worldwide, and these laws may at times be conflicting.

It is possible that these laws may be interpreted or applied in a manner that is inconsistent with the practices we or our third party partners maintain, and any of our efforts to comply with the evolving data protection rules may be unsuccessful.

Neither we nor our third party partners can guarantee that we or they are and have been in compliance with all applicable data privacy and protection laws, rules regulations, policies and standards.

We may need to devote significant resources to seek to understand and comply with this changing landscape, and it is possible that these ongoing compliance efforts may be costly and require modifications to our policies, procedures and systems over time.

Failure, or perceived failure, by us or our third-party partners and service providers to comply with laws and regulations regarding privacy and security of personal information could result in penalties under such laws, such as orders requiring a change in business practices, claims for damages or other liabilities, government investigations and enforcement actions, litigation and significant costs for remediation, any of which could adversely affect our business.

Even if it is determined that there was no violation of these laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity.

Any resulting enforcement actions against us or our third party partners could lead to the imposition of fines, criminal prosecution of employees, claims for damages by affected individuals and reputational damage and loss of goodwill.

Additionally, if we and any CROs or third parties we use to conduct clinical trials, are unable to properly protect the privacy and security of personal information, including protected health information, we and they could be found to have breached our and their contracts with certain third parties.

There are numerous U.S.

federal and state laws and regulations related to the privacy and security of personal information.

In particular, the Health Insurance Portability and Accountability Act (HIPAA), as amended by HITECH and their respective implementing regulations, establish privacy and security standards for Covered Entities and Business Associates (as defined by HIPAA) that limit the use and disclosure of individually identifiable health information, or protected health information, and require the implementation of administrative, physical and technological safeguards to protect the privacy of protected health information and ensure the confidentiality, integrity and availability of electronic protected health information.

We do not believe that we are currently acting as a covered entity or business associate under HIPAA and thus are not directly subject to its requirements or penalties.

we may obtain health information from third parties, including research institutions from which we obtain clinical trial data, that are subject to privacy and security requirements under HIPAA.

Determining whether protected health information has been handled in compliance with applicable privacy standards and contractual obligations can be complex and may be subject to changing interpretation.

If we or our third party partners fail to comply with applicable privacy laws, including applicable HIPAA privacy and security standards, we could face civil and criminal penalties.

HHS enforcement activity can result in financial liability and reputational harm, and responses to such enforcement activity can consume significant internal resources;

the HHS also has discretion to impose penalties without attempting to first resolve violations.

In addition, state attorneys general are authorized pursuant to certain federal and state laws to bring civil actions seeking either injunctions or damages in response to violations that threaten the privacy of state residents.

We cannot be sure how these laws and regulations will be interpreted, enforced or applied to our operations or the operations of our third party partners.

state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to sensitive and personal information than international, federal, or other state laws, and such laws may differ from each other, which may complicate compliance efforts.

For example, in June 2018, California enacted the California Consumer Privacy Act (CCPA), which broadly defines personal information, gives California residents expanded privacy rights and protections, including the right to access and delete certain personal information, as well as the right to opt-out of certain sales of personal information, and provides for civil penalties for violations and a private right of action for data breaches.

Additional states have passed privacy laws, such as the Virginia Consumer Data Protection Act and the Colorado Privacy Act, which are similar to the CCPA.

Such new privacy laws add further complexity in interpreting and implementing data privacy requirements and restrictions and thus create additional potential legal risk, require additional investment in resources for compliance programs, and could impact business strategies and the availability of previously useful data.

This complexity applies to data security as well.

Certain other states, including California, Massachusetts and Nevada have adopted laws requiring the implementation of certain security measures to protect personal information, and all 50 states and the District of Columbia, Puerto Rico, the U.S.

Virgin Islands and Guam have adopted laws including obligations to provide notification of security breaches of computer databases that contain personal information to affected individuals, state officers and others.

We may also be subject to U.S.

federal rules, regulations and guidance with respect to data privacy and security practices.

According to the Federal Trade Commission (FTC), failing to take appropriate steps to keep consumers’ personal information secure constitutes unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act, 15 U.S.C § 45(a).

The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities.

These federal and state laws regarding data privacy and security may differ from one another, and the interplay between them may be subject to varying interpretations by courts and government agencies, increasing our costs of compliance and exposing us to potential legal risk.

In the European Union (EU), the processing of personal data, including personal health data, is governed by the provisions of the EU General Data Protection Regulation (EU GDPR), in addition to other applicable laws and regulations.

The EU GDPR, together with national legislation, regulations and guidelines of the EU Member States governing the processing of personal data, impose strict obligations with respect to, and restrictions on, the collection, use, retention, protection, disclosure, transfer and processing of personal data.

The EU GDPR also imposes strict rules on the transfer of personal data to countries outside the EU that are not deemed to have adequate protections for personal information, including the United States.

The EU GDPR authorizes fines for certain violations that are in addition to any civil litigation claims by data subjects.

Separately, Brexit has led and could lead to further legislative and regulatory changes and may increase our compliance costs.

Data processing in the United Kingdom (UK) is governed by the UK General Data Protection Regulation (UK GDPR), creating two parallel regimes, each of which authorizes similar fines and other potentially divergent enforcement actions for certain violations.

Failure to comply with the EU GDPR or the UK GDPR can result in significant fines and other liability, including, under the EU GDPR, fines of up to €20 million (or £17.5 million under the UK GDPR) or four percent (4%) of global revenue, whichever is greater.

Other jurisdictions worldwide are similarly introducing or enhancing privacy and data security laws, rules and regulations, which could increase our compliance costs and the risks associated with noncompliance.

Compliance with data protection laws and regulations in the U.S.

and internationally could require us to take on more onerous obligations in our contracts, restrict our ability to collect, use and disclose data, or in some cases, impact our ability

to operate in certain jurisdictions.

Although we work to comply with applicable laws, regulations and standards, our contractual obligations and other legal obligations, these requirements are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another or other legal obligations with which we must comply.

Any failure or perceived failure by us or our employees, representatives, contractors, consultants, CROs, collaborators, development partners or other third party partners and service providers to comply with such requirements or adequately address privacy and security concerns, even if unfounded, could have a material adverse effect on our business, financial condition, results of operations and prospects.

We cannot guarantee that we and our employees, representatives, contractors, consultants, CROs, collaborators, development partners and other third parties on whom we rely are, and will be, in compliance with all applicable international laws and regulations as they are enforced now or as such laws and regulations evolve or are interpreted.

We and our collaborators may be subject, directly or indirectly, to applicable U.S.

federal and state anti-kickback, false claims laws, physician payment transparency laws, fraud and abuse laws or similar healthcare and security laws and regulations, and health information privacy and security laws, which could expose us or them to criminal sanctions, civil penalties, exclusion or suspension from federal and state healthcare programs, contractual damages, reputational harm and diminished profits and future earnings.

federal and state anti-kickback, false claims laws, physician payment transparency laws, other fraud and abuse laws or similar healthcare and security laws and regulations, and health information privacy and security laws, which could expose us or them to criminal sanctions, civil penalties, exclusion or suspension from federal and state healthcare programs, contractual damages, reputational harm and diminished profits and future earnings.

Healthcare providers, physicians and others play a primary role in the recommendation and prescription of any products for which we obtain regulatory approval.

3 unchanged sentences

These laws may impact, among other things, our proposed sales, marketing and education programs.

For example, there are federal and state healthcare laws and regulations that govern prescription drug marketing practices, including off-label promotion, and increased scrutiny of direct-to-consumer advertisements.

In addition, we may be subject to patient privacy regulation by both the federal government and the states and foreign jurisdictions in which we conduct our business.

If we fail to comply with any applicable federal, state or foreign legal requirement, we could be subject to penalties.

Regulators globally are imposing greater monetary fines for privacy violations.

The EU GDPR applies to any company established in the EU as well as to those outside the EU if they collect and use personal data in connection with the offering of goods or services to individuals in the EU or the monitoring of their behavior.

The EU GDPR enhances

data protection obligations for processors and controllers of personal data, including, for example, expanded disclosures about how personal information is to be used, limitations on retention of information, mandatory data breach notification requirements and onerous new obligations on services providers.

Noncompliance with the EU GDPR may result in monetary penalties of up to €20 million or 4% of worldwide revenue, whichever is higher.

The EU GDPR may increase our responsibility and liability in relation to personal data that we process and we may be required to put in place additional mechanisms to ensure compliance with the EU GDPR, including as implemented by individual countries.

Compliance with the EU GDPR and other changes in laws or regulations associated with the enhanced protection of certain types of personal data, such as healthcare data or other sensitive information, could greatly increase our cost of developing our products or even prevent us from offering certain products in jurisdictions that we may operate in.

The California Consumer Privacy Act (CCPA) also created new individual privacy rights for California consumers (as defined in the law) and places increased privacy and security obligations on entities handling personal data of consumers or households.

While there is currently an exception for protected health information that is subject to HIPAA and clinical study regulations, as currently written, the CCPA may impact our business activities.

The uncertainty surrounding the implementation of the CCPA exemplifies the vulnerability of our business to the evolving regulatory environment related to personal data and protected health information.

Because of the breadth of these laws and the narrowness of the statutory exceptions and safe harbors available, it is possible that some of our business activities could be subject to challenge under one or more of such laws.

16 unchanged sentences

In addition, the federal, state and local laws and regulations governing the use, manufacture, storage, handling and disposal of hazardous or radioactive materials and waste products might require us to incur substantial compliance costs that could materially and adversely affect our business, financial condition and results of operations.

Our employees, independent contractors, consultants, collaborators and CROs may engage in misconduct or other improper activities, including noncompliance with regulatory standards and requirements, which could result in significant liability for us and harm our reputation.

Our employees, independent contractors, consultants, collaborators and CROs may engage in misconduct or other improper activities, including noncompliance with regulatory standards and requirements for which we may be held responsible and which could result in significant liability for us and harm our reputation.

We are exposed to the risk of fraud or other misconduct, including failure to:

23 unchanged sentences

Method-of-use patents protect the use of a product for the specified method(s) and do not prevent a competitor from making and marketing a product that is identical to our product for an indication that is outside the scope of the patented method.

Formulation patents protect the formulation of a product and do not prevent a competitor from making and marketing a product that has an identical active pharmaceutical ingredient to

our product if the product is formulated differently than the patented formulation.

Formulation patents protect the formulation of a product and do not prevent a competitor from making and marketing a product that has an identical active pharmaceutical ingredient to our product if the product is formulated differently than the patented formulation.

We rely on a combination of these and other types of patents to protect our product candidates, and there can be no assurance that our intellectual property will create and sustain the competitive position of our product candidates.

20 unchanged sentences

Our competitors may have filed, and may in the future file, patent applications covering products and technologies similar to ours.

Any such patent application may have priority over our patent applications, which could further require us to obtain rights from third parties to issued patents covering such products and technologies.

Any such patent application may have priority over our patent applications, which could further require us to

obtain rights from third parties to issued patents covering such products and technologies.

We cannot guarantee that the manufacture, use or marketing of any product candidates that we develop will not infringe third-party patents.

24 unchanged sentences

Risks Related to Our Common Stock

The price of our common stock might fluctuate significantly, and you could lose all or part of your investment.

The price of our common stock has in the past and may continue to fluctuate significantly, and you could lose all or part of your investment.

The price of our common stock fluctuates widely.

Continued volatility in the market price of our common stock might prevent a stockholder from being able to sell shares of our common stock at or above the price paid for such shares.

The trading price of our common stock may continue to be volatile and subject to wide price fluctuations in response to various factors, many of which are beyond our control, such as the progress, results and timing of our clinical and nonclinical studies and other studies involving our product candidates, the success or failure of our product candidates, the receipt or loss of required regulatory approvals for our product candidates, the availability of capital or the other risks discussed in this “Risk Factors” section.

The trading price of our common stock has in the past and may continue to be volatile and subject to wide price fluctuations in response to various factors, many of which are beyond our control, such as the progress, results and timing of our clinical and nonclinical studies and other studies involving our product candidates, the success or failure of our product candidates, the receipt or loss of required regulatory approvals for our product candidates, the availability of capital or the other risks discussed in this “Risk Factors” section.

Our amended and restated bylaws provide that the Court of Chancery of the State of Delaware will be the sole and exclusive forum for certain types of actions and proceedings that may be initiated by our stockholders, which could limit our stockholders’ ability to bring a claim in a judicial forum they find favorable for disputes with us or our directors, officers or other employees.

18 unchanged sentences

infrastructure security systems;

and cyber threat operations with regular monitoring and threat hunting.

and cyber threat operations with regular monitoring and threat hunting, including system penetration tests through a third-party service provider.

This program includes processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers.

4 unchanged sentences

Cybersecurity is integrated into our overall risk management systems, including our annual enterprise risk management, internal controls, business continuity and crisis management, third-party risk management, insurance risk management, and employee compliance processes.

Our Cyber Incident Response Team, comprised of our Vice President, General Counsel and Corporate Secretary, our Executive Director, Accounting and Treasury, and our Executive Director, Information Technology, consults with, or provides input to each of these programs to ensure that material risks from cybersecurity threats are appropriately assessed, identified, and managed.

Our Cyber Incident Response Team, comprised of our Vice President, General Counsel and Corporate Secretary, our Vice President, Finance, and our Executive Director, Information Technology, consults with, or provides input to each of these programs to ensure that material risks from cybersecurity threats are appropriately assessed, identified, and managed.

As of the date of this report, there have been no cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business, strategy, results of operations, or financial condition.

8 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business