ASTROTECH Corp 10-K

Item 1. Business   Our Company   Astrotech Corporation (Nasdaq: ASTC) (“Astrotech,” the “Company,” “we,” “us,” or “our”), a Delaware corporation organized in 1984, is a mass spectrometry company that launches, manages, and commercializes scalable companies based on its innovative core technology.   Our efforts are focused on commercializing our platform mass spectrometry technology through our wholly-owned subsidiaries:     ● Astrotech Technologies, Inc. (“ATI”) owns and licenses the intellectual property related to the Astrotech Mass Spectrometer Technology™ (the “AMS Technology”).     ● 1 st  Detect Corporation (“1 st  Detect”) is a manufacturer of explosives trace detectors capable of also detecting narcotics. It was developed for use at airports, cargo and other secured facilities, and borders worldwide. 1 st  Detect holds an exclusive AMS Technology license from ATI for air passenger and cargo security applications.     ● AgLAB, Inc. (“AgLAB”) is developing a series of mass spectrometers for use in the hemp and cannabis market with initial focus on optimizing yields in the distillation processes. AgLAB holds an exclusive AMS Technology license from ATI for agriculture applications.     ● BreathTech Corporation (“BreathTech”) is developing a breath analysis tool to screen for volatile organic compound (“VOC”) metabolites found in a person’s breath that could indicate a compromised condition including but not limited to a bacterial or viral infection. BreathTech holds an exclusive AMS Technology license from ATI for breath analysis applications.   Business and Recent Developments   On November 23, 2022, the Company announced a Reverse Stock Split.  The Board approved the Reverse Stock Split at a ratio of 1-for-30.  Each 30 shares of the Company’s issued and outstanding common stock was automatically combined into one validly issued, fully paid and non-assessable share of common stock.  The split brought the Company into compliance with the minimum bid price requirements for maintaining its listing in The Nasdaq Capital Market.    On December 21, 2022, the Company announced the adoption of a Rights Agreement with American Stock Transfer & Trust Company, LLC.  The Rights Plan is intended to protect the interests of all stockholders and enable all Company stockholders to realize the long-term value of their investment.  Stockholder interests are protected by reducing the likelihood that any person or group could gain control of the Company through rapid open-market purchases of the Company’s shares without paying an appropriate premium.    On February 1, 2023, the Company announced the appointment of Bob McFarland to the Board of Directors.  Mr. McFarland brings extensive domestic and international executive management experience, with a focus on information technology.   He brings experience working with and for the federal government, as well as leading companies in the industry.   On February 6, 2023, the Company announced the appointment of Thomas B. Pickens III as Chief Technology Officer of the Company. Mr. Pickens has been a valued team member in the discovery and development of the method to detect the compounds associated with COVID-19 lung infections. Mr. Pickens also leads the team that is developing applications for the AMS Technology in the distillation of essential oils using molecular distillation systems, including the manufacturing of hemp and cannabis oils. Mr. Pickens has been instrumental in the Company’s process to accurately qualify and quantify chemical compounds using our technology.     On May 8, 2023, the Company announced that it has accepted a purchase order from a Romanian based company focused on research and innovation in the security and telecommunications space.  The Company is required to deliver 17 TRACER 1000 explosive trace detectors over the remainder of the calendar year 2023. As of the date of this filing, the TRACER 1000 is deployed in 29 locations across 14 countries throughout Europe and Asia.   On May 9, 2023, the Company confirmed the results from field trials using the AgLAB 1000-D2™ mass spectrometer and the Maximum Value Process™ testing method (“AgLAB MVP”). AgLAB MVP is designed to improve yields and bottom-line profits for hemp (CBD) and cannabis (THC) producers of distilled oils.   6 Table of Contents   Our Business Units   Astrotech Technologies, Inc.   ATI owns and licenses the AMS Technology, the platform mass spectrometry technology originally developed by 1st Detect. The AMS Technology has been designed to be inexpensive, smaller, and easier to use when compared to traditional mass spectrometers. Unlike other technologies, the AMS Technology works under ultra-high vacuum, which eliminates competing molecules, yielding higher resolution and fewer false alarms. The intellectual property includes 18 patents granted along with extensive trade secrets. With a number of diverse market opportunities for the core technology, ATI is structured to license the intellectual property for different fields of use. ATI currently licenses the AMS Technology to three wholly-owned subsidiaries of Astrotech on an exclusive basis, including to 1st Detect for use in the security and detection market, to AgLAB for use in the agriculture market, and to BreathTech for use in breath analysis applications.   ATI has contracted with various vendors to assist with the further development of our mass spectrometer products including the manufacturability and reliability of our systems.    1 st Detect Corporation   1st Detect, a licensee of ATI for the security and detection market, has developed the TRACER 1000™, the world’s first mass spectrometry (“MS”) based explosives trace detector (“ETD”) certified by the European Civil Aviation Conference (“ECAC”). The TRACER 1000 was designed to outperform the ETDs currently used at airports, cargo and other secured facilities, and borders worldwide. The Company believes that ETD customers are unsatisfied with the currently deployed ETD technology, which is driven by ion mobility spectrometry (“IMS”). The Company further believes that some IMS-based ETDs have issues with false positives, as they often misidentify personal care products and other common household chemicals as explosives, causing facility shutdowns, unnecessary delays, frustration, and significant wasted security resources. In addition, there are hundreds of different types of explosives, but IMS-based ETDs have a very limited threat detection library reserved only for those few explosives of largest concern. Adding additional compounds to the detection library of an IMS-based ETD fundamentally reduces the instrument’s performance, further increasing the likelihood of false alarms. In contrast, adding additional compounds to the TRACER 1000’s detection library does not degrade its detection capabilities, as it has a virtually unlimited and easily expandable threat library.   In order to sell the TRACER 1000 to airport and cargo security customers in the European Union and certain other countries, we obtained ECAC certification. The Company is currently selling the TRACER 1000 to customers who accept ECAC certification.  As of June 30, 2023, the Company has deployed the TRACER 1000 in approximately 29 locations in 14 countries throughout Europe and Asia.   In the United States, the Company is working with the U.S. Transportation Security Administration (“TSA”) towards air cargo certification. On March 27, 2018, the Company announced that the TRACER 1000 was accepted into TSA’s Air Cargo Screening Technology Qualification Test (“ACSQT”) and, on April 4, 2018, the Company announced that the TRACER 1000 entered into testing with the TSA for passenger screening at airports. On November 14, 2019, the Company announced that the TRACER 1000 had been selected by the TSA’s Innovation Task Force to conduct live checkpoint screening at Miami International Airport. With similar protocols as ECAC testing, the Company has received valuable feedback from all programs. Following ECAC certification and the Company’s early traction within the cargo market, testing for cargo security continued with the TSA. With the COVID-19 pandemic, all testing within the TSA was put on hold; however, cargo testing resumed during the summer of 2020, and the Company subsequently announced on September 9, 2020 that the TRACER 1000 passed the non-detection testing portion of the TSA’s ACSQT. Due to delays caused by COVID-19, TSA cargo detection testing is ongoing, but has proceeded much more slowly than originally anticipated. As a result, efforts are primarily focused on our other opportunities. TSA cargo detection testing is the final step to be listed on the Air Cargo Screening Technology List as an “approved” device. If approved, the TRACER 1000 will be approved for cargo sales in the United States.    AgLAB Inc.   AgLAB, an exclusive licensee of ATI for the agriculture market, has developed the AgLAB 1000™ series of mass spectrometers for use in the hemp and cannabis markets with initial focus on optimizing yields in the distillation process. The AgLAB product line is a derivative of the Company’s core AMS Technology. AgLAB has continued to conduct field trials to demonstrate that the AgLAB 1000-D2™ can be used in the distillation process to significantly improve the processing yields of tetrahydrocannabinol (“THC”) and cannabidiol (“CBD”) oil during distillation. The AgLAB 1000-D2™ uses the Maximum Value Process solution (“MVP”) to analyze samples in real-time and assist the equipment operator determining the ideal settings required to maximize yields.  As part of our growth plan, we also plan to launch a family of “process control” methods and solutions that we believe could be valuable additions to many nutraceutical and pharmaceutical distillation processing plants.   7 Table of Contents   Production and processing of hemp and cannabis is a huge, worldwide industry. In the U.S., for example, the wholesale value of the cannabis crop from just the 11 states permitting adult-use and medical cannabis exceeds $6 billion annually. Growth in the U.S. and in the worldwide market is likely fed in part by the growing acceptance of medicinal cannabis products and anticipated legislative changes in various jurisdictions worldwide. This growth is also due in part to the passage of the 2018 Farm Bill, which legalized hemp production in the United States. According to a report by BDS Analytics and Arcview Market Research, the U.S. CBD market is estimated to reach $20 billion by 2024, with a CAGR of 49% from 2019 to 2024. The market is segmented into various categories of products, including oils, tinctures, capsules, topicals, edibles, and pet products. The largest category is oils and tinctures, accounting for 44% of the market share in 2020, followed by topicals (26%) and edibles (19%). CBD-infused pet products are also growing in popularity, with sales estimated to reach $1.7 billion by 2025, despite the FDA’s current position that such products may not be lawfully sold under the federal Food, Drug & Cosmetic Act (FD&C Act).   One factor driving the growth of the market is the increasing consumer interest in natural and alternative health remedies. According to a survey conducted by the National Center for Complementary and Integrative Health, nearly one-third of Americans use natural products, including CBD, for their health and wellness needs. Another survey by Consumer Reports found that 64% of Americans who have tried CBD reported benefits in connection with various health conditions, including pain, anxiety, and sleep disorders. Despite the regulatory uncertainty surrounding the use of CBD in food and dietary supplements, as the FDA has consistently held that such products are unlawful under the FD&C Act, the market has continued to expand. A survey conducted by the Grocery Manufacturers Association found that 71% of US consumers are open to using CBD-infused food and beverage products, and the market for CBD-infused beverages is projected to reach $1.4 billion by 2023.   As the market continues to grow, there has been an influx of new companies entering the space, ranging from large corporations to small startups. The competition is fierce, with companies investing heavily in research and development to create innovative products and differentiate themselves from their competitors. However, the market remains highly fragmented, with many products of varying quality and efficacy, making it challenging for consumers to navigate. Overall, the CBD and hemp market in the US is a rapidly growing industry with significant potential for continued expansion. As more research is conducted and regulations are established, we believe it is likely that the market will become more standardized and regulated, leading to increased consumer confidence and demand. However, the industry is also likely to face challenges as it matures, including increased competition and potential regulatory hurdles.   Management believes the AgLAB 1000-D2™ will deliver a compelling combination of cost and time savings while enhancing product quality and quantity for distillation processors of hemp and cannabis. The use of the AgLAB 1000-D2™ should reduce waste from current distillation practices and result in a significantly improved product. Due in large part to the Company’s proprietary technology, the Company believes it is the only provider of a mass spectrometry system that gives it a distinct advantage in the industry.   Our competition consists of high performance liquid chromatography technology which analyzes THC and CBD derived from hemp. . While we believe our technology has competitive advantages over the incumbent technology, there are no assurances competing in this market segment.   The hemp extraction market is a broad market and encompasses many startup companies and well-established companies.  There is no assurance this industry will remain profitable, given the evolving regulatory landscape and applicable state and federal restrictions.   During the first quarter of fiscal year 2023, AgLab began the first production run of the AgLAB 1000-D2 and sales efforts are currently underway. On May 9, 2023, AgLab announced the confirmed results from field trials using the AgLAB 1000-D2TM mass spectrometer and the Maximum Value ProcessTM testing method (“AgLAB MVP”). AgLAB MVP is designed to improve yields and bottom-line profits for hemp (CBD) and cannabis (THC) producers of distilled oils. While we currently market primarily to distillers within the hemp industry, our AgLAB products also have the potential to serve distillers within the broader cannabis industry in the future, in which case our risk exposure would likely increase and could have a detrimental effect on our business.      8 Table of Contents   BreathTech Corporation   BreathTech, an exclusive licensee of ATI for use in breath analysis applications, is developing the BreathTest-1000™, a breath analysis tool to screen for VOC metabolites found in a person’s breath that could indicate they may have compromised condition including but not limited to a bacterial or viral infection. The Company believes that new tools to aid in the battle against COVID-19 and other diseases remain of the utmost importance to help more quickly identify that an infection may be present.   In June 2022, the Company expanded its existing study that initially focused on COVID-19 with Cleveland Clinic to use the BreathTest-1000 to screen for a variety of diseases spanning the entire body. The project will focus on detecting bloodstream infections, respiratory infections such as influenza types A and B and respiratory syncytial virus (“RSV”), carriage of Staphylococcus aureus, and Clostridioides difficile (“C. diff”) infections.   In November 2022, BreathTech announced that, based on analysis of data from testing of breath samples procured during library development, the BreathTest-1000™ lung disease screening instrument can clearly distinguish between infected and healthy breath samples. This analysis and conclusion marks a significant milestone in the development of the BreathTest-1000™ lung disease screening instrument.   Trends and Uncertainties   To date, we have seen delays with respect to the TSA certification process and parts of our supply chain, particularly the impact of the global semiconductor and electronics shortage, which has now resulted in product pricing inflation. In addition, although passenger demand for air travel has rebounded, the overall recovery of the airline industry and ancillary services remains uncertain.   We continue to manage production, to secure alternative supplies, and to take other proactive actions. We believe that we will be able to pass the inflation caused by raw materials shortages and increased shipping costs to our customers by increasing the price of our instruments. If supply chain shortages become more severe or longer term in nature, our business and results of operations could be adversely impacted; however, we do not expect this issue to materially adversely affect our liquidity position. In addition, the long-term impact of the COVID-19 pandemic on our business may not be fully reflected until future periods.   Business Strategy   1 st   Detect Corporation   There are tens of thousands of IMS instruments deployed in the field today, with many nearing their end of life. As the current generation of IMS technology is replaced, we are working to position the Company as the next-generation solution for the ETD market with the introduction of the world’s first ECAC certified ETD driven by a mass spectrometer. With mass spectrometry being the gold standard of chemical detection, an MS-ETD significantly improves detection capabilities, dramatically reduces the number of false positives, decreases delays and the associated costs, and allows for a much more expansive library of compounds of interest, yielding an instrument that we believe is far superior to the currently deployed IMS instruments, at a similar price point and a lower operating cost.   We currently market the TRACER 1000 to countries that accept ECAC certification. If we obtain TSA certification and are listed on the ACSTL as an “approved” device, we plan to also market and sell the TRACER 1000 to those countries that accept TSA certification.   9 Table of Contents   AgLAB Inc.   Initial interest for the AgLAB-1000 series has come from the hemp and cannabis industry. Many derivative hemp and cannabis products are being manufactured using cannabinoids present in the plant, primarily THC for cannabis and CBD for hemp. Extraction and distillation equipment is used to remove the cannabinoids from the raw plant matter to create an oil that is used in many manufactured products. AgLAB has launched the first of several planned products that have been designed to assist in the distillation processes by maximizing the final product quality and yield.   Current efforts are focused on the U.S. market, but international markets present attractive future growth opportunities as the number of countries with legal recreational or medicinal use continues to expand.   BreathTech Corporation   The BreathTest-1000 product that is currently under development is being designed to provide an inexpensive, non-invasive screening device for compromised conditions including a bacterial or viral infection that can offer results on-site in a very short period of time. We believe there is strong value for this easy to use screener in high density and critical locations, especially with additional COVID-19 variants and other diseases continuing to pose new or reemerging threats. Most currently available tests either take too long or are invasive and painful. The market need for a quick and painless test is considered significant in the following target markets:     ● Hospitals ● Military   ● Nursing homes ● Sporting events   ● Airlines ● Performing arts venues   ● Hotels ● Convention and conference centers   ● Cruise lines ● Schools             Products and Services   1 st   Detect Corporation   The TRACER 1000 is the first MS-ETD certified by ECAC. We believe the TRACER 1000 significantly outperforms currently deployed competitive trace detection solutions based on IMS technology, specifically related to false alarm rate, probability of detection, and unit up-time. Many of our sales to-date have come from the cargo security industry where false alarms can cause expensive delays and facility shutdowns as the false alarms are cleared, preventing the mission critical continuous flow of time sensitive packages. We have also expanded into the airport passenger screening market with sales to a distributor who services a major international airport in Asia and another who services airports in Romania. We also continue to garner much interest in the narcotics capabilities of our system and plan to expand sales efforts in this area.   AgLAB Inc.   Leveraging the platform AMS Technology, AgLAB has designed its product line to serve distillers in the hemp and cannabis industry. AgLAB has launched the AgLAB-1000-D2 which is designed to be used to determine the optimal settings to increase yield and potency during the distillation process. With the AgLAB-1000-D2, a sample is manually introduced into the system for analysis. Currently under development is the AgLAB-1000-D1. When completed, this instrument will be an inline process control unit.   BreathTech Corporation   The BreathTest-1000 is being developed, in conjunction with Cleveland Clinic, to provide an inexpensive, non-invasive screening device for a variety of diseases, including highly contagious diseases like COVID-19 as well as other compromising conditions. The BreathTest-1000 is being designed to detect infectious VOC metabolites in a person’s breath.   10 Table of Contents   Customers, Sales, and Marketing   1 st   Detect Corporation   Marketing efforts at 1 st  Detect are currently focused on foreign airports and commercial companies in aviation and cargo security. We employ both direct sales and channel sales through distributors. We now have units deployed in 29 locations in 14 countries. While we have had some degree of success with sales, the sales cycles are normally long and much of the pipeline has seen delays caused by the COVID-19 pandemic.   AgLAB Inc.   Currently, AgLAB uses only direct sales. We do plan to engage with various channel partners, largely companies with existing distribution channels in the hemp and cannabis market, to help sell our products to target customers.   BreathTech Corporation   Efforts are currently focused on the development of the BreathTest-1000. We plan to increase marketing activities as the product approaches commercial viability.   Competition   1 st   Detect Corporation   Competition for the TRACER 1000 comes primarily from IMS-based ETDs. We have several competitors that sell IMS-based ETDs whose Company's are much larger than us, with well-established sales forces and offering a wider range of security products; however, we believe the TRACER 1000 has a number of attributes that are superior to competing products.   IMS-ETD 1 st  Detect’s TRACER 1000   ● False alarms caused by confusants   ● Near-zero false alarm rate   ● Lower probability of detection   ● Higher probability of detection   ● Numerous unscheduled bake-outs and calibrations   ● Near 100% up-time   ● Limited library of compounds of interest   ● Unlimited library of compounds of interest   ● Addition of new compounds may require hardware changes   ● Library updates that do not require hardware changes   ● Causes delays or shutdowns at security facilities/inspection checkpoints   ● Improves throughput at security facilities and checkpoints   ● Low price chemical detector   ● Competitive price to IMS in a throughput sensitive environment   These claims have been confirmed in numerous discussions with industry experts and verified in our many field trials.   AgLAB Inc.    The currently available technology that we believe to be the only direct competition to our MS-based system is high performance liquid chromatography (“HPLC”). We believe the AgLAB-1000 series of products offers a more customer-friendly interface, quicker results, and, once the AgLAB-1000-D1 is launched, the ability to provide closed loop process control, ensuring maximum yield and product quality.   BreathTech Corporation   The BreathTest-1000 product that is currently under development is being designed to screen for VOC metabolites. The VOC metabolites are found in a person’s breath and could indicate they may have a compromised condition including but not limited to a bacterial or viral infection. Given that breath samples are quick, inexpensive, and painless, we anticipate that the BreathTest-1000 will help screen for signs of disease. We do not see this as competing with traditional tests but supplementing and improving medical care.   11 Table of Contents   Research and Development   Astrotech Technologies, Inc.   We invest considerable resources into our internal research and development (“R&D”) functions. Much of our R&D investment is devoted to the cross-platform AMS Technology as the R&D team continually works to develop new derivative products, improve system functionality and reliability, optimize design, reduce cost, and streamline and simplify the software and user experience. Each market, however, typically requires unique sample introduction technology, library development, and customized adjustments to the user interface.    1 st   Detect Corporation   While 1 st Detect’s TRACER 1000 is fully commercialized, we continue to invest in cross-platform improvements that benefit all of our products, including those that improve system functionality and reliability, optimize design, reduce cost, and streamline and simplify the software and user experience.   AgLAB Inc.   The AgLAB-1000 series uses the core AMS Technology and is continuing its development of its product line to include other valuable products specific to the hemp and cannabis industry.   BreathTech Corporation   The BreathTest-1000 employs the core AMS Technology. BreathTech R&D activities are being devoted to sample introduction and library development, which is needed to identify the specific compounds present in the breath that are indicative of the presence a compromised condition including infections.   We have been in correspondence with the U.S. Food and Drug Administration ("FDA") regarding how the FDA will classify the BreathTest-1000 and the classification has not yet been determined. The classification will inform the required FDA premarket submission and review process that will follow. If premarket notification (510(k) submission) is required, we intend to submit a pre-submission request to the FDA. The pre-submission is a formal mechanism for requesting feedback from the FDA prior to submitting a medical device application. The timeframe for receiving feedback from a pre-submission request is approximately 70 calendar days but may be shorter or longer.   Simultaneously, we are exploring how to potentially accelerate our time to market for the BreathTest-1000 via the Emergency Use Authorization ("EUA") process, pursuant to the EUA declaration for in vitro diagnostic tests (“IVDs”) that became effective on February 4, 2020, in connection with the public health emergency related to COVID-19. In relevant part, an EUA declaration allows the FDA to temporarily authorize the use of unapproved and uncleared medical countermeasures, such as, IVD tests that have not gone through the FDA’s review process in anticipation of a potential emergency or during an actual emergency involving a chemical, biological, radiological, or nuclear agent, or an emerging infectious disease where the U.S. Secretary of Health and Human Services (“HHS”) determines that circumstances exist to justify such authorization. Several COVID-19 diagnostic tests have been authorized through the EUA process, and such authorizations generally remain in effect until HHS declares the public health emergency is terminated or the conditions of the given EUA are not fulfilled. We have not submitted a request for an EUA but are hopeful that we will be able to obtain authorization under the EUA to get the BreathTest-1000 to market as quickly as possible. The timeframe for authorization of an EUA is highly variable and depends on, among other things, the complexity of the product, completeness of the submission, and technical requirements of the FDA. Authorization, if granted, may take as little as one month or as long as several months, and there is no guarantee that an EUA will be granted for the BreathTest-1000.   Certain Regulatory Matters   We are subject to United States federal, state, and local laws and regulations designed to protect the environment and to regulate the discharge of materials into the environment. We are also beholden to certain regulations designed to protect our domestic technology from unintended foreign exploitation and regulate certain business practices. We believe that our policies, practices, and procedures are properly designed to prevent unreasonable risk of environmental damage and consequential financial liability. Our operations are also subject to various regulations under federal laws regarding the international transfer of technology, as well as to various federal and state laws related to business operations. In addition, we are subject to federal contracting procedures, audit, and oversight. Compliance with environmental laws and regulations and technology export requirements has not had and, we believe, will not have in the future, material effects on our capital expenditures, earnings, or competitive position.   12 Table of Contents   Federal regulations that impact our operations include, but are not limited to, the following:   Foreign Corrupt Practices Act . The Foreign Corrupt Practices Act establishes rules for U.S. companies doing business internationally. Compliance with these rules is achieved through established and enforced corporate policies, documented internal procedures, and financial controls.   Iran Nonproliferation Act of 2000 . This act authorizes the President of the United States to take punitive action against individuals or organizations known to be providing material aid to weapons of mass destruction programs in Iran.   Federal Acquisition Regulations . Goods and services provided by us to U.S. Government agencies are subject to Federal Acquisition Regulations (“FAR”). These regulations provide rules and procedures for invoicing, documenting, and conducting business under contract with such entities. The FAR also subjects us to audit by federal auditors to confirm such compliance.   Truth in Negotiations Act . The Truth in Negotiations Act was enacted for the purpose of providing full and fair disclosure by contractors in the conduct of negotiations with the U.S. Government. The most significant provision included in the Truth in Negotiations Act is the requirement that contractors submit certified cost and pricing data for negotiated procurements above a defined threshold.   Export Administration Act . This act provides authority to regulate exports, to improve the efficiency of export regulation, and to minimize interference with the ability to engage in commerce.   Export Administration Regulations.  The Export Administration Regulations govern whether a person or company may export goods from the U.S., re-export goods from a foreign country, or transfer goods from one person or company to another in a foreign country.   Medical Device Regulation   FDA Premarket Clearance and Approval Requirements. Unless an exemption applies, each medical device, to be lawfully commercially distributed in the U.S., requires either FDA clearance of a 510(k) premarket notification submission, granting of a de novo request, or premarket application (“PMA”) approval. Under the Federal Food Drug and Cosmetic Act (“FDCA”), administered by the FDA, medical devices are classified into one of three classes, Class I, Class II, or Class III, depending on the degree of risk associated with each medical device and the extent of manufacturer and regulatory controls needed to ensure its safety and effectiveness. Class I includes devices with the lowest risk to the patient and are those for which safety and effectiveness can be assured by adherence to the FDA’s general controls for medical devices, which include compliance with the applicable portions of the Quality System Regulation (“QSR”), facility registration and product listing, reporting of adverse medical events, and truthful and non-misleading labeling, advertising, and promotional materials. Some Class I devices may require premarket notification to the FDA.   Class II devices are moderate risk devices and are subject to the FDA’s general controls, and certain special controls as deemed necessary by the FDA to ensure the safety and effectiveness of the device. These special controls can include performance standards, post-market surveillance, patient registries, and FDA guidance documents. While most Class I devices are exempt from the 510(k) premarket notification requirement, manufacturers of most Class II devices are required to submit to the FDA a premarket notification under Section 510(k) of the FDCA requesting permission to commercially distribute the device. The FDA’s permission to commercially distribute a device subject to a 510(k) premarket notification is generally known as 510(k) clearance. Under the 510(k) process, the manufacturer must submit to the FDA a premarket notification demonstrating that the device is “substantially equivalent” to either a device that was legally marketed prior to May 28, 1976, the date upon which the Medical Device Amendments of 1976 were enacted, or another commercially available device that was cleared to through the 510(k) or de novo process.   Devices deemed by the FDA to pose the greatest risks, such as life-sustaining, life-supporting or some implantable devices, or devices that have a new intended use, or use advanced technology that is not substantially equivalent to that of a legally marketed device, are placed in Class III, requiring approval of a PMA. For a device that is Class III by default (because it is a novel device that was not previously classified and has no predicate), the device manufacturer may request that FDA reclassify the device into Class II or Class I via a de novo request.   510(k) Marketing Clearance. To obtain 510(k) clearance, a premarket notification submission must be submitted to the FDA demonstrating that the proposed device is “substantially equivalent” to a predicate device. A predicate device is a legally marketed device that is not subject to premarket approval, i.e., a device that was legally marketed prior to May 28, 1976 (pre-amendments device) and for which a PMA is not required, a device that has been reclassified from Class III to Class II or I (e.g., via the de novo classification process), or a device that was previously cleared through the 510(k) process. The FDA’s 510(k) review process usually takes from three to six months but may take longer. The FDA may require additional information, including clinical data, to make a determination regarding substantial equivalence. If the FDA agrees that the device is substantially equivalent to a predicate device, it will grant 510(k) clearance to market the device.   13 Table of Contents   After a device receives 510(k) marketing clearance, any modification that could significantly affect its safety or effectiveness, or that would constitute a major change or modification in its intended use, will require a new 510(k) marketing clearance or, depending on the modification, a de novo request or PMA approval. The FDA requires each manufacturer to determine whether the proposed change requires submission of a 510(k), de novo or a PMA in the first instance, but the FDA can review that decision and disagree with a manufacturer’s determination. If the FDA disagrees with a manufacturer’s determination, the FDA may take a wide range of enforcement actions, including, but not limited to, issuing a warning letter, withdrawing existing 510(k) clearance(s), and/or requesting a recall of the modified device. In addition, the manufacturer must cease marketing of the modified device until FDA has cleared or approved a new 510(k), de novo or PMA for the change, if ever. Also, in these circumstances, the manufacturer may be subject to significant regulatory fines or penalties.   De Novo Process. If a previously unclassified new medical device does not qualify for the 510(k) pre-market notification process because no predicate device to which it is substantially equivalent can be identified, the device is automatically classified into Class III. The Food and Drug Administration Modernization Act of 1997 established a new route to market for low to moderate risk medical devices that are automatically placed into Class III due to the absence of a predicate device, called the “Request for Evaluation of Automatic Class III Designation,” or the de novo classification procedure. This procedure allows a manufacturer whose novel device is automatically classified into Class III to request down-classification of its medical device into Class I or Class II on the basis that the device presents low or moderate risk, rather than requiring the submission and approval of a PMA. Prior to the enactment of the Food and Drug Administration Safety and Innovation Act (“FDASIA”) in July 2012, a medical device could only be eligible for de novo classification if the manufacturer first submitted a 510(k) pre-market notification and received a determination from the FDA that the device was not substantially equivalent. FDASIA streamlined the de novo classification pathway by permitting (under Section 513(f)(2) of the FDCA) manufacturers to request de novo classification directly without first submitting a 510(k) pre-market notification to the FDA and receiving a not substantially equivalent determination. FDASIA sets a review time for FDA of 120 days following receipt of the de novo application, but FDA does not always meet this timeline and has publicly only committed to a review of 150 days for 50% of applications. If the manufacturer seeks reclassification into Class II, the manufacturer must include a draft proposal for special controls that are necessary to provide a reasonable assurance of the safety and effectiveness of the medical device. The FDA may reject the reclassification petition if it identifies a legally marketed predicate device that would be appropriate for a 510(k) or determines that the device is not low to moderate risk or that general controls would be inadequate to control the risks and special controls cannot be developed. If the FDA agrees with the down-classification, the de novo applicant will then receive authorization to market the device, and a classification regulation will be established for the device type. The device can then be used as a predicate device for future 510(k) submissions by the manufacturer or a competitor. In October 2021, FDA enacted regulations implementing the above-referenced FDCA provisions governing the de novo reclassification process.   Premarket Approval Process. Class III devices require submission through the PMA process before they can be marketed. The PMA process is more demanding than the 510(k) premarket notification process. Under the PMA pathway, the manufacturer must demonstrate that the investigational device is safe and effective for the target indication(s) for use, and the PMA must be supported by extensive data, including data from preclinical studies and human clinical trials conducted under a valid investigational device exemption (“IDE”). The PMA must also contain, among other things, a full description of the device and its components, a full description of the methods, facilities and controls used for manufacturing, and proposed labeling. Following receipt of a PMA submission, the FDA determines whether the application is sufficiently complete to permit a substantive review. If the FDA accepts the application for review, it has 180 days under the FDCA to complete its review of a PMA, although in practice, the FDA’s review often takes significantly longer, and can take up to several years. An advisory panel of experts from outside the FDA may be convened to review and evaluate the application and provide recommendations to the FDA as to the approvability of the device. The FDA may or may not accept the panel’s recommendation. In addition, the FDA will generally conduct a preapproval inspection of the applicant or its third-party manufacturers’ or suppliers’ manufacturing facility or facilities to ensure compliance with the QSR.   The FDA will approve the new device for commercial distribution if it determines that the data and information in the PMA application constitute valid scientific evidence and that there is reasonable assurance that the device is safe and effective for its intended use(s). The FDA may approve a PMA application with post-approval conditions intended to ensure the safety and effectiveness of the device, including, among other things, restrictions on labeling, promotion, sale and distribution, and collection of long-term follow-up data from patients in the clinical study that supported PMA approval or requirements to conduct additional clinical studies post-approval. The FDA may condition PMA approval on some form of post-market surveillance when deemed necessary to protect the public health or to provide additional safety and efficacy data for the device in a larger population or for a longer period of use. In such cases, the manufacturer might be required to follow certain patient groups for a number of years and to make periodic reports to FDA on the clinical status of those patients. Failure to comply with the conditions of approval can result in material adverse enforcement action, including withdrawal of the approval.   14 Table of Contents   Certain changes to an approved device, such as changes in manufacturing facilities, methods, or quality control procedures, or changes in the design performance specifications, which affect the safety or effectiveness of the device, require submission of a PMA supplement. PMA supplements often require submission of the same type of information as a PMA, except that the supplement is limited to information needed to support any changes from the device covered by the original PMA and may not require as extensive clinical data or the convening of an advisory panel. Certain other changes to an approved device require the submission of a new PMA, such as when the design change causes a different intended use, mode of operation, and technical basis of operation, or when the design change is so significant that a new generation of the device will be developed, and the data that were submitted with the original PMA are not applicable for the change in demonstrating a reasonable assurance of safety and effectiveness.   Emergency Use Authorization . The Commissioner of the FDA, under delegated authority from HHS may, under certain circumstances, issue an EUA, that would temporarily permit the use of an unapproved medical device or unapproved use of an approved medical device. Before an EUA may be issued, the HHS Secretary must declare that circumstances exist to justify the authorization (referred to as an “EUA declaration”) based on one of the following grounds:     ● a determination by the Secretary of the Department of Homeland Security (“DHS”) that there is a domestic emergency, or a significant potential for a domestic emergency, involving a heightened risk of attack with a specified biological, chemical, radiological or nuclear agent or agents;     ● a determination by the Secretary of Defense that there is a military emergency, or a significant potential for a military emergency, involving a heightened risk to U.S. military forces of attack with a specified biological, chemical, radiological, or nuclear agent or agents;      ● a determination by the Secretary of HHS of a public health emergency that affects or has the significant potential to affect, national security or the health and security of U.S. citizens living abroad, and that involves a specified biological, chemical, radiological, or nuclear agent or agents, or a specified disease or condition that may be attributable to such agent or agents; or     ● the identification of a material threat, by the DHS Secretary pursuant to section 319F-2 of the Public Health Service (“PHS”) Act, that is sufficient to affect national security or the health and security of U.S. citizens living abroad.   In order for a medical countermeasure, such as an IVD (among others), to be the subject of an EUA, the FDA Commissioner must conclude that, based on the totality of scientific evidence available, it is reasonable to believe that the product may be effective in diagnosing, treating, or preventing a disease attributable to the agents described above, that the product’s potential benefits outweigh its potential risks and that there is no adequate, approved alternative to the product.   Clinical Trials. Clinical trials are almost always required to support de novo or a PMA and are sometimes required to support a 510(k) submission. All clinical investigations of investigational devices to determine safety and effectiveness must be conducted in accordance with the FDA’s IDE regulations which govern investigational device labeling, prohibit promotion of the investigational device, and specify an array of recordkeeping, reporting and monitoring responsibilities of study sponsors and study investigators. If the device presents a “significant risk” to human health, as defined by the FDA, the FDA requires the device sponsor to submit an IDE application to the FDA, which must become effective prior to commencing human clinical trials. A significant risk device is one that presents a potential for serious risk to the health, safety or welfare of a patient and either is implanted, used in supporting or sustaining human life, substantially important in diagnosing, curing, mitigating or treating disease or otherwise preventing impairment of human health, or otherwise presents a potential for serious risk to a subject. An IDE application must be supported by appropriate data, such as animal and laboratory test results, showing that it is safe to test the device in humans and that the testing protocol is scientifically sound. The IDE will automatically become effective 30 days after receipt by the FDA, unless the FDA notifies the manufacturer that the investigation may not begin or is subject to a clinical hold. If the FDA determines that there are deficiencies or other concerns with an IDE for which it requires modification, the FDA may permit a clinical trial to proceed under a conditional approval.   In addition, clinical studies must be approved by, and conducted under the oversight of, an Institutional Review Board ("IRB") for each clinical site. The IRB is responsible for the initial and continuing review of the IDE and may pose additional requirements for the conduct of the trial. If an IDE application is approved by the FDA and one or more IRBs, human clinical trials may begin at a specific number of investigational sites with a specific number of patients, as approved by the FDA. If the device presents a non-significant risk to the patient, a sponsor may begin the clinical trial after obtaining approval for the trial by one or more IRBs without separate approval from the FDA, but must still follow abbreviated IDE requirements, such as monitoring the investigation, ensuring that the investigators obtain informed consent, and labeling and record-keeping requirements. An IDE supplement must be submitted to and approved by the FDA before a sponsor or investigator may make a change to the investigational plan.   15 Table of Contents   During a clinical trial, the sponsor is required to comply with the applicable FDA requirements, including, for example, trial monitoring, selecting clinical investigators and providing them with the investigational plan, ensuring IRB review, adverse event reporting, record keeping, and prohibitions on the promotion of investigational devices or on making safety or effectiveness claims for them. The clinical investigators in the clinical study are also subject to FDA regulations and must obtain patient informed consent, rigorously follow the investigational plan and study protocol, control the disposition of the investigational device, and comply with all reporting and recordkeeping requirements. Additionally, after a trial begins, we, the FDA, or the IRB could suspend or terminate a clinical trial at any time for various reasons, including a belief that the risks to study subjects outweigh the anticipated benefits.   Post-market Regulation. After a device is cleared or approved for marketing, numerous and pervasive regulatory requirements continue to apply. These include (among others):     ● establishment registration and device listing with the FDA;     ● state licensure requirements for the manufacturing and distribution of medical devices;     ● FDA’s QSR requirements, which require manufacturers, including third-party manufacturers, to follow stringent design, testing, control, documentation, and other quality assurance procedures during all aspects of the design and manufacturing process;     ● FDA labeling and marketing regulations, which require that promotion is truthful, not misleading, fairly balanced, provide adequate directions for use, and that all claims are substantiated, and also prohibit the promotion of products for unapproved or “off-label” uses and impose other restrictions on labeling;      ● FDA regulations and guidance pertaining to clearance or approval of product modifications to 510(k)-cleared devices that could significantly affect safety or effectiveness or that would constitute a major change in intended use of one of our cleared devices, or approval of a supplement for certain modifications to PMA devices;     ● FDA’s medical device reporting (“MDR”) regulations, which require that a manufacturer report to the FDA if a device it markets may have caused or contributed to a death or serious injury, or has malfunctioned and the device or a similar device that it markets would be likely to cause or contribute to a death or serious injury, if the malfunction were to recur;     ● FDA’s correction, removal, and recall reporting regulations, which require that manufacturers report to the FDA field corrections and product recalls or removals if undertaken to reduce a risk to health posed by the device or to remedy a violation of the FDCA that may present a risk to health;     ● FDA regulations requiring Unique Device Identifiers on devices and also requiring the submission of certain information about each device to the FDA’s Global Unique Device Identification Database;     ● the FDA’s recall authority, whereby the agency can order device manufacturers to recall from the market a product that is in violation of governing laws and regulations;     ● FDA post-market surveillance activities and regulations, which apply when deemed by the FDA to be necessary to protect the public health or to provide additional safety and effectiveness data for the device;     ● the federal Physician Sunshine Act and various state and foreign laws on reporting remunerative relationships with health care professionals, teaching hospitals, and other applicable entities;     ● the federal Anti-Kickback Statute (and similar state laws) prohibiting, among other things, soliciting, receiving, offering or providing remuneration intended to induce the purchase or recommendation of an item or service reimbursable under a federal healthcare program, such as Medicare or Medicaid. A person or entity does not have to have actual knowledge of this statute or specific intent to violate it to have committed a violation; and     ● the federal False Claims Act (and similar state laws) prohibiting, among other things, knowingly presenting, or causing to be presented, claims for payment or approval to the federal government that are false or fraudulent, knowingly making a false statement material to an obligation to pay or transmit money or property to the federal government or knowingly concealing, or knowingly and improperly avoiding or decreasing, an obligation to pay or transmit money to the federal government. The government may assert that claim includes items or services resulting from a violation of the federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the false claims statute.   16 Table of Contents   We may be subject to similar foreign laws that may include applicable post-marketing requirements such as safety surveillance. With respect to any medical devices that we may commercialize in the U.S. in the future, our manufacturing processes, or those of any contract manufacturer that we engage, will be required to comply with the applicable portions of the QSR, which cover the methods and the facilities, controls for the design, manufacture, testing, production, processes, controls, quality assurance, labeling, packaging, distribution, installation, and servicing of finished devices intended for human use. The QSR also requires, among other things, maintenance of a device master file, device history file, and complaint files. The discovery of previously unknown problems with any of our products, including unanticipated adverse events or adverse events of increasing severity or frequency, whether resulting from the use of the device within the scope of its clearance or off-label by a physician in the practice of medicine, could result in restrictions on the device, including the removal of the product from the market or voluntary or mandatory device recalls.   The FDA has broad regulatory compliance and enforcement powers. If the FDA determines that we failed to comply with applicable regulatory requirements, it can take a variety of compliance or enforcement actions, which may result in any of the following sanctions:     ● warning letters, untitled letters, fines, injunctions, consent decrees, and civil penalties;     ● recalls, withdrawals, or administrative detention or seizure of our products;     ● operating restrictions or partial suspension or total shutdown of production (due to violations of the QSR or other applicable regulations) refusing or delaying requests for 510(k) marketing clearance or PMA approvals of new products or modified products;     ● withdrawing 510(k) clearances or PMA approvals that have already been granted;     ● refusal to grant export or import approvals for our products; or     ● criminal prosecution.   Regulation of Medical Devices in the EEA   Medical devices placed on the market in the European Economic Area ("EEA") must meet the relevant essential requirements laid down in Annex I of Directive 93/42/EEC concerning medical devices ("the Medical Devices Directive"). The most fundamental essential requirement is that a medical device must be designed and manufactured in such a way that it will not compromise the clinical condition or safety of patients, or the safety and health of users and others. In addition, the device must achieve the performances intended by the manufacturer and be designed, manufactured, and packaged in a suitable manner. The European Commission has adopted various standards applicable to medical devices. These include standards governing common requirements, such as sterilization and safety of medical electrical equipment and product standards for certain types of medical devices. There are also harmonized standards relating to design and manufacture. While not mandatory, compliance with these standards is viewed as the easiest way to satisfy the essential requirements as a practical matter. Compliance with a standard developed to implement an essential requirement also creates a rebuttable presumption that the device satisfies that essential requirement.   To demonstrate compliance with the essential requirements laid down in Annex I to the Medical Devices Directive, medical device manufacturers must undergo a conformity assessment procedure, which varies according to the type of medical device and its classification. Conformity assessment procedures require an assessment of available clinical evidence, literature data for the product, and post-market experience in respect of similar products already marketed. Except for low-risk medical devices (Class I non-sterile, non-measuring devices), where the manufacturer can self-declare the conformity of its products with the essential requirements (except for any parts which relate to sterility or metrology), a conformity assessment procedure requires the intervention of a Notified Body. Notified bodies are often separate entities and are authorized or licensed to perform such assessments by government authorities. The notified body would typically audit and examine a product’s technical dossiers and the manufacturers’ quality system. If satisfied that the relevant product conforms to the relevant essential requirements, the notified body issues a certificate of conformity, which the manufacturer uses as a basis for its own declaration of conformity. The manufacturer may then apply the CE Mark to the device, which allows the device to be placed on the market throughout the EEA. Once the product has been placed on the market in the EEA, the manufacturer must comply with requirements for reporting incidents and field safety corrective actions associated with the medical device.   17 Table of Contents   In order to demonstrate safety and efficacy for their medical devices, manufacturers must conduct clinical investigations in accordance with the requirements of Annex X to the Medical Devices Directive ("MDD"), Annex 7 of the Active Implantable Medical Devices Directive ("AIMDD"), and applicable European and International Organization for Standardization standards, as implemented or adopted in the EEA member states. Clinical trials for medical devices usually require the approval of an ethics review board and approval by or notification to the national regulatory authorities. Both regulators and ethics committees also require the submission of serious adverse event reports during a study and may request a copy of the final study report.   On April 5, 2017, the European Parliament passed the Medical Devices Regulation (Regulation 2017/745), which repeals and replaces the E.U. Medical Devices Directive and the Active Implantable Medical Devices Directive. Unlike directives, which must be implemented into the national laws of the EEA member States, the regulations would be directly applicable, i.e., without the need for adoption of EEA member State laws implementing them, in all EEA member States and are intended to eliminate current differences in the regulation of medical devices among EEA member States. The Medical Devices Regulation, among other things, is intended to establish a uniform, transparent, predictable, and sustainable regulatory framework across the EEA for medical devices and ensure a high level of safety and health while supporting innovation. The Medical Device Regulation will become applicable in May 2021. The new regulations:     ● strengthen the rules on placing devices on the market and reinforce surveillance once they are available;     ● establish explicit provisions on manufacturers’ responsibilities for the follow-up of the quality, performance, and safety of devices placed on the market;     ● improve the traceability of medical devices throughout the supply chain to the end-user or patient through a unique identification number;     ● set up a central database to provide patients, healthcare professionals, and the public with comprehensive information on products available in the E.U.;     ● strengthened rules for the assessment of certain high-risk devices, such as implants, which may have to undergo an additional check by experts before they are placed on the market.   In the European Union, member states are responsible for enforcing the EU’s medical device rules and for ensuring that only compliant medical devices are placed on the market or put into service in their jurisdictions. They have powers to suspend the marketing and use, or demand the recall, of unsafe or non-compliant devices. They also have the power to bring enforcement action against companies or individuals for breaches of the device rules. Non-compliance may also result in Notified Bodies revoking any certificate of conformity that they have issued for a device or the manufacturer’s quality system.   We are subject to regulations and product registration requirements in many foreign countries in which we may sell our products, including in the areas of:     ● design, development, and manufacturing;     ● product standards;     ● product safety;     ● product safety reporting;     ● marketing, sales, and distribution;     ● packaging and storage requirements;     ● labeling requirements;     ● content and language of instructions for use;     ● clinical trials;   18 Table of Contents     ● record keeping procedures;     ● advertising and promotion;     ● recalls and field corrective actions;     ● post-market surveillance, including reporting of deaths or serious injuries and malfunctions that, if they were to recur, could lead to death or serious injury;     ● import and export restrictions;     ● tariff regulations, duties, and tax requirements;     ● registration for reimbursement; and     ● necessity of testing performed in country by distributors for licensees.   The time required to obtain clearance required by foreign countries may be longer or shorter than that required for FDA clearance, and requirements for licensing a product in a foreign country may differ significantly from FDA requirements.   Federal, State, and Foreign Fraud and Abuse and Physician Payment Transparency Laws. In addition to FDA restrictions on marketing and promotion of drugs and devices, other federal and state laws may restrict our business practices if our products will be reimbursable under federal or state healthcare programs. These laws include, without limitation, foreign, federal, and state anti-kickback and false claims laws, as well as transparency laws regarding payments or other items of value provided to healthcare providers.   The federal Anti-Kickback Statute prohibits, among other things, knowingly and willfully offering, paying, soliciting or receiving any remuneration (including any kickback, bribe or rebate), directly or indirectly, overtly or covertly, in cash or in kind to induce or in return for purchasing, leasing, ordering or arranging for or recommending the purchase, lease or order of any good, facility, item or service reimbursable, in whole or in part, under Medicare, Medicaid or other federal healthcare programs.   Violations of the federal Anti-Kickback Statute may result in civil monetary penalties up to $100,000 for each violation, plus up to three times the remuneration involved. Civil penalties for such conduct can further be assessed under the federal False Claims Act. Violations can also result in criminal penalties, including criminal fines of up to $100,000 and/or imprisonment of up to 10 years. Similarly, violations can result in exclusion from participation in government healthcare programs, including Medicare and Medicaid. Liability under the federal Anti-Kickback Statute may also arise because of the intentions or actions of the parties with whom we do business.   The federal civil False Claims Act prohibits, among other things, any person or entity from knowingly presenting, or causing to be presented, a false or fraudulent claim for payment or approval to the federal government or knowingly making, using or causing to be made or used a false record or statement material to a false or fraudulent claim to the federal government. A claim includes “any request or demand” for money or property presented to the U.S. government. The federal civil False Claims Act also applies to false submissions that cause the government to be paid less than the amount to which it is entitled, such as a rebate. Intent to deceive is not required to establish liability under the federal civil False Claims Act.   In addition, private parties may initiate “qui tam” whistleblower lawsuits against any person or entity under the federal civil False Claims Act in the name of the government and share in the proceeds of the lawsuit. Penalties for federal civil False Claim Act violations include fines for each false claim, plus up to three times the amount of damages sustained by the federal government and, most critically, may provide the basis for exclusion from the federally funded healthcare program The criminal False Claims Act prohibits the making or presenting of a claim to the government knowing such claim to be false, fictitious or fraudulent and, unlike the federal civil False Claims Act, requires proof of intent to submit a false claim. When an entity is determined to have violated the federal civil False Claims Act, the government may impose civil fines and penalties ranging from $11,803 to $23,607 for each false claim, plus treble damages, and exclude the entity from participation in Medicare, Medicaid, and other federal healthcare programs.   The Civil Monetary Penalty Act of 1981 imposes penalties against any person or entity that, among other things, is determined to have presented or caused to be presented a claim to a federal healthcare program that the person knows or should know is for an item or service that was not provided as claimed or is false or fraudulent, or offering or transferring remuneration to a federal healthcare beneficiary that a person knows or should know is likely to influence the beneficiary’s decision to order or receive items or services reimbursable by the government from a particular provider or supplier.   19 Table of Contents   The Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”) and including implementing regulations (collectively, “HIPAA”) also created additional federal criminal statutes that prohibit among other actions, knowingly and willfully executing, or attempting to execute, a scheme to defraud any healthcare benefit program, including private third-party payors, knowingly and willfully embezzling or stealing from a healthcare benefit program, willfully obstructing a criminal investigation of a healthcare offense, and knowingly and willfully falsifying, concealing or covering up a material fact or making any materially false, fictitious or fraudulent statement in connection with the delivery of or payment for healthcare benefits, items or services. Similar to the federal Anti-Kickback Statute, a person or entity does not need to have actual knowledge of the statute or specific intent to violate it in order to have committed a violation.   Many foreign countries have similar laws relating to healthcare fraud and abuse. Foreign laws and regulations may vary greatly from country to country. For example, the advertising and promotion of our products is subject to E.U. directives concerning misleading and comparative advertising and unfair commercial practices, as well as other EEA Member State legislation governing the advertising and promotion of medical devices. These laws may limit or restrict the advertising and promotion of our products to the general public and may impose limitations on our promotional activities with healthcare professionals. Also, many U.S. states have similar fraud and abuse statutes or regulations that may be broader in scope and may apply regardless of payor, in addition to items and services reimbursed under Medicaid and other state programs.   Data Privacy and Security Laws . In the future, we may also be subject to various federal, state, and foreign laws that protect personal information including certain patient health information, such as the E.U. General Data Protection Regulation (“GDPR”) and the California Consumer Privacy Act (“CCPA”), and restrict the use and disclosure of patient health information, such as HIPAA, and analogous state laws, many of which apply more broadly than HIPAA, in the U.S.   HIPAA established uniform standards governing the conduct of certain electronic healthcare transactions and requires certain entities, called covered entities (as defined under HIPAA), to comply with standards that include the privacy and security of Protected Health Information (“PHI”). HIPAA also requires business associates (as defined under HIPAA), that may include independent contractors or agents of covered entities that access, use or disclose PHI in connection with providing a service to or on behalf of a covered entity to enter into business associate agreements with the covered entity and to safeguard the covered entity’s PHI against improper use and disclosure.   The HIPAA privacy regulations cover the use and disclosure of PHI by covered entities as well as business associates, which are defined to include subcontractors that create, receive, maintain, or transmit PHI on behalf of a business associate. They also set forth certain rights that an individual has with respect to his or her PHI maintained by a covered entity, including the right to access or amend certain records containing PHI, or to request restrictions on the use or disclosure of PHI. The security regulations establish requirements for safeguarding the confidentiality, integrity, and availability of PHI that is electronically transmitted or electronically stored. HITECH, among other things, established certain health information security breach notification requirements. A covered entity must notify any individual whose PHI is breached according to the specifications set forth in the breach notification rule. The HIPAA privacy and security regulations establish a uniform federal “floor” and do not supersede state laws that are more stringent or provide individuals with greater rights with respect to the privacy or security of, and access to, their records containing PHI or insofar as such state laws apply to personal information that is broader in scope than PHI as defined under HIPAA.   HIPAA requires the notification of patients, and other compliance actions, in the event of a breach of unsecured PHI. If notification to patients of a breach is required, such notification must be provided without unreasonable delay and in no event later than 60 calendar days after discovery of the breach. In addition, if the PHI of 500 or more individuals is improperly used or disclosed, we would be required to report the improper use or disclosure to HHS which would post the violation on its website, and to the media. Failure to comply with the HIPAA privacy and security standards can result in civil monetary penalties up to $63,973 per violation, not to exceed an aggregate of $1.92 million per calendar year, and, in certain circumstances, criminal penalties with fines up to $250,000 per violation and/or imprisonment.   HIPAA authorizes state attorneys general to file suit on behalf of their residents for violations. Courts are able to award damages, costs and attorneys’ fees related to violations of HIPAA in such cases. While HIPAA does not create a private right of action allowing individuals to file suit against us in civil court for violations of HIPAA, its standards have been used as the basis for duty of care cases in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI. In addition, HIPAA mandates that the Secretary of HHS conduct periodic compliance audits of HIPAA covered entities, and their business associates for compliance with the HIPAA privacy and security standards. It also tasks HHS with establishing a methodology whereby harmed individuals who were the victims of breaches of unsecured PHI may receive a percentage of the civil monetary penalty paid by the violator.   20 Table of Contents   In addition, California enacted the CCPA, effective January 1, 2020, which, among other things, creates new data privacy obligations for covered companies and provides new privacy rights to California residents, including the right to opt out of certain disclosures of their information. The CCPA also creates a private right of action with statutory damages for certain data breaches, thereby potentially increasing risks associated with a data breach. Although the law includes limited exceptions, including for “protected health information” maintained by a covered entity or business associate, it may regulate or impact our processing of personal information depending on the context.   In the EEA, we may become subject to laws which restrict our collection, control, processing, and other use of personal data (i.e., data relating to an identifiable living individual) including the GDPR (and any national laws implementing the GDPR). As part of our operations, we process personal data belonging to data subjects in the EEA, including employees, contractors, suppliers, distributors, service providers, customers, patients, or clinical trial participants. For patients or clinical trial participants, we process special categories of personal data like health and medical information. We need to ensure compliance with the GDPR (and any applicable national laws implementing the GDPR) in each applicable EEA jurisdiction.   Healthcare Reform. The U.S. and some foreign jurisdictions are considering or have enacted a number of legislative and regulatory proposals to change the healthcare system in ways that could affect our ability to sell our products profitably. Among policy makers and payors in the U.S. and elsewhere, there is significant interest in promoting changes in healthcare systems with the stated goals of containing healthcare costs, improving quality or expanding access. Current and future legislative proposals, on both a national and state level, to further reform healthcare or reduce healthcare costs may limit coverage of or lower reimbursement for the procedures associated with the use of our products. The cost containment measures that payors and providers are instituting and the effect of any healthcare reform initiative implemented in the future could impact our revenue from the sale of our medical products, to the extent any are authorized for commercialization in the United States.   We expect additional state and federal healthcare reform measures to be adopted in the future, any of which could limit the amounts that federal and state governments will pay for healthcare products and services, which could result in reduced demand for our products or additional pricing pressure.   US Government Regulation of the Cannabis Industry   While we do not generate any revenue from the direct sale of cannabis products, we offer our services and solutions to cultivators operating within the cannabis industry. Marijuana is a Schedule I controlled substance and is illegal under federal law. Even in those states in which specific uses of marijuana have been legalized, such as medical marijuana or for adult recreational purposes, its use remains a violation of federal laws, subject to the narrow exception carved out by the 2018 Farm Bill.   A Schedule I controlled substance is defined as a substance that has no currently accepted medical use in the United States, a lack of safety for use under medical supervision and a high potential for abuse. The Department of Justice defines Schedule I controlled substances as “the most dangerous drugs of all the drug schedules with potentially severe psychological or physical dependence.” If the federal government decides to enforce the Controlled Substances Act with respect to marijuana, persons that are charged with distributing, possessing with intent to distribute, or growing cannabis in violation of federal law could be subject to fines and terms of imprisonment, the maximum being life imprisonment and a $50 million fine. Any unfavorable change in the federal government’s enforcement of current federal laws could cause significant financial damage to the industry. While we do not intend to directly harvest, manufacture, distribute or sell cannabis or cannabis products, we may be detrimentally affected by a change in enforcement by the federal or state governments.   21 Table of Contents   In the past, the Obama administration took the position that it was not an efficient use of resources to direct federal law enforcement agencies to prosecute those lawfully abiding by state-designated laws allowing the use and distribution of medical marijuana. The Trump administration revised this policy but made no major changes in enforcement. Although President Biden stood for decriminalization and descheduling during his campaign, his administration has not formulated an explicit policy on cannabis. The Biden administration has implemented pardons for past federal cannabis possession convictions and encouraged governors to do the same. Also, in May 2021 the Drug Enforcement Administration approved licensed facilities to grow cannabis for the purpose of medical research, and on December 2, 2022, President Biden signed the Medical Marijuana and Cannabidiol Research Expansion Act. This act is “the first standalone marijuana-related bill approved by both chambers of the United States Congress” and allows medical marijuana research. The act requires the Drug Enforcement Administration to register researchers and suppliers of cannabis for medical research in a timely manner, who will then be able to legally manufacture, distribute, dispense and possess the substance. It also creates a mechanism for FDA approval of drugs derived from the cannabis plant and “protects doctors who may now discuss the harms and benefits of using cannabis and cannabis derivatives.” It also requires the Department of Health and Human Services to investigate the medical utility of cannabis and barriers that exist to conducting research, and requires the U.S. Attorney General to conduct an annual review to ensure that cannabis is being adequately produced for research purposes. In January 2023, the FDA stated that given the growing cannabidiol (CBD) products market, it had convened a high-level internal working group to explore potential regulatory pathways for CBD products and is prepared to find a new regulatory pathway for CBD to balance individuals’ desire for access to CBD products with the regulatory oversight needed to manage risks. Notwithstanding the actions of the Biden administration, it should be expected that the Department of Justice will continue to enforce the Controlled Substances Act with respect to cannabis under established principles in setting their law enforcement priorities to prevent:     ● the distribution of cannabis products, such as marijuana, to minors;   ● criminal enterprises, gangs and cartels receiving revenue from the sale of cannabis;   ● the diversion of cannabis products from states where it is legal under state law to states where it is not legal under state law;   ● the use of state-authorized cannabis activity as a cover or pretext for the trafficking of other illegal drugs or other illegal activity;   ● violence and the use of firearms in the cultivation and distribution of cannabis products;   ● driving while impaired and the exacerbation of other adverse public health and safety consequences associated with cannabis product usage;   ● the growing of cannabis on public lands; and   ● cannabis possession or use on federal property.   Since the use of marijuana is illegal under federal law, most federally chartered banks will not accept deposit funds from businesses involved with marijuana. Consequently, businesses involved in the marijuana industry generally bank with state-chartered banks and credit unions to provide banking to the industry.   In 2014, Congress passed a spending bill containing a provision (the Rohrabacher-Farr amendment and sometimes referred to as the Rohrabacher-Blumenauer Amendment) blocking federal funds and resources allocated under the federal appropriations bills from being used to “prevent such States from implementing their own State medical marijuana laws.” The Rohrabacher-Blumenauer Amendment, however, did not codify any federal protections for medical marijuana patients and producers operating within state law. The Justice Department maintains that it can still prosecute violations of the federal cannabis laws and continue cases already in the courts. The Rohrabacher-Blumenauer Amendment must be re-enacted every year, and it is continued through September 30, 2023. However, state laws do not supersede the prohibitions set forth in the federal drug laws.   In order to participate in either the medical or the adult use aspects of the cannabis industry, all businesses and employees must obtain licenses from the state and, for businesses, local jurisdictions as well. As an example, Colorado issues four types of business licenses including cultivation, manufacturing, dispensing, and testing. In addition, all owners and employees must obtain an occupational license to be permitted to own or work in a facility. All applicants for licenses undergo a background investigation, including a criminal record check for all owners and employees.   22 Table of Contents   Colorado has also enacted stringent regulations governing the facilities and operations of cannabis businesses that are involved with the plant and its products. All facilities are required to be licensed by the state and local authorities and are subject to comprehensive security and surveillance requirements. In addition, each facility is subject to extensive regulations that govern its businesses practices, which includes mandatory seed-to-sale tracking and reporting, health and sanitary standards, packaging and labeling requirements, and product testing for potency and contaminants.   Laws and regulations affecting the medical marijuana industry are constantly changing, which could detrimentally affect our proposed operations. Local, state and federal medical marijuana and hemp laws and regulations are broad in scope and subject to evolving interpretations, which could require us to incur substantial costs associated with compliance or alter our business plan. It is also possible that regulations may be enacted in the future that will be directly applicable to our business. We cannot predict the nature of any future laws, regulations, interpretations or applications, nor can we determine what effect additional governmental regulations or administrative policies and procedures, when and if promulgated, could have on our business.   Regulatory Compliance and Risk Management   We maintain compliance with regulatory requirements and manage our risks through a program of compliance, awareness, and insurance, which includes maintaining certain insurances and a continued emphasis on safety to mitigate any risks.   Employees Update   As of June 30, 2023, we employed 22 employees, none of which were covered by any collective bargaining agreements.   Website   For more information on the Company’s business operations, please visit our company website at www.astrotechcorp.com.