What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2023-11-09 compared with 2023-08-09 · 64 added, 29 removed, 1193 unchanged (7% of the section changed)

9 unchanged sentences

Investment in biotechnology product development is highly speculative because it entails substantial upfront capital expenditures and significant risk that a product candidate will fail to gain regulatory approval or fail to become commercially viable.

Our net losses were $35.8 million and $26.3 million for the six months ended June 30, 2023 and 2022, respectively.

As of June 30, 2023, we had an accumulated deficit of $246.7 million.

Our net losses were $54.3 million and $42.2 million for the nine months ended September 30, 2023 and 2022, respectively.

As of September 30, 2023, we had an accumulated deficit of $265.2 million.

Substantially all of our net losses have resulted from costs incurred in connection with our research and development programs and from general and administrative costs associated with our operations.

38 unchanged sentences

Accordingly, we will need to obtain substantial additional funding in order to continue our operations.

Based on our current operating plan, we believe that our existing cash and cash equivalents, will be sufficient to fund our operating expenses and capital expenditures into the second half of 2025.

Based on our current operating plan, we believe that our existing cash and cash equivalents and marketable securities and $92.6 million in net proceeds from the 2023 Follow-On Offering after deducting underwriting discounts and commissions and estimated offering expenses, will be sufficient to fund our operating expenses and capital expenditures into the second half of 2026.

Advancing the development of bel-sar and other research programs will require a significant amount of capital.

39 unchanged sentences

Our ability to generate revenue and achieve profitability depends significantly on our ability to achieve several objectives, including:

successful and timely completion of preclinical and clinical development of bel-sar in indeterminate lesions and primary choroidal melanoma and additional oncology indications, other research programs from our VDC technology platform, and any other future programs;

successful and timely completion of preclinical and clinical development of bel-sar in indeterminate lesions and primary choroidal melanoma and additional oncology indications, including but not limited to bladder cancer, other research programs from our VDC technology platform, and any other future programs;

establishing and maintaining relationships with CROs and clinical sites for the clinical development of bel-sar, other research programs from our VDC technology platform, and any other future programs;

66 unchanged sentences

We have not yet demonstrated an ability to successfully complete pivotal clinical trials, obtain marketing approvals, manufacture a commercial-scale product or arrange for a third party to do so on our behalf, or conduct sales and marketing activities necessary for successful product commercialization.

In order to complete later stage or pivotal trials, we will need to expand our clinical operations, CMC and regulatory capabilities, and we may be unable to recruit and train qualified personnel or sign a contract with a global clinical research organization to conduct the trials on our behalf.

In order to complete later stage or pivotal trials, we are expanding our clinical operations, CMC and regulatory capabilities, and we may be unable to recruit and train qualified personnel or sign a contract with a global clinical research organization to conduct the trials on our behalf.

Consequently, we may be unable to successfully and efficiently design, execute and complete necessary clinical trials in a way that leads to approval of bel-sar or future product candidates.

49 unchanged sentences

factors we may not be able to control that may limit patients, principal investigators or staff or clinical site availability.

We may in the future conduct clinical trials for current or future product candidates outside the United States, and the FDA and comparable foreign regulatory authorities may not accept data from such trials.

We may in the future choose to conduct one or more clinical trials outside the United States, including in Europe.

We are conducting a clinical trial outside the United States, and we may in the future conduct additional clinical trials for current or future product candidates outside the United States, and the FDA and comparable foreign regulatory authorities may not accept data from such trials.

We are currently conducting a clinical trial at sites in Ireland, the UK, Brazil, Canada, Australia, Austria, Italy, Greece, South Korea, Israel, Germany, France, Spain, Denmark, Sweden, Belgium, and the Czech Republic, and may in the future choose to conduct one or more additional clinical trials outside the United States, including in Europe.

The acceptance of data from clinical trials conducted outside the United States or another jurisdiction by the FDA or comparable foreign regulatory authority may be subject to certain conditions or may not be accepted at all.

103 unchanged sentences

Significant preclinical study or clinical trial delays also could shorten any periods during which we may have the exclusive right to commercialize our product candidates or allow our competitors to bring products to market before we do, which would impair our ability to successfully commercialize our product candidates and may significantly harm our business, operating results, financial condition and prospects.

Even if we receive regulatory approval for any of our product candidates, we will be subject to ongoing regulatory obligations and continued regulatory review, which may result in significant additional expense.

Additionally, our product candidates, if approved, could be subject to post-marketing commitments/requirements, marketing and labeling restrictions, and even recall or market withdrawal if unanticipated safety issues are discovered following approval.

75 unchanged sentences

Even if we do receive accelerated approval, we may not experience a faster development or regulatory review or approval process, and receiving accelerated approval does not provide assurance of ultimate FDA approval.

The FDA’s agreement to a Special Protocol Assessment with respect to the study design of our Phase 3 clinical trial of bel-sar for the treatment of early-stage choroidal melanoma does not guarantee any particular outcome from regulatory review, including ultimate approval, and may not lead to a successful review or approval process.

We have obtained agreement from the FDA on the design and planned analysis of our Phase 3 clinical trial of bel-sar for the treatment of early-stage choroidal melanoma through a Special Protocol Assessment (SPA).

A SPA agreement documents FDA’s agreement that the design and planned analysis of a study can adequately address objectives in support of a regulatory submission.

However, final determinations for marketing application approval are made after complete review of a marketing application and are based on the entire data in the application.

The FDA’s SPA process is designed to facilitate the FDA’s review and approval of drugs and biologics by allowing the FDA to evaluate the proposed design and size of certain clinical or animal studies, including clinical trials that are intended to form the primary basis for determining a product candidate’s efficacy.

The FDA ultimately assesses whether specific elements of the protocol design of the trial, such as entry criteria, dose selection, endpoints and/or planned analyses, are acceptable to support a regulatory submission.

Although the FDA may agree to an SPA, an SPA agreement does not guarantee approval of a product.

Even if the FDA agrees to the design, execution, and analysis proposed in protocols reviewed under the SPA process, the FDA may revoke or alter its agreement in certain circumstances.

In particular, an SPA agreement is not binding on the FDA if public health concerns emerge that were unrecognized at the time of the SPA agreement, other new scientific concerns regarding product safety or efficacy arise, the sponsor company fails to comply with the agreed upon trial protocols, or the relevant data, assumptions or information provided by the sponsor in a request for the SPA change or are found to be false or omit relevant facts.

In addition, even after an SPA agreement is finalized, the SPA agreement may be modified, and such modification will be deemed binding by the FDA review division, except under the circumstances described above, if the FDA and the sponsor agree in writing to modify the protocol.

Generally, such modification is intended to improve the study.

The FDA retains significant latitude and discretion in interpreting the terms of the SPA agreement and the data and results from any study that is the subject of the SPA agreement.

Moreover, if the FDA revokes or alters its agreement under the SPA, or interprets the data collected from the clinical trial differently than we do, the FDA may not deem the data sufficient to support an application for regulatory approval of bel-sar for the treatment of indeterminate lesions and choroidal melanoma.

Risks Related to Our Reliance on Third Parties

453 unchanged sentences

Although there are limited exemptions for clinical trial data and the CCPA’s implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, the CCPA may increase our compliance costs and potential liability.

It is anticipated that the CCPA will be expanded on January 1, 2023, when the California Privacy Rights Act of 2020, or CPRA, becomes operative.

The CPRA will, among other things, give California residents the ability to limit use of certain sensitive information, establish restrictions on the retention of personal data, expand the types of data breaches subject to the CCPA’s private right of action and establish a new California Privacy Protection Agency to implement and enforce the new law.

In addition, other states have enacted or proposed data privacy laws.

For example, Virginia recently passed its Consumer Data Protection Act and Colorado recently passed the Colorado Privacy Act, both of which differ from the CPRA and go into effect in 2023.

The CCPA was expanded on January 1, 2023, when the California Privacy Rights Act of 2020, or CPRA, became operative.

The amendments introduced by the CPRA expanded the scope of the CCPA in a number of ways, including by providing California residents the ability to limit use of certain sensitive information, establishing restrictions on the retention of personal data, expanding the types of data breaches subject to the CCPA’s private right of action and establishing a new California Privacy Protection Agency to implement and enforce the new law.

Comprehensive consumer privacy laws have been passed in twelve other states and a number of other states have proposed new privacy law.

Such proposed legislation, if enacted, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies.

The existence of comprehensive privacy laws in different states in the country would make our compliance obligations more complex and costly and may increase the likelihood that we may be subject to enforcement actions or otherwise incur liability for noncompliance.

In addition, laws in all 50 U.S.

states require businesses to provide notice to individuals if certain of their personal information has been disclosed as a result of a qualifying data breach.

There are also states that are specifically regulating health information.

In addition, other states have proposed and/or passed legislation that regulates the privacy and/or security of certain specific types of information.

For example, a small number of states have passed laws that regulate biometric data specifically.

These various privacy and security laws may impact our business activities, including our identification of research subjects, relationships with business partners and ultimately the marketing and distribution of our products.

State laws are changing rapidly and there is discussion in the U.S.

Congress of a new comprehensive federal data privacy law to which we may likely become subject, if enacted.

These laws demonstrate our vulnerability to the evolving regulatory environment related to personal data.

As we expand our operations, these and similar laws may increase our compliance costs and potential liability.

Foreign data protection laws, such as, without limitation, the EU GDPR, the EU member state implementing legislation, and the UK GDPR, may also apply to health-related and other personal data that we process, including, without limitation, personal data relating to clinical trial participants.

Foreign data protection laws, such as, without limitation, the EU GDPR (General Data Protection Regulation), the EU member state implementing legislation, and the UK GDPR, may also apply to health-related and other personal data that we process, including, without limitation, personal data relating to clinical trial participants.

The GDPR imposes strict obligations on the ability to process health-related and other personal data, including in relation to security (which requires the adoption of administrative, physical and technical safeguards designed to protect such information), collection, use and transfer or personal data.

These obligations include, without limitation, several requirements relating to transparency related to communications with data subjects regarding the processing of their personal data, obtaining the consent of the individuals to whom the personal data relates in certain circumstances, limitations on the retention of personal data, increased requirements pertaining to health data, establishing a legal basis for processing, notification of data processing obligations or security incidents to the competent national data protection authorities and/or data subjects, the security and confidentiality of the personal data, various rights that data subjects may exercise with respect to their personal data, and strict rules and restrictions on the international transfer of personal data.

The GDPR prohibits the transfer of personal data to countries outside the EEA/UK which are not considered by the European Commission and UK government as providing “adequate”

protection of personal data, including the United States, unless a valid GDPR transfer mechanism (for example, the European Commission approved Standard Contractual Clauses, or SCCs, and the UK International Data Transfer Agreement/Addendum, or UK IDTA) has been put in place.

Where relying on the SCCs /UK IDTA for data transfers, we may also be required to carry out transfer impact assessments to assess whether the recipient is subject to local laws which allow public authority access to personal data.

The international transfer obligations under the EEA/UK data protection regimes will require significant effort and cost, and may result in us needing to make strategic considerations around where EEA/UK personal data is transferred and which service providers we can utilize for the processing of EEA/UK personal data.

Although the UK is regarded as a third country under the EU GDPR, the European Commission has issued a decision recognizing the UK as providing adequate protection under the EU GDPR, or Adequacy Decision, and, therefore, transfers of personal data originating in the EEA to the UK remain unrestricted.

The GDPR imposes strict rules on the transfer of personal data out of the EEA and UK to other regions outside the EEA/UK, or third countries, that have not been deemed to offer “adequate”

privacy protections by the competent data protection authorities, including the United States in certain circumstances, unless a derogation exists or adequate international transfer safeguards (for example, the European Commission approved Standard Contractual Clauses, or the EU SCCs, and the UK International Data Transfer Agreement/Addendum, or the UK IDTA) are put in place.

Where relying on the EU SCCs or UK IDTA for data transfers, we may also be required to carry out transfer impact assessments on the transfers made pursuant to the EU SCCs and UK IDTA, on a case-by-case basis, to ensure the law in the recipient country provides “essentially equivalent”

protections to safeguard the transferred personal data as provided in the EEA and UK, and may be required to adopt supplementary measures if this standard is not met.

The international transfer obligations under the EEA and UK data protection regimes will require significant effort and cost, and may result in us needing to make strategic considerations around where EEA and UK personal data is located and which service providers we can utilize for the processing of EEA and UK personal data.

Any inability to process or transfer personal data from the EEA to the United States in compliance with data protection laws may impede our ability to conduct trials and may adversely affect our business and financial position.

Although the UK is regarded as one of the third countries under the EU GDPR, the European Commission has adopted an adequacy decision in favor of the UK, enabling data transfers from EEA member states to the UK without additional safeguards.

The UK government has confirmed that personal data transfers from the UK to the EEA remain free flowing.

The UK Government has also now introduced a Data Protection and Digital Information Bill, or UK Bill, into the UK legislative process.

The relationship between the UK and the EU in relation to certain aspects of data protection law remains unclear, and it is unclear how UK data protection laws and regulations will develop in the medium to longer term, and how data transfers to and from the UK will be regulated in the long term.

Further, the UK Government has introduced a Data Protection and Digital Information Bill, or the UK Bill, into the UK legislative process.

The aim of the UK Bill is to reform the UK’s data protection regime following Brexit.

If passed, the final version of the UK Bill may have the effect of further altering the similarities between the UK and EEA data protection regime and threaten the UK Adequacy Decision from the EU Commission.

This may lead to additional compliance costs and could increase our overall risk.

The respective provisions and enforcement of the EU GDPR and UK GDPR may further diverge in the future and create additional regulatory challenges and uncertainties.

If passed, the final version of the UK Bill may have the effect of further altering the similarities between the UK and EEA data protection regime and threaten the UK adequacy decision from the European Commission.

In addition, EEA Member States have adopted national laws to implement the GDPR that may partially deviate from the GDPR.

Further, the competent authorities in the EEA Member States may interpret GDPR obligations slightly differently from country to country and therefore we do not expect to operate in a uniform legal landscape in the EEA.

The potential of the respective provisions and enforcement of the EU GDPR and UK GDPR further diverging in the future creates additional regulatory challenges and uncertainties for us.

This lack of clarity on future UK laws and regulations and their interaction with EU laws and regulations could add legal risk, complexity and cost to our handling of personal data and our privacy and data security compliance programs and could require us to implement different compliance measures for the UK and the EEA.

The increase of foreign privacy and security legal frameworks with which we must comply, increases our compliance burdens and exposure to substantial fines and penalties for non-compliance.

15 unchanged sentences

Compliance with data protection laws may be time consuming, require additional resources and could result in increased expenses, reduce overall demand for our products and make it more difficult to meet expectations of or commitments to our relevant stakeholders.

Artificial intelligence presents risks and challenges that can impact our business including by posing security risks to our confidential information, proprietary information, and personal data.

Issues in the development and use of artificial intelligence, combined with an uncertain regulatory environment, may result in reputational harm, liability or other adverse consequences to our business operations.

As with many technological innovations, artificial intelligence presents risks and challenges that could impact our business.

We may integrate generative artificial intelligence tools into our systems for specific use cases reviewed by legal and information security.

In addition, our vendors may incorporate generative artificial intelligence tools into their offerings without disclosing this use to us, and the providers of these generative artificial intelligence tools may not meet existing or rapidly evolving regulatory or industry standards with respect to privacy and data protection and may inhibit our or our vendors’

ability to maintain an adequate level of service and experience.

If we, our vendors, or our third-party partners experience an actual or perceived breach or privacy or security incident because of the use of generative artificial intelligence, we may lose valuable intellectual property and confidential information and our reputation and the public perception of the effectiveness of our security measures could be harmed.

Further, bad actors around the world use increasingly sophisticated methods, including the use of artificial intelligence, to engage in illegal activities involving the theft and misuse of personal information, confidential information, and intellectual property.

Any of these outcomes could damage our reputation, result in the loss of valuable property and information, and adversely impact our business.

Business disruptions could seriously harm our future revenue and financial condition and increase our costs and expenses.

62 unchanged sentences

Our principal stockholders and management own a significant percentage of our stock and will be able to exert significant influence over matters subject to stockholder approval.

Based on the beneficial ownership of our common stock as of June 30, 2023, our executive officers, directors, holders of 5% or more of our capital stock and their respective affiliates beneficially owned approximately 54.8% of our outstanding common stock.

Based on the beneficial ownership of our common stock as of September 30, 2023, our executive officers, directors, holders of 5% or more of our capital stock and their respective affiliates beneficially owned approximately 54.8% of our outstanding common stock.

As a result, these stockholders, if acting together, will continue to have significant influence over the outcome of corporate actions requiring stockholder approval, including the election of directors, amendment of our organizational documents, any merger, consolidation or sale of all or substantially all of our assets and any other significant corporate transaction.

85 unchanged sentences

These sales, or the perception in the market that the holders of a large number of shares of common stock intend to sell shares, could reduce the market price of our common stock.

As of June 30, 2023, we have 38,086,606 shares of common stock outstanding.

As of September 30, 2023, we have 38,216,717 shares of common stock outstanding.

Significant portions of these shares are held by a small number of stockholders, including persons who were our stockholders prior to our IPO.

46 unchanged sentences

and international markets.

In addition, the current military conflict between Russia and Ukraine could disrupt or otherwise adversely impact our operations and those of third parties upon which we rely.

In addition, the current military conflict between Russia and Ukraine and the armed conflict in Israel and the Gaza Strip could disrupt or otherwise adversely impact our operations and those of third parties upon which we rely.

Related sanctions, export controls or other actions that may be initiated by nations including the United States, the EU or Russia (e.g., potential cyberattacks, disruption of energy flows, etc.), which could adversely affect our business and/or our supply chain, our CROs, CDMOs and other third parties with which we conduct business.

50 unchanged sentences

results of preclinical studies and results or enrollment of clinical trials of bel-sar or our future product candidates, or those of our potential future competitors or our existing or future collaborators;

the impact of the COVID-19 pandemic on our employees, trials, collaboration partners, suppliers, our results of operations, liquidity and financial condition;

regulatory or legal developments in the United States and other countries, especially changes in laws or regulations applicable to our product candidates;

22 unchanged sentences

natural disasters, pandemics and other calamities;

acts of war or periods of widespread civil unrest, including the increasingly volatile global economic conditions resulting from the Russia-Ukraine conflict;

acts of war or periods of widespread civil unrest, including the increasingly volatile global economic conditions resulting from the Russia-Ukraine conflict and Israel-Hamas conflict;

general economic, industry, and market conditions, including inflationary pressures.

35 unchanged sentences

Accordingly, because of the inherent limitations in our control system, misstatements due to error or fraud may occur and not be detected.

Global economic uncertainty and unfavorable global economic conditions caused by political instability, changes in trade agreements and conflicts, such as the conflict between Russia and Ukraine, could adversely affect our business, financial condition, results of operations or prospects.

Global economic uncertainty and unfavorable global economic conditions caused by political instability, changes in trade agreements and conflicts, such as the Russia-Ukraine and Israel-Hamas conflicts, could adversely affect our business, financial condition, results of operations or prospects.

Our business, financial condition, results of operations or prospects could be adversely affected by general conditions in the global economy and in the global financial markets.

A severe or prolonged economic downturn, increased inflation, economic uncertainties in various global markets caused by political instability and conflict, such as the Russia-Ukraine conflict, or additional global financial crises, could result in a variety of risks to our business, including weakened demand for our product candidates, if approved, or our inability to raise additional capital when needed on acceptable terms, if at all.

A severe or prolonged economic downturn, increased inflation, economic uncertainties in various global markets caused by political instability and conflict, such as the Russia-Ukraine and Israel-Hamas conflicts, or additional global financial crises, could result in a variety of risks to our business, including weakened demand for our product candidates, if approved, or our inability to raise additional capital when needed on acceptable terms, if at all.

A weak or declining economy could also strain our suppliers, possibly resulting in supply disruption.

9 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors