What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2021-08-04 compared with 2021-05-13 · 91 added, 108 removed, 1151 unchanged (15% of the section changed)

30 unchanged sentences

We cannot be certain that we will achieve or sustain profitability.*

We incurred net losses of $9.9 million and $10.5 million, and used cash in operations of $13.9 million and $8.0 million for the three months ended March 31, 2021 and 2020, respectively.

As of March 31, 2021, we had an accumulated deficit of $153.6 million.

We incurred net losses of $28.7 million and $18.6 million, and used cash in operations of $26.3 million and $15.3 million for the six months ended June 30, 2021 and 2020, respectively.

As of June 30, 2021, we had an accumulated deficit of $172.4 million.

We cannot predict if we will achieve sustained profitability in the near future or at all.

2 unchanged sentences

These increased expenses will make it harder for us to achieve and sustain future profitability.

We may incur significant losses in the future for a number of reasons, many of which are beyond our control, including the other risks described in this Annual Report, the market acceptance of our products, future product development and our market penetration and margins.

We may incur significant losses in the future for a number of reasons, many of which are beyond our control, including the other risks described in this Quarterly Report, the market acceptance of our products, future product development and our market penetration and margins.

Our quarterly and annual operating results and cash flows have fluctuated in the past and might continue to fluctuate, which could cause the market price of our securities to decline substantially.

64 unchanged sentences

If we raise additional funds through collaboration and licensing arrangements with third parties, it may be necessary to relinquish some rights to our technologies or our products, or grant licenses on terms that are not favorable to us.

In addition, the COVID-19 pandemic may compromise our ability to comply with the terms of our loan agreement and could result in an event of default.

If an event of default were to occur, our lender could accelerate our repayment obligations or enforce other rights under our loan agreements.

Any such default may also require us to seek additional or alternative financing, which may not be available on commercially reasonable terms or at all.

For example, for the three months ended September 30, 2020, we were not in compliance with the revenue covenant under the Innovatus LSA.

Although we secured a waiver for such

noncompliance in December 2020, there can be no assurance that we will be able to maintain compliance with our covenants in the Innovatus LSA in the future and securing such waivers in the future may require us to divert further cash towards the repayment of debt and subject us to fees incurred in connection with the negotiation of such waivers.

If we do not have, or are not able to obtain, sufficient funds, we may have to delay development or commercialization of our products.

41 unchanged sentences

As of December 31, 2020, we have federal and state tax net operating loss carryforwards of $266.7 million and $114.0 million, respectively.

The federal tax loss carryforwards include $102.5 million that do not expire, but utilization of such tax loss carryforwards in taxable years beginning after December 31, 2020 is limited to 80% of the Company's taxable income.

The remaining federal tax loss carryforwards of $164.2 million and state tax loss carryforwards begin to expire in 2027 and 2023, respectively, unless previously utilized.

12 unchanged sentences

taxation of such activities could increase our worldwide effective tax rate and harm our future financial position and results of operations.

The terms of our debt facility place restrictions on our operating and financial flexibility, and failure to comply with covenants or to satisfy certain conditions of the agreement governing the debt facility may result in acceleration of our repayment obligations and foreclosure on our pledged assets, which could significantly harm our liquidity, financial condition, operating results, business and prospects and cause the price of our securities to decline.

On March 14, 2019, we entered into a Loan and Security Agreement, or the Innovatus LSA, with Innovatus Life Sciences Lending Fund I, LP, or Innovatus, and certain lenders, which provides for borrowings up to $25.0 million pursuant to certain term loans and an additional $5.0 million under a revolving credit line.

The Innovatus LSA is secured by a lien covering substantially all of our assets, including our intellectual property.

As of March 31, 2021, we owed approximately $14.9 million in principal amounts of term loans under the Innovatus LSA.

The Innovatus LSA requires us to comply with a number of covenants (affirmative and negative), including restrictive covenants that limit our ability to:

incur additional indebtedness;

encumber the collateral securing the loan;

acquire, own or make investments;

repurchase or redeem any class of stock or other equity interest;

declare or pay any cash dividend or make a cash distribution on any class of stock or other equity interest;

transfer a material portion of our assets;

acquire other businesses;

and merge or consolidate with or into any other organization or otherwise suffer a change in control, in each case subject to exceptions.

Our intellectual property is also subject to customary negative covenants.

The Innovatus LSA also includes standard events of default, including a provision that Innovatus could declare an event of default upon the occurrence of any event that it interprets as having a material adverse effect upon our business, operations, properties, assets, or financial condition or upon our ability to perform or pay the secured obligations under the Innovatus LSA or upon the collateral or the liens on the collateral under the agreement, thereby requiring us to repay the loan immediately, together with a prepayment fee and other applicable fees.

If we default under the Innovatus LSA, Innovatus may accelerate all of our repayment obligations and, if we are unable to access funds to meet those obligations or to renegotiate our agreement, Innovatus could take control of our pledged assets and we could immediately cease operations.

For example, we were unable to maintain compliance with certain covenants under the Innovatus LSA as of September 30, 2019, December 31, 2019 and September 30, 2020.

In order to secure waivers for the September 30, 2019, December 31, 2019, September 30, 2020 breaches, we have been required to pay consideration to Innovatus, including, with respect to our breach of our covenant as of December 31, 2019, our agreement to pay a waiver fee of $200,000 and a prepayment of $2.1 million of principal, as well as to prepay an additional $2.9 million of principal upon the earlier of April 30, 2020 or the closing of one or more equity financings during a specified period resulting in at least $15.0 million of gross proceeds to us in the aggregate, and a $100,000 prepayment fee in connection with such second repayment.

In addition, to secure a waiver in December 2020 with respect to our breach of our covenant as of September 30, 2020, we agreed to close an equity financing during a specified period resulting in at least $20.0 million of gross proceeds to us in the aggregate, which we satisfied in January 2021.

We may not be able to maintain compliance with our covenants in the Innovatus LSA in the future and, although we have been able to secure waivers from Innovatus in the past, securing such waivers in the future may require us to divert further cash towards the repayment of debt and subject us to fees incurred in connection with the negotiation of such waivers.

If we are unable to maintain compliance or obtain a waiver of any breach under the Innovatus LSA, Innovatus could declare an event of default or require us to renegotiate the Innovatus LSA on terms that may be significantly less favorable to us.

If we were liquidated, Innovatus’ right to repayment would be senior to the rights of our stockholders to receive any proceeds from the liquidation.

Any declaration by Innovatus of an event of default could significantly harm our liquidity, financial condition, operating results, business, and prospects and cause the price of our securities to decline.

In order to obtain waivers for any future breaches of covenants, we may be required to pay additional fees and penalties and issue shares of our common stock to Innovatus as consideration.

We may incur additional indebtedness in the future.

The debt instruments governing such indebtedness may contain provisions that are as, or more, restrictive than the provisions governing our existing indebtedness under the Innovatus LSA.

If we are unable to repay, refinance or restructure our indebtedness when payment is due, the lenders could proceed against the collateral or force us into bankruptcy or liquidation.

Risks related to our business operations

4 unchanged sentences

Compared to some competing technologies, our technology is new and complex, and many potential customers have limited knowledge of, or experience with, our products.

Prior to adopting our systems, some potential customers may need to devote time and effort to testing and validating our systems.

Any failure of our systems to meet these

customer benchmarks could result in potential customers choosing to retain their existing systems or to purchase systems other than ours.

Prior to adopting our systems, some potential

customers may need to devote time and effort to testing and validating our systems.

Any failure of our systems to meet these customer benchmarks could result in potential customers choosing to retain their existing systems or to purchase systems other than ours.

In addition, it is important that our gene mapping systems be perceived as accurate and reliable by the scientific and medical research community as a whole.

262 unchanged sentences

If we are unable to attract, train or retain the number of highly qualified technical services personnel that our business needs, our business and prospects will suffer.

Security breaches or other types of security incidents of our or our third-party service providers’, consultants’, or contractors’ networks or systems could result in a material disruption of our services, compromise sensitive information related to our business or other personal information, may cause us to incur significant liabilities and adversely affect our business, results of operations, financial condition, and future prospects.*

Security breaches or other types of security incidents affecting our or our third-party service providers’, consultants’, or contractors’ networks or systems could result in a material disruption to our services, compromise personal or sensitive information related to our business, may cause us to incur significant liabilities and adversely affect our business, results of operations, financial condition, and future prospects.*

We are increasingly dependent upon information technology systems, infrastructure and data to operate our business.

In the ordinary course of our business, we collect, store, use, transmit, and otherwise process sensitive data and confidential information, including but not limited to intellectual property, proprietary business information owned or controlled by ourselves or our customers, financial information and, where allowed, personal information (including protected health information).

The secure collection, storage, use, transmission and processing of such sensitive data and confidential information is vital to our operations and business strategy.

In the ordinary course of our business, we collect, store, use, transmit, and otherwise process sensitive, proprietary and confidential information, including but not limited to intellectual property, proprietary business information owned or controlled by ourselves or our customers, financial information and, where allowed, personal information (including protected health information).

The secure collection, storage, use, transmission and processing of such information is vital to our operations and business strategy.

Any actual or perceived breach of our security measures or those of our third-party service providers, consultants, or contractors could adversely affect our business, operations, financial condition, and future prospects.

The procedures and controls we use to monitor cyber security threats and mitigate our exposure to such threats may not be sufficient to prevent cyber security incidents, and our internal information technology systems and those of our third-party service providers, consultants, and contractors are potentially vulnerable to breakdown or other damage or interruption from service interruptions, system malfunction, natural disasters, terrorism, war, public health crises (such as the COVID-19 global pandemic), telecommunication and electrical failures, as well as security breaches from inadvertent or intentional actions by our employees, contractors, consultants, business partners, and/or other third parties, or from cyber-attacks by malicious third parties (including the deployment of harmful malware, ransomware, viruses, worms, denial-of-service attacks, supply chain attacks, social engineering and other means to affect service reliability and threaten the confidentiality, integrity and availability of information), which may compromise our, or our third-party service providers’ consultants’, or contracts’ system infrastructure or lead to data leakage.

To the extent that any disruption or security breach were to result in a loss of, or damage to, our data or applications, or inappropriate disclosure of sensitive data and confidential information, we could incur liability and reputational damage.

The procedures and controls we use to monitor cyber security threats and mitigate our exposure to such threats may not be sufficient to prevent cyber security incidents, and our internal information technology systems and those of our third-party service providers, consultants, and contractors are potentially vulnerable to breakdown or other damage or interruption from service interruptions, system malfunction, natural disasters, terrorism, war, public health crises (such as the COVID-19 global pandemic), telecommunication and electrical failures, theft as well as security breaches from inadvertent or intentional actions by our employees, contractors, consultants, business partners, and/or other third parties, or from cyber-attacks by malicious third parties (including the deployment of harmful malware, ransomware, viruses, worms, denial-of-service attacks, supply chain attacks, social engineering schemes and other means to affect service reliability and threaten the confidentiality, integrity and availability of information), which may compromise our, or our third-party service providers’ consultants’, or contracts’ system infrastructure or lead to data leakage or misdirected payments to and from us.

Ransomware attacks, including those from organized criminal threat actors, nation-states and nation-state supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions, delays, or outages in our operations, loss of data, loss of income, significant extra expenses to restore data or systems, reputational loss and the diversion of funds.

To alleviate the financial, operational and reputational impact of a ransomware attack it may be preferable to make extortion payments, but we may be unwilling or unable to do so (including, for example, if applicable laws or regulations prohibit such payments).

Similarly, supply chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our platform, systems and networks or the systems and networks of third parties that support us and our services.

Despite the security controls we have in place, such attacks are very difficult to avoid.

To the extent that any disruption or security breach were to result in a loss of, or damage to, our data or applications, or inappropriate disclosure of information, we could incur liability and reputational damage.

In addition, these incidents could result in disrupted operations, lost opportunities, misstated financial data, increased costs arising from the implementation of additional security protective measures and litigation costs.

While we have security measures in place to protect sensitive data and confidential information and prevent data loss and other security breaches, we cannot guarantee that our, or our third-party service providers’, consultants’, or contractors’ security measures will be sufficient to protect against unauthorized access to, or other compromise of such sensitive data and confidential information.

While we have security measures in place designed to protect information and prevent data loss and other security breaches, we cannot guarantee that our, or our third-party service providers’, consultants’, or contractors’ security measures will be sufficient to protect against unauthorized access to, or other compromise of such information.

The techniques used to sabotage or to obtain unauthorized access to our platform, systems, networks and/or physical facilities in which data is stored or through which data is transmitted change frequently, and we may be unable to anticipate such techniques or implement adequate preventative measures or stop security breaches that may arise from such techniques.

As a result, our safeguards and preventive measures may not be adequate to prevent current or future cyberattacks and security incidents, including security breaches that may remain undetected for extended periods of time, which can substantially increase the potential for a material adverse impact resulting from the breach.

We are also required to comply with laws, rules, industry standards and regulations that require us to maintain the security of sensitive data and confidential information.

We may also have contractual and other legal obligations to notify relevant stakeholders of security breaches.

Failure to prevent or mitigate cyberattacks could result in unauthorized access to such sensitive data and confidential information, including personal information (and protected health information).

We are also required to comply with laws, rules, industry standards, regulations, policies and contracts that may require us to maintain the security of information.

In addition, we may have contractual and other legal obligations to notify relevant stakeholders of security breaches.

Failure to prevent or mitigate cyberattacks could result in unauthorized access to such information, including personal information (and protected health information).

Most jurisdictions have enacted laws requiring companies to notify individuals, regulatory authorities and others of security breaches involving certain types of data.

2 unchanged sentences

In addition, any costs or other liabilities related to responding to a cybersecurity event or to mitigate any identified security vulnerabilities could be significant, including costs for remediating the effects of such an event, paying a ransom, restoring data from backups, and conducting data analysis to determine what data may have been affected by the breach.

In addition, our efforts to contain or remediate a security breach or any vulnerability exploited to cause a breach may be unsuccessful, and efforts and any related failures to contain or remediate them could result in interruptions, delays, loss in customer trust, harm to our reputation, and increases to our insurance coverage.

For example, any such event that leads to unauthorized access, use, or disclosure of sensitive data and confidential information, including personal information related to our patient samples or employees, could harm our reputation directly, compel us to comply with federal and/or state breach notification laws and foreign law equivalents, subject us to mandatory corrective action, and otherwise subject us to liability under laws and regulations that protect the privacy and security of personal information, which could result in significant legal and financial exposure and reputational damages that could potentially have an adverse effect on our business.

In addition, our efforts to contain or remediate a security breach or any vulnerability exploited to cause a breach may be unsuccessful, and efforts and any related failures to contain or remediate

them could result in interruptions, delays, loss in customer trust, harm to our reputation, and increases to our insurance coverage.

For example, any such event that leads to unauthorized access, use, or disclosure of information, including personal information related to our patient samples or personnel, could harm our reputation directly, compel us to comply with federal and/or state breach notification laws and foreign law equivalents, subject us to mandatory corrective action, and otherwise subject us to liability under laws and regulations that protect the privacy and security of personal information, which could result in significant legal and financial exposure and reputational damages that could potentially have an adverse effect on our business.

We may not have adequate insurance coverage for security incidents or breaches, including fines, judgments, settlements, penalties, costs, attorney fees and other impacts that arise out of incidents or breaches.

2 unchanged sentences

Our risks are likely to increase as we continue to expand, grow our customer base, and process, store, and transmit increasingly large amounts of confidential, proprietary and sensitive data.

We are subject to stringent and changing laws, regulations and standards, and contractual obligations related to privacy and data security.

The actual or perceived failure to comply with applicable data protection, privacy, and security laws, regulations, standards, and other requirements could adversely affect our business, results of operations, and financial conditions.*

We are subject to numerous foreign and domestic laws, regulations and standards regarding privacy and data security that govern the personal information and other data we may collect, store, use, or process.

The regulatory framework for privacy issues is rapidly evolving and is likely to remain uncertain for the foreseeable future.

We are subject to stringent and changing privacy laws, regulations and standards, as well as policies, contracts and other obligations related to data privacy and security.

Our actual or perceived failure to comply with such obligations could lead to enforcement or litigation (that could result in fines or penalties), reputational harm, or other adverse business effects.

We are or may become subject to numerous foreign and domestic laws, regulations and standards regarding privacy and data security that govern the personal information and other data we may collect, store, use, or process.

The regulatory framework for privacy and data protection issues is rapidly evolving and is likely to remain uncertain for the foreseeable future.

Many government bodies and agencies have adopted or are considering adopting laws and regulations regarding the collection, use, storage, destruction, and disclosure of personal information and breach notification procedures.

We are also required to comply with laws, rules and regulations relating to data security.

Interpretation of these laws, rules and regulations in applicable jurisdictions is subject to change and cannot be fully determined at this time.

Privacy has become a significant issue in the United States.

For example, on June 28, 2018, California adopted the California Consumer Privacy Act of 2018, or CCPA, which took effect on January 1, 2020.

The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used.

We are also or may become required to comply with laws, rules and regulations relating to data security.

Interpretation of these laws, rules and regulations in applicable jurisdictions is subject to change and may result in potentially conflicting obligations.

The federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and their respective implementing regulations, impose requirements relating to the privacy, security and transmission of individually identifiable health information.

Such laws may apply to us, our customers or our service providers.

Among other things, HITECH, through its implementing regulations, makes certain of HIPAA’s privacy and security standards directly applicable to business associates, defined as a person or organization, other than a member of a covered entity’s workforce, that creates, receives, maintains or transmits protected health information for or on behalf of a covered entity for a function or activity regulated by HIPAA as well as their covered subcontractors.

Most healthcare providers in the United States, including institutions from which we may obtain customer data, are subject to privacy and security regulations promulgated under HIPAA, as amended by HITECH.

A person may be prosecuted for alleged HIPAA violations either directly or indirectly such as under aiding-and-abetting or conspiracy principles.

Consequently, depending on the facts and circumstances, we could face substantial civil and criminal penalties and liabilities if we knowingly receive individually identifiable health information from a HIPAA-covered healthcare provider that has not satisfied HIPAA’s requirements for disclosure of individually identifiable health information.

In the United States, at the state level, the California Consumer Privacy Act of 2018 (“CCPA”), which took effect on January 1, 2020, gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used.

The CCPA also provides for civil penalties for violations and contains a private right of action for data breaches that is expected to increase litigation involving misuse of personal information of California residents.

3 unchanged sentences

Some observers have noted that the CCPA and CPRA could mark the beginning of a trend of states adopting more stringent privacy laws in the U.S., which could further increase our compliance costs, potential liability and adversely affect our business.

For example, Virginia recently passed its Consumer Data Protection Act, and Colorado recently passed the Colorado Privacy Act, both of which differ from the CPRA and become effective in 2023.

The global data protection landscape is also rapidly evolving, and we expect there will continue to be new and proposed laws, regulations, and industry standards concerning privacy, data protection, and information security.

We cannot yet determine the impact that such future laws, regulations and standards may have on our business.

For example, in May 2018, the General Data Protection Regulation, or the GDPR, went into effect in the European Union.

The GDPR imposes stringent data protection requirements and to date, has increased compliance burdens on us, including by mandating burdensome documentation requirements and granting certain rights to individuals to control how we collect, use, disclose, retain and process their personal data.

The GDPR also provides for more robust regulatory enforcement and greater penalties for noncompliance than previous data protection laws, including fines of up to €20 million or 4% of global annual revenue of any noncompliant company for the preceding financial year, whichever is greater.

For example, in May 2018, the European Union’s General Data Protection Regulation, or the GDPR, took effect across the European Economic Area (“EEA”)..

Also, notwithstanding the United Kingdom’s (“UK”) withdrawal from the EU, the GDPR continues to apply in substantially equivalent form in the context of the UK, UK establishments and UK-focused processing operations by operation of the so-called “UK GDPR.” European data protection laws imposes stringent data protection requirements and to date, has increased compliance burdens on us, including by mandating burdensome documentation requirements and granting certain rights to individuals to control how we collect, use, disclose, retain and process their personal data.

The GDPR also provides for more robust regulatory enforcement and greater fines for noncompliance than previous data protection laws, including fines of up to €20 million or 4% of global annual revenue of any noncompliant company for the preceding financial year, whichever is greater as well as the potential for processing penalties that include the inability to process European personal data.

European data protection laws including the GDPR also generally prohibit the transfer of personal information from Europe to the United States and most other countries unless the parties to the transfer have implemented specific safeguards to protect the transferred personal information.

2 unchanged sentences

While the CJEU upheld the validity of Standard Contractual Clauses, the CJEU ruled that the underlying data transfers must be assessed on a case-by-case basis by the data controller to determine whether the personal information will be adequately protected.

Further, the European Commission recently proposed updates to the Standard Contractual Clauses.

Further, the European Commission recently adopted new SCCs under the GDPR for personal data transfers outside the EEA, which may require us to expend significant resources to update our contractual arrangements and conduct personal data transfer impact assessments.

At present, there are few if any viable alternatives to the Standard Contractual Clauses and, therefore, there is uncertainty regarding how to ensure that transfers of personal information from Europe to the United States comply with the GDPR.

As such, any transfers by us, or our third party service providers, of personal information from Europe may not comply with European data protection laws;

As such, any transfers by us, our customers or our third party service providers, of personal information from Europe may not comply with European data protection laws;

may increase our exposure to the GDPR’s heightened sanctions for violations of its cross-border data transfer restrictions;

and may reduce demand for our

services from companies subject to European data protection laws.

and may reduce demand for our services from companies subject to European data protection laws.

Loss of our ability to transfer personal information from Europe may also require us to increase our data processing capabilities in those jurisdictions at significant expense.

Moreover, other countries outside of Europe have enacted or are considering enacting similar cross-border data transfer restrictions and laws requiring local data residency, which could increase the cost and complexity of delivering our services and operating our business.

Further, the United Kingdom’s decision to leave the EU, often referred to as Brexit, has created uncertainty about the regulation of data protection in the U.K., including with respect to whether laws or regulations will apply to us consistent with the GDPR in the future and how data transfers to and from the U.K.

3 unchanged sentences

Furthermore, the relationship between the UK and the EEA in relation to certain aspects of data protection law remains uncertain.

For example, it is unclear whether transfers of personal data from the EEA to the UK will be permitted to take place on the basis of a future adequacy decision of the European Commission, or whether a ‘transfer mechanism’ such as the SCCs will be required.

Under the post-Brexit Trade and Cooperation Agreement between the EU and the UK, the UK and EU have agreed that transfers of personal data to the UK from EEA member states will not be treated as ‘restricted transfers’ to a non-EEA country for a period of up to four months from January 1, 2021, plus a potential further two months extension, or the “Extended Adequacy Assessment Period.” Although the current maximum duration of the Extended Adequacy Assessment Period is six months, it may end sooner, for example, in the event that the European Commission adopts an adequacy decision in respect of the UK, or the UK amends the UK GDPR and/or makes certain changes regarding data transfers under the UK GDPR/Data Protection Act 2018 without the consent of the EU (unless those amendments or decisions are made simply to keep relevant UK laws aligned with the EU’s data protection regime).

If the European Commission does not adopt an ‘adequacy decision’ in respect of the UK prior to the expiry of the Extended Adequacy Assessment Period, from that point onwards the UK will be an ‘inadequate third country’ under the GDPR and transfers of personal data from the EEA to the UK will require a ‘transfer mechanism’ such as the Standard Contractual Clauses.

Compliance with these and any other applicable privacy and data security laws and regulations is a rigorous and time-intensive process, and we may be required to put in place additional mechanisms to ensure compliance with the new data protection rules.

On June 28, 2021, the European Commission issued an adequacy decision under the GDPR which allows transfers (other than those carried out for the purposes of United Kingdom immigration control) of personal data from the EEA to the United Kingdom to continue without restriction for a period of four years ending June 27, 2025.

After that period, the adequacy decision may be renewed, however, only if the United Kingdom continues to ensure an adequate level of data protection.

During these four years, the European Commission will continue to monitor the legal situation in the United Kingdom and could intervene at any point if the United Kingdom deviates from the level of data protection in place at the time of issuance of the adequacy decision.

If the adequacy decision is withdrawn or not renewed, transfers of personal data from the EEA to the United Kingdom will require a valid ‘transfer mechanism’ and we may be required to implement new processes and put new agreements in place, such as SCCs, to enable transfers of personal data from the EEA to the United Kingdom to continue.

In Canada, where we may also operate or have customers, the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and various provincial laws require that companies give detailed privacy notices to consumers, obtain consent to use personal information, with limited exceptions, allow individuals to access and correct their personal information, and report certain data breaches.

In addition, Canada’s Anti-Spam Legislation, or CASL, prohibits email marketing without the recipient’s consent, with limited exceptions.

Failure to comply with PIPEDA, CASL, or provincial privacy or data protection laws could result in significant fines or penalties or possible damage awards.

We may publish privacy policies and other documentation regarding our collection, processing, use and disclosure of personal information.

Although we endeavor to comply with our published policies and other documentation, we may at times fail to do

so or may be perceived to have failed to do so.

Despite our efforts, we may not be successful in achieving compliance if our personnel, customers, or service providers fail to comply with our policies and documentation.

Such failures can subject us to potential foreign, local, state and federal action if they are found to be deceptive, unfair, or misrepresentative of our actual practices.

Compliance with applicable privacy and data security laws and regulations is a rigorous and time-intensive process, and we may be required to put in place additional mechanisms to ensure compliance with the new data protection rules.

Any failure or perceived failure by us or third parties working on our behalf to comply with applicable laws and regulations, any privacy and data security obligations pursuant to contract, our stated privacy or security policies, or obligations to customers or other third parties may result in governmental enforcement actions (including fines, penalties, judgments, settlements, imprisonment of company officials and public censure), civil claims, litigation, damage to our brand and reputation and loss of goodwill (both in relation to existing customers and prospective customers), any of which could have a material adverse effect on our business, operations and financial performance.

98 unchanged sentences

Such in-vitro diagnostic, or IVD, products will be subject to regulation by the FDA as medical devices, or comparable international agencies, including requirements for regulatory clearance or approval of such products before they can be marketed.

If the FDA were to determine that our products are intended for clinical use or if we decided to market our products for such use, we would be required to obtain FDA 510(k) clearance or premarket approval in order to sell our products in a manner consistent with FDA laws and regulations.

order to sell our products in a manner consistent with FDA laws and regulations.

Such regulatory approval processes or clearances are expensive, time-consuming and uncertain;

28 unchanged sentences

Billing for clinical laboratory testing services in connection with our diagnostic services is complex, time-consuming and expensive.

Depending on the billing arrangement and applicable law, we bill various payors, including Medicare, Medicaid, private insurance companies, private healthcare institutions, and patients, all of which have different billing requirements.

Depending on the billing arrangement and applicable law, we bill various payors, including Medicare, Medicaid,

private insurance companies, private healthcare institutions, and patients, all of which have different billing requirements.

We generally bill third-party payors for our diagnostic testing services and pursue reimbursement on a case-by-case basis where pricing contracts are not in place.

30 unchanged sentences

Coverage determinations by a third-party payor may depend on a number of factors, including, but not limited to, a third-party payor’s determination of whether our products or services are appropriate, medically necessary or cost-effective.

If we are unable to provide third-party payors with sufficient evidence of the clinical utility and validity of our Lineagen products and diagnostic assays, they may not provide coverage, or may provide limited coverage, which will adversely affect our revenues and our ability to succeed.

If we are unable to provide third-party payors with sufficient evidence of the clinical utility and validity of our Lineagen products and

diagnostic assays, they may not provide coverage, or may provide limited coverage, which will adversely affect our revenues and our ability to succeed.

Since each third-party payor makes its own decision as to whether to establish a policy to cover our Lineagen products and diagnostic assays, enter into a contract with us and set the amount it will reimburse for a product, these negotiations are a time-consuming and costly process, and they do not guarantee that the third-party payor will provide coverage or adequate reimbursement for our Lineagen products and diagnostic assays.

12 unchanged sentences

Currently, our Saphyr product is for research use only, but clinical laboratories may acquire our instrumentation through a capital purchase or capital lease and use the Saphyr and direct label stain chemistry to create their own potentially reimbursable products, such as laboratory developed tests for in vitro diagnostics.

Our customers may generate revenue for these testing

services by seeking the necessary approval of their product from the FDA or the Centers for Medicare & Medicaid Services, or CMS, along with coverage and reimbursement from third-party payors, including government health programs and private health plans.

Our customers may generate revenue for these testing services by seeking the necessary approval of their product from the FDA or the Centers for Medicare & Medicaid Services, or CMS, along with coverage and reimbursement from third-party payors, including government health programs and private health plans.

The ability of our customers to commercialize diagnostic tests based on our technology will depend in part on the extent to which coverage and reimbursement for these tests will be available from such third-party payors.

19 unchanged sentences

There have been executive, judicial and Congressional challenges to certain aspects of the ACA.

While Congress has not passed comprehensive repeal legislation, it has enacted laws that modify certain provisions of the ACA such as removing penalties, starting January 1, 2019, for not complying with the ACA’s individual mandate to carry health insurance.

On December 14, 2018, a Texas U.S.

District Court Judge ruled that the ACA is unconstitutional in its entirety because the “individual mandate” was repealed by Congress as part of the Tax Act.

Additionally, on December 18, 2019, the U.S.

Court of Appeals for the 5th Circuit upheld the District Court ruling that the individual mandate was unconstitutional and remanded the case back to the District Court to determine whether the remaining provisions of the ACA are invalid as well.

Supreme Court is currently reviewing the case, although it is unknown when a decision will be made.

Additionally, on February 10, 2021, the Biden administration withdrew the federal government’s support for overturning the ACA.

It is unclear how the Supreme Court ruling, other such litigation, and the healthcare reform measures of the Biden administration will impact the ACA and our business.

For example, while Congress has not passed comprehensive repeal legislation, it has enacted laws that modify certain provisions of the ACA such as removing penalties, starting January 1, 2019, for not complying with the ACA’s individual mandate to carry health insurance.

On June 17, 2021 the U.S.

Supreme Court dismissed a challenge on procedural grounds that argued the ACA was unconstitutional in its entirety because the “individual mandate” was repealed by Congress.

Thus, the ACA will remain in effect in its current form.

In addition, other legislative changes have been proposed and adopted since the ACA was enacted.

61 unchanged sentences

Ensuring that our business arrangements with third parties comply with applicable healthcare laws and regulations is costly.

If our operations are found to be in violation of any of these laws, we may be subject to significant penalties, including, without

limitation, civil, criminal, and administrative penalties, damages, fines, disgorgement, the curtailment or restructuring of our operations, exclusion from participation in federal and state healthcare programs, additional integrity oversight and reporting obligations, imprisonment, contractual damages, and reputational harm, any of which could adversely affect our ability to operate our business and our results of operations.

If our operations are found to be in violation of any of these laws, we may be subject to significant penalties, including, without limitation, civil, criminal, and administrative penalties, damages, fines, disgorgement, the curtailment or restructuring of our operations, exclusion from participation in federal and state healthcare programs, additional integrity oversight and reporting obligations, imprisonment, contractual damages, and reputational harm, any of which could adversely affect our ability to operate our business and our results of operations.

If any of the physicians or other healthcare providers or entities with whom we do business is found to be not in compliance with applicable laws, they may be subject to criminal, civil or administrative sanctions, including exclusions from government funded healthcare programs.

13 unchanged sentences

We cannot guarantee investors that we will be successful in defending challenges made against our patents and patent applications.

Any successful third-party challenge or challenges to our patents could result in the unenforceability or invalidity of such patents, or such patents being interpreted narrowly and/or in a manner adverse to our interests.

Any successful third-party challenge or challenges to our patents could result in the unenforceability or invalidity of such patents, or such patents being interpreted narrowly and/or in

a manner adverse to our interests.

Our ability to establish or maintain a technological or competitive advantage over our competitors and/or market entrants may be diminished because of these uncertainties.

26 unchanged sentences

Moreover, if a party having an agreement with us has an overlapping or conflicting obligation to a third-party, our rights in and to certain intellectual property could be undermined.

Monitoring unauthorized and inadvertent disclosure is difficult, and we do not know whether the steps we have taken to prevent such disclosure are, or will be, adequate.

Monitoring unauthorized and inadvertent disclosure is difficult, and we do not know whether the steps we

have taken to prevent such disclosure are, or will be, adequate.

If we were to enforce a claim that a third-party had illegally obtained and was using our trade secrets, it would be expensive and time consuming, the outcome would be unpredictable, and any remedy may be inadequate.

24 unchanged sentences

government requires that any products embodying the subject invention or produced through the use of the subject invention be manufactured substantially in the U.S.

The manufacturing preference requirement can be waived if the owner of the intellectual property can show that reasonable but unsuccessful efforts have been made to grant licenses on similar terms to

potential licensees that would be likely to manufacture substantially in the U.S.

The manufacturing preference requirement can be waived if the owner of the intellectual property can show that reasonable but unsuccessful efforts have been made to grant licenses on similar terms to potential licensees that would be likely to manufacture substantially in the U.S.

or that, under the circumstances, domestic manufacture is not commercially feasible.

136 unchanged sentences

Accordingly, a third-party may try to use the USPTO procedures to invalidate our patent claims that would not have been invalidated if first challenged by the third-party in court.

The AIA and its implementation could increase the uncertainties and

costs surrounding the prosecution of our patent applications and the enforcement or defense of our issued patents.

The AIA and its implementation could increase the uncertainties and costs surrounding the prosecution of our patent applications and the enforcement or defense of our issued patents.

In addition, the contours of the laws under the AIA are subject to further judicial interpretation and/or legislative changes.

17 unchanged sentences

We may not be able to protect our rights to these trademarks and trade names, which we need to build name recognition by potential partners or customers in our markets of interest.

At times, competitors may adopt trade names or trademarks similar to ours, thereby impeding our ability to build brand identity and possibly leading to market confusion.

At times, competitors may

adopt trade names or trademarks similar to ours, thereby impeding our ability to build brand identity and possibly leading to market confusion.

In addition, there could be potential trade name or trademark infringement claims brought by owners of other registered trademarks.

13 unchanged sentences

In the future, this software may not be available to us on commercially reasonable terms, or at all.

Any loss of the right to use any of this software could result in delays in the production of our products until equivalent technology is either developed by us, or, if available, is identified, obtained and

integrated, which could harm our business.

In addition, any errors or defects in third-party software or other third-party software failures could result in errors or defects or cause our products to fail, which could harm our business and be costly to correct.

58 unchanged sentences

For example, in a letter dated April 22, 2020, or the Notice, we were notified by the Nasdaq Stock Market LLC, or Nasdaq, that for 30 consecutive trading days preceding the date of the Notice, the bid price of our common stock had closed below the $1.00 per share minimum required for continued listing on The Nasdaq Capital Market pursuant to Nasdaq Listing Rule 5550(a)(2), or the Minimum Bid Price Requirement.

Under Nasdaq Listing Rule 5810(c)(3)(A), we had 180 calendar days following the date of the Notice to regain compliance with the Minimum Bid Price Requirement, and due to extraordinary market conditions, Nasdaq determined to toll the compliance period for the Minimum Bid Price Requirement through September 30, 2020, or the

Tolling Period.

As a result, the compliance Period ended on December 28, 2020, or the Compliance Period, instead of October 20, 2020.

Nasdaq subsequently granted us an extension until June 28, 2021 to regain compliance with the Minimum Bid Price Requirement.

On January 13, 2021, Nasdaq notified that Company that it had regained compliance with the Minimum Bid Price Requirement because the closing bid price of our common stock had been at least $1.00 per share or greater from December 29, 2020 to January 12, 2021.

On January 13, 2021, Nasdaq notified us that it had regained compliance with the Minimum Bid Price Requirement because the closing bid price of our common stock had been at least $1.00 per share or greater from December 29, 2020 to January 12, 2021.

Although we have regained compliance with Nasdaq, if we fail to satisfy another Nasdaq requirement for continued listing, Nasdaq staff could provide notice that our common stock may become subject to delisting.

10 unchanged sentences

Additionally, unless exempt, prior to a transaction involving a penny stock, the penny stock rules require the delivery of a disclosure schedule prescribed by the SEC relating to the penny stock market.

The broker-dealer must also disclose the commissions payable to the broker-dealer, current quotations for the securities and, if the broker-dealer is the sole market-maker for the security, the fact that they are the sole market-maker and their presumed control over the market.

broker-dealer must also disclose the commissions payable to the broker-dealer, current quotations for the securities and, if the broker-dealer is the sole market-maker for the security, the fact that they are the sole market-maker and their presumed control over the market.

Finally, monthly statements disclosing recent price information on the limited market in penny stocks must be sent to holders of such penny stocks.

13 unchanged sentences

We are an emerging growth company, as defined in the Jumpstart Our Business Startups Act of 2012, or the JOBS Act.

Oxley Act, reduced disclosure obligations regarding executive compensation in our Annual Report and our periodic reports and proxy statements and exemptions from the requirements of holding nonbinding advisory votes on executive compensation and stockholder approval of any golden parachute payments not previously approved.

For as long as we continue to be an emerging growth company, we may take advantage of exemptions from various reporting requirements that are applicable to other public companies that are not emerging growth companies, including not being required to comply with the auditor attestation requirements of Section 404 of the Sarbanes-Oxley Act of 2002, or the Sarbanes-Oxley Act, reduced disclosure obligations regarding executive compensation in our Annual Report and our periodic reports and proxy statements and exemptions from the requirements of holding nonbinding advisory votes on executive compensation and stockholder approval of any golden parachute payments not previously approved.

We can remain an emerging growth company until the earlier of (1) the last day of the fiscal year (a) ending December 31, 2023, which is the end of the fiscal year following the fifth anniversary of the closing of our initial public offering, (b) in which we have total annual gross revenue of at least $1.07 billion, or (c) in which we are deemed to be a large accelerated filer, which means the market value of our common stock that is held by non-affiliates exceeds $700 million as of the prior June 30th, and (2) the date on which we have issued more than $1.0 billion in non-convertible debt during the prior three-year period.

9 unchanged sentences

As of May 7, 2021, the market value of our common stock held by non-affiliates exceeded $700.0 million.

If the market value of our common stock held by non-affiliates exceeds $700.0 million as of June 30, 2021, we will be a large accelerated filer and thus will cease to be an emerging growth company effective December 31, 2021.

If the market value of our common stock held by non-affiliates exceeds $700.0 million as of June 30, 2021, we will be a large accelerated filer and

thus will cease to be an emerging growth company effective December 31, 2021.

Additionally, in such case, we expect to no longer qualify as a smaller reporting company beginning with our first Quarterly Report on Form 10-Q for the quarterly period ending March 31, 2022.

12 unchanged sentences

However, we cannot assure you that these efforts will remediate our material weakness in a timely manner, or at all.

If we are unable to remediate the material weaknesses described above, or if we or our independent registered public accounting firm are otherwise unable to conclude that our internal control over financial reporting is effective we could lose investor confidence in the accuracy and completeness of our financial reports, the market price of our securities could decline, and we

could be subject to sanctions or investigations by Nasdaq, the Securities and Exchange Commission, or the SEC, or other regulatory authorities.

Failure to remedy any material weakness in our internal control over financial reporting, or to implement or maintain other effective control systems required of public companies, could also restrict our future access to the capital markets.

9 unchanged sentences

As a newly public company, we have begun to incur significant legal, accounting and other expenses that we did not incur as a private company.

We are subject to the reporting requirements of the Securities Exchange Act of 1934, as amended, which will require, among other things, that we file with the SEC annual, quarterly and current reports with respect to our business and financial condition.

financial condition.

In addition, the Sarbanes-Oxley Act, as well as rules subsequently adopted by the SEC and Nasdaq to implement provisions of the Sarbanes-Oxley Act, impose significant requirements on public companies, including requiring establishment and maintenance of effective disclosure and financial controls and changes in corporate governance practices.

18 unchanged sentences

All of our outstanding shares of common stock are available for sale in the public market, subject only to the restrictions of Rule 144 under the Securities Act in the case of our affiliates.

In addition, as of March 31, 2021, we have filed registration statements on Form S-8 under the Securities Act registering the issuance of an aggregate of 21,104,867 shares of common stock subject to options or other equity awards issued or reserved for future issuance under our equity incentive plans.

In addition, as of June 30, 2021, we have filed registration statements on Form S-8 under the Securities Act registering the issuance of an aggregate of 21,104,867 shares of common stock subject to options or other equity awards issued or reserved for future issuance under our equity incentive plans.

Shares registered under these registration statements on Form S-8 are available for sale in the public market subject to vesting arrangements and exercise of options, the lock-up agreements described above and the restrictions of Rule 144 in the case of our affiliates.

Anti-takeover provisions under our charter documents and Delaware law could delay or prevent a change of control which could limit the market price of our securities and may prevent or frustrate attempts by our securityholders to replace or remove our current management.

Anti-takeover provisions under our charter documents and Delaware law could delay or prevent a change of control which could limit the market price of our securities and may prevent or frustrate attempts by our security holders to replace or remove our current management.

Our amended and restated certificate of incorporation and amended and restated bylaws, contain provisions that could delay or prevent a change of control of our company or changes in our board of directors that our stockholders might consider favorable.

29 unchanged sentences

If individuals are ultimately elected to our board of directors with a specific agenda, it may adversely affect our ability to effectively implement our business strategy and create additional value for our stockholders.

We may choose to initiate, or may become subject to, litigation as a result of the proxy contest or matters arising from the proxy contest, which would serve as a further distraction to our board of directors and management and would require us to incur significant additional costs.

We may choose to initiate, or may become subject to, litigation as a result of the proxy contest or matters arising from the proxy

contest, which would serve as a further distraction to our board of directors and management and would require us to incur significant additional costs.

In addition, actions such as those described above could cause significant fluctuations in our stock price based upon temporary or speculative market perceptions or other factors that do not necessarily reflect the underlying fundamentals and prospects of our business.

11 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors