Co-Diagnostics, Inc. 10-K

ITEM 1A. RISK FACTORS Risks Related to Our Business and Industry We have limited commercial history upon which to base our prospects and are not certain that we will achieve profitability in the future. We have a limited operating history. We began operations in April 2013. Our accumulated retained earnings (deficit) were ($33.0 million) and $4.6 million as of December 31, 2024 and 2023, respectively. We do not have any way of predicting when or if we will achieve profitability in the future. Potential investors should be aware of the difficulties normally encountered by early commercial stage companies, many of which are beyond our control, including substantial risks and expenses in the course of developing new diagnostic tests, obtaining regulatory approval of clearance to commercialize such tests, establishing or entering new markets, organizing operations and marketing procedures. The likelihood of our success must be considered in light of these risks, expenses, complications and delays, and the competitive environment in which we operate. There is, therefore, nothing at this time upon which to base an assumption that our business plan will prove successful, and we may not be able to generate significant revenue, raise additional capital or operate profitably. We will continue to encounter risks and difficulties frequently experienced by early commercial stage companies, including scaling up our infrastructure and headcount, and may encounter unforeseen expenses, difficulties or delays in connection with our growth. In addition, as a result of the start-up nature of our business, we expect to continue to sustain substantial operating expenses and may not be able to continue generating sufficient revenues to cover expenditures. Any investment in our company is therefore highly speculative and could result in the loss of any investment. Our future success is dependent on our development of our Co-Dx PCR platform and securing regulatory approval for the platform including the PCR Pro instrument and related diagnostic tests, demand for infectious disease diagnostics and upon our ability to develop and market other commercially accepted diagnostic tests for our PCR platform. Our future success will depend, in part, on our development of our Co-Dx PCR platform and securing regulatory approval for the platform including the PCR Pro instrument and related diagnostic tests, our ability to develop and sell sufficient quantities of other diagnostics tests, and our ability to successfully and profitably market our Co-Dx PCR platform. Attracting new customers and distribution networks requires substantial time and expense. Any failure to obtain regulatory approval for our product candidates and to increase sales of our diagnostic tests in sufficient quantities to achieve profitability in a timely manner would adversely affect our operating results. Many factors could affect the market acceptance and commercial success of any of our diagnostic tests and devices, including: ● Our ability to develop additional infectious disease diagnostic tests for which there is a commercial market; ● Our ability to obtain regulatory clearance to commercialize our product candidates; ● our ability to convince our potential customers of the advantages and economic value of our tests over competing technologies and diagnostic tests; ● the breadth of our test menu relative to competitors; ● changes to policies, procedures or currently accepted best practices in clinical diagnostic testing; ● the extent and success of our marketing and sales efforts; and ● our ability to manufacture in quantity our commercial diagnostic tests and meet demand in a timely fashion. 13 The diagnostic market is highly competitive, and we may not be able to compete effectively against the larger, well-established companies that dominate this market or emerging and small innovative companies that may seek to obtain or increase their share of the market. The markets for diagnostic products are intensely competitive, and many of our competitors are much larger and have substantially more financial and human resources than we do. Many have long histories and strong reputations within the industry, and a relatively small number of companies dominate these markets. These companies enjoy significant competitive advantages over us, including: ● broad product offerings, which address the needs of health care providers in a wide range of applications; ● products that are supported by long-term clinical data; ● greater experience in, and resources for, launching, marketing, distributing and selling products, including strong sales forces and established distribution networks; ● extensive intellectual property portfolios and greater resources for patent protection; ● greater financial and other resources for product research and development; ● greater experience in obtaining and maintaining FDA and other regulatory clearances and approvals for products and product enhancements; ● established manufacturing operations and contract manufacturing relationships; ● significantly greater name recognition and widely recognized trademarks; and ● established relationships with healthcare providers and payers. Our products and any product candidates that we may introduce into the market may not enable us to overcome the competitive advantages of these large and dominant companies. In addition, even if we successfully introduce additional product candidates into the market, emerging and small innovative companies may seek to increase their market share and they may eventually possess competitive advantages, which could adversely impact our business. Our competitors may also employ pricing strategies that could adversely affect the pricing of our products. We depend on a limited number of third-party suppliers for key raw materials used in the manufacturing of our products, and the loss of these third-party suppliers or their inability to supply us with adequate raw materials could harm our business. We rely on a limited number of third-party suppliers for the raw materials required for the production of our diagnostic products and product candidates. Our dependence on a limited number of third-party suppliers involves several risks, including limited control over pricing, availability, quality, and delivery schedules for raw materials. We have no supply agreements in place with any of our suppliers and cannot be certain that our current suppliers will continue to provide us with the quantities of raw materials that we require or that satisfy our anticipated specifications and quality requirements. Any supply interruption in limited or single sourced raw materials could materially harm our ability to manufacture our products until a new source of supply, if any, could be identified and qualified. We may be unable to find a sufficient alternative supply channel within a reasonable time or on commercially reasonable terms. Any performance failure on the part of our suppliers could delay the production of our products and product candidates and delay the development and commercialization of our product candidates, including limiting supplies necessary for commercial sale, clinical trials and regulatory approvals, which could have a material adverse effect on our business. In order to be successful, we must expand our available product lines by commercializing new product candidates, but we may not be able to do so in a timely fashion and at expected costs, or at all. Although we are currently manufacturing diagnostic kits for commercialization, in order to be successful, we will need to expand our product lines to include other diagnostic products. To succeed in our commercialization efforts, we must effectively continue product development and testing, find new strategic partners, obtain regulatory clearances and approvals, and enhance our sales and marketing capabilities. Because of these uncertainties, there is no assurance that we will succeed in bringing any of our current or future product candidates to market. If we fail in bringing our product candidates to market, or experience delays in doing so, we will not generate revenues as planned and will need to curtail operations or seek additional financing earlier than otherwise anticipated. We are dependent on our senior management team, scientific team, and external advisors, and the loss of any of them could harm our business, including by adversely affecting our ability to effectuate our business strategy. The members of our current senior management team may not be able to successfully implement our strategy. In addition, we have not entered into employment agreements with any of the members of our senior management team. There are no assurances that the services of any of these individuals will be available to us for any specified period of time. The successful integration of our senior management team, the loss of members of our senior management team, scientific team and key external advisors, or our inability to attract or retain other qualified personnel or advisors could have a material adverse effect on our business, financial condition and results of operations. We may not have a sufficient number of qualified personnel to effectuate our business strategy, which could have a material adverse effect on our business, financial condition and results of operations. 14 If we experience significant disruptions in our information technology systems, our business, results of operations and financial condition could be adversely affected. The efficient operation of our business depends on our information technology systems. We rely on our information technology systems to effectively manage our sales and marketing, accounting and financial functions; manufacturing processes; inventory; scientific and product development functions; and our research and development functions. As such, our information technology systems are vulnerable to damage or interruption including from earthquakes, fires, floods and other natural disasters; terrorist attacks and attacks by computer viruses or hackers; power losses; and computer systems, or Internet, telecommunications or data network failures. The failure of our information technology systems to perform as we anticipate or our failure to effectively implement new systems could disrupt our entire operation and could result in decreased sales, increased overhead costs, excess inventory and product shortages, all of which could have a material adverse effect on our reputation, business, results of operations and financial condition. Cybersecurity risks and the failure to maintain the integrity of company, employee or customer data could expose us to data loss, litigation and liability, and our reputation could be significantly harmed. We and third-party service providers collect and retain large volumes of data, including personally identifiable information regarding clinical trial participants and others, for business purposes, including for regulatory, research and development and commercialization purposes, and our collaborators’ various information technology systems enter, process, summarize and report such data. We also maintain personally identifiable information about our employees. The integrity and protection of our company, employee and clinical data is critical to our business. We are subject to significant data security and privacy laws and regulations. These regulations impose significant requirements on how we maintain, use, and protect such information. Maintaining compliance with these evolving regulations and requirements could be difficult and may increase our expenses. In addition, a penetrated or compromised data system or the intentional, inadvertent or negligent release or disclosure of data could result in theft, loss or fraudulent or unlawful use of company, employee or clinical data which could harm our reputation, disrupt our operations, or result in remedial and other costs, fines or lawsuits. Risks Related to Our Capital Resources and Impairments We will require additional financing and our failure to obtain additional funding would force us to delay, reduce or eliminate our product development programs or commercialization efforts. We currently have limited committed sources of capital, and we have limited liquidity. Our cash, cash equivalents, and marketable investment securities as of December 31, 2024 were $29.7 million. We have entered into an Equity Distribution Agreement (the “ATM Agreement”) with Piper Sandler & Co. (“Piper Sandler”), pursuant to which we may offer and sell shares of our common stock having an aggregate offering price of up to $17,111,650 from time to time through Piper Sandler acting as our agent, under our prospectus supplement dated October 18, 2024. As of December 31, 2024, we have sold 314,707 shares of common stock under the ATM Agreement resulting in net proceeds to the Company of $0.2 million. We will require substantial future capital in order to continue operating our business, conduct the research and development and regulatory clearance and approval activities necessary to bring our products to market, and to establish effective marketing and sales capabilities. If adequate funds to develop our product candidates and fund operations are not available on a timely basis, we may terminate or delay the development of one or more of our product candidates, or delay activities necessary to commercialize our product candidates. Additional funding may not be available to us on acceptable terms, or at all. Any additional equity financing, if available, may not be available on favorable terms and will most likely be dilutive to our current stockholders, and debt financing, if available, may involve more restrictive covenants. Our ability to access capital when needed is not assured and, if not achieved on a timely basis, will materially harm our business, financial condition and results of operations or could cause us to cease operations. 15 Our independent registered public accounting firm has included an explanatory paragraph relating to our ability to continue as a going concern in its report on our audited financial statements. We may be unable to continue to operate without the threat of liquidation for the foreseeable future. Our report from our independent registered public accounting firm for the year ended December 31, 2024 includes an explanatory paragraph stating that our recurring losses from operations raises substantial doubt about our ability to continue as a going concern. If we are unable to obtain sufficient additional funding, our business, prospects, financial condition and results of operations will be materially and adversely affected, and we may be unable to continue as a going concern. If we are unable to continue as a going concern, we may have to liquidate our assets and may receive less than the value at which those assets are carried on our consolidated financial statements, and it is likely that investors will lose all or a part of their investment. Future reports from our independent registered public accounting firm may also contain statements expressing doubt about our ability to continue as a going concern. If we seek additional financing to fund our business activities in the future and there remains doubt about our ability to continue as a going concern, investors or other financing sources may be unwilling to provide additional funding on commercially reasonable terms or at all. Raising additional capital by issuing securities or through debt financings or licensing arrangements will likely cause dilution to existing stockholders, restrict our operations or require us to relinquish proprietary rights. To the extent that we raise additional capital through the sale of equity or convertible debt securities, your ownership interest will likely be diluted, and the terms may include liquidation or other preferences that adversely affect your rights as a stockholder. Debt financing, if available, may involve agreements that include covenants limiting or restricting our ability to take specific actions such as incurring additional debt, making capital expenditures or declaring dividends. If we raise additional funds through collaboration and licensing arrangements with third parties, we may have to relinquish valuable rights to our technologies or products or grant licenses on terms that are not favorable to us. Any of these events could adversely affect our ability to achieve our product development and commercialization goals and have a material adverse effect on our business, financial condition and results of operations. Risks Related to Regulatory Approval of Our Products and Other Government Regulations We received Emergency Use Authorization or EUA for our Logix Smart COVID-19 test in the US. For our existing EUA and any new EUA, the FDA may revoke any EUA where it is determined that the underlying health emergency no longer exists or warrants such authorization, which would adversely impact our ability to market our COVID-19 test in the United States. The FDA has the authority to grant an EUA to allow unapproved medical products to be used in an emergency to diagnose, treat or prevent serious or life-threatening diseases or conditions when there are no adequate, approved and available alternatives. During the COVID 19 pandemic the FDA determined that circumstances exist to justify the authorization of emergency use of medical devices, including alternative products used as medical devices, during the COVID-19 pandemic. On April 3, 2020, we received an EUA from the FDA for our Logix Smart Coronavirus Disease 2019 (COVID-19) kit for use on individuals who are suspected of COVID-19 by their healthcare provider. We cannot predict how long the EUA for our COVID-19 test will remain in place. The FDA may revoke an EUA where it is determined that the underlying health emergency no longer exists or warrants such authorization. The FDA may take such a position at any time and without notice and, therefore, we cannot predict how long our EUAs will remain in place. The FDA may also revoke an EUA when the circumstances justifying its issuance no longer exist, such as when an alternative is authorized for marketing through the standard procedures, including through a 510(k) clearance. If our existing EUAs are revoked prior to us having received regulatory approval to commercialize our COVID-19 test through a traditional pathway, we may not be able to obtain required clearances or approvals in a timely manner, or at all, and one or more of our competitors may obtain the necessary clearances or approvals for their products before we do. In addition, we would be required to cease our commercialization efforts, which would substantially and negatively impact our business. As a result, any such revocation could adversely impact our business, financial condition and results of operations. 16 In June 2024, we filed a 510(k) application with the FDA for our PCR platform which we withdrew in February 2025 as a result of discussions with the FDA. Our long-term success depends substantially on our ability to obtain regulatory clearance or approval and thereafter commercialize our product candidates; we cannot be certain that we will be able to do so in a timely manner or at all. In June 2024, we filed a 510(k) application with the FDA for our PCR platform which we withdrew in February 2025 as a result of discussions with the FDA. The process of obtaining regulatory clearances or approvals to market a medical diagnostic from the FDA or similar regulatory authorities outside of the United States can be costly and time consuming, and there can be no assurance that such clearances or approvals will be granted on a timely basis, or at all. The FDA’s 510(k) clearance process generally takes one to six months from the date of submission, depending on whether a special or traditional 510(k) premarket notification has been submitted, but can take significantly longer. An application for premarket approval, or PMA, must be submitted to the FDA if the device cannot be cleared through the 510(k) clearance process or is not exempt from premarket review by the FDA. The PMA process almost always requires one or more clinical trials and can take two to three years from the date of filing, or even longer. If we are required to obtain approval of any of our products through the PMA process, the costs associated with such a process will be significant, which could adversely affect our financial performance and results of operations. In addition, a submission through the PMA process would require us to delay commercialization of such product candidates until after approval is received, if ever. If we are unable to commercialize our product candidates in a timely manner, or at all, our business will be adversely affected. Similar to our compliance with U.S. regulatory requirements, we must obtain and comply with international requirements, in order to market and sell our products outside of the United States and we may only promote and market our products, if approved, as permitted by applicable regulatory authorities. There is no guarantee that we will receive the necessary regulatory approvals for our product candidates either inside the United States or internationally. If our product candidates do not receive necessary regulatory approvals, our business could be materially and adversely affected. Our current and future relationships with third-party payers and current and potential customers in the United States and elsewhere may be subject, directly or indirectly, to applicable anti-kickback, fraud and abuse, false claims, transparency, health information privacy and security and other healthcare laws and regulations, which could expose us to criminal sanctions, civil penalties, contractual damages, reputational harm administrative burdens and diminished profits and future earnings. Our current and future arrangements with third-party payers and current and potential customers, including providers and physicians, may expose us to broadly applicable fraud and abuse and other healthcare laws and regulations, including, without limitation, the federal Anti-Kickback Statute and the federal False Claims Act, which may constrain the business or financial arrangements and relationships through which we sell, market and distribute our products. In addition, we may be subject to transparency laws and patient privacy regulations by U.S. federal and state governments and by governments in foreign jurisdictions in which we conduct our business. The applicable federal, state and foreign healthcare laws and regulations that may affect our ability to operate include: ● the federal Anti-Kickback Statute, which prohibits, among other things, persons from knowingly and willfully soliciting, offering, receiving or providing remuneration, directly or indirectly, in cash or in kind, to induce or reward, or in return for, either the referral of an individual for, or the purchase, order or recommendation of, any good or service, for which payment may be made under federal healthcare programs, such as Medicare and Medicaid; ● federal civil and criminal false claims laws and civil monetary penalty laws, including the federal False Claims Act, which impose criminal and civil penalties, including civil whistleblower or qui tam actions, against individuals or entities for knowingly presenting, or causing to be presented, to the federal government, including the Medicare and Medicaid programs, claims for payment that are false or fraudulent or making a false statement to avoid, decrease or conceal an obligation to pay money to the federal government; ● the federal Health Insurance Portability and Accountability Act of 1996, or HIPAA, which imposes criminal and civil liability for executing a scheme to defraud any healthcare benefit program or making false statements relating to healthcare matters; ● HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, or HITECH, and their respective implementing regulations, which impose obligations on covered healthcare providers, health plans, and healthcare clearinghouses, as well as their business associates that create, receive, maintain or transmit individually identifiable health information for or on behalf of a covered entity, with respect to safeguarding the privacy, security and transmission of individually identifiable health information; ● the Physician Payments Sunshine Act, which requires (i) manufacturers of drugs, devices, biologics and medical supplies for which payment is available under Medicare, Medicaid or the Children’s Health Insurance Program, with specific exceptions, to report annually to CMS information related to certain “payments or other transfers of value” made to physicians, which is defined to include doctors, dentists, optometrists, podiatrists and chiropractors, and teaching hospitals, (ii) applicable manufacturers and applicable group purchasing organizations to report annually to CMS ownership and investment interests held in such entities by physicians and their immediate family members, with data collection beginning on August 1, 2013, (iii) manufacturers to submit reports to CMS by the 90 th day of each calendar year, and (iv) disclosure of such information by CMS on a publicly available website; and ● analogous state and foreign laws and regulations, such as state anti-kickback and false claims laws, which may apply to sales or marketing arrangements and claims involving healthcare items or services reimbursed by non-governmental third-party payers, including private insurers; state and foreign laws that require medical device companies to comply with the medical device industry’s voluntary compliance guidelines and the relevant compliance guidance promulgated by the federal government or otherwise restrict payments that may be made to healthcare providers; state and foreign laws that require medical device manufacturers to report information related to payments and other transfers of value to physicians and other healthcare providers or marketing expenditures; and state and foreign laws governing the privacy and security of health information in certain circumstances, many of which differ from each other in significant ways and often are not preempted by HIPAA, thus complicating compliance efforts. 17 Efforts to ensure that our business arrangements with third parties will comply with applicable healthcare laws and regulations may involve substantial costs. It is possible that governmental authorities will conclude that our business practices may not comply with current or future statutes, regulations or case law involving applicable fraud and abuse or other healthcare laws and regulations. If our operations are found to be in violation of any of these laws or any other governmental regulations that may apply to us, we may be subject to significant civil, criminal and administrative penalties, including, without limitation, damages, fines, imprisonment, exclusion from participation in government healthcare programs, such as Medicare and Medicaid, and the curtailment or restructuring of our operations, which could have a material adverse effect on our business. If any of the physicians or other healthcare providers or entities with whom we expect to do business, including our collaborators, are found not to be in compliance with applicable laws, they may be subject to criminal, civil or administrative sanctions, including exclusions from participation in government healthcare programs, which could also materially affect our business. We are subject to stringent and changing data protection laws, privacy policies and data protection obligations, which continue to evolve and change over time. The actual or perceived failure by us or our third-party service providers or vendors to comply with such obligations could harm our reputation, subject us to significant fines and liability, or otherwise adversely affect our business. We are subject to numerous data protection laws that govern the processing of individually identifiable information and health information and other sensitive and personal information in the jurisdictions in which we operate. In many instances, these data protection laws, regulations and standards apply not only to disclosures to third parties, but also to transfers of information between or among us and other parties with which we have commercial relationships. The regulatory framework for data privacy, data security and data transfers worldwide is rapidly evolving and, as a result, interpretation and implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. These data protection laws may be interpreted and applied differently over time and from jurisdiction to jurisdiction, and it is possible that they will be interpreted and applied in ways that will materially and adversely affect our business, financial condition and results of operations. Failure to comply with any of these data protection laws could result in enforcement actions against us, including fines, imprisonment of company officials and public censure, claims for damages by affected individuals, damage to our reputation and loss of goodwill, any of which could have a material adverse effect on our business. There are numerous U.S. federal and state laws and regulations related to the privacy and security of personal information. These laws and regulations include the Health Insurance Portability and Accountability Act of 1996, or HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, or HITECH, and their implementing regulations, or collectively referred to as the HIPAA Rules, which establish a set of national privacy and security standards to safeguard Protected Health Information, or PHI, by health plans, healthcare clearinghouses and certain healthcare providers, referred to as covered entities, and the business associates and their subcontractors with whom such covered entities contract for services that involve the creation, receipt, maintenance or transmission of PHI for or on behalf of a covered entity or another business associate. HIPAA requires covered entities and business associates to, among other things, develop and maintain policies and procedures with respect to PHI that is used or disclosed, including the adoption of administrative, physical and technical safeguards to protect such information and ensure the confidentiality, integrity and availability of electronic PHI. As this applies to our business, we are required to maintain security standards for any PHI that we create, receive, maintain or transmit. For example, we plan to offer cloud-based portal software to help our customers more efficiently use our products. The software will maintain security safeguards that are designed to be consistent with the HIPAA Rules, but we cannot guarantee that these safeguards will not fail or that they will not be deemed inadequate in the future. In addition, we could be subject to periodic audits for compliance with the HIPAA Privacy and Security Standards by the U.S. HHS, and our customers. The U.S. HHS Office for Civil Rights may impose significant penalties on entities subject to HIPAA for a failure to comply with a requirement of the HIPAA Rules. If we are unable to properly protect the privacy and security of the PHI of our customers, we could be found to have breached our contracts. Determining whether PHI has been handled in compliance with applicable privacy standards and our contractual obligations can be complex and we cannot be sure how these regulations will be interpreted, enforced or applied to our operations. In addition, many states in which we operate have laws that protect the privacy and security of sensitive and personal information, including health-related information. Certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to sensitive and personal information than federal, international or other state laws, and such laws may differ from each other, which may complicate compliance efforts. 18 Laws, regulations and standards in many other jurisdictions also apply broadly to the Processing of personal information, which impose significant compliance obligations. Complying with these numerous, complex and often changing regulations is expensive and difficult, and failure to comply with any Data Protection Laws or any security incident or breach involving the misappropriation, loss or other unauthorized use or disclosure of sensitive or confidential information, whether by us, one of our service providers or another third party, could negatively affect our business, financial condition and results of operations, including but not limited to: investigation costs, material fines and penalties; compensatory, special, punitive and statutory damages; litigation; consent orders regarding our privacy and security practices; requirements that we provide notices, credit monitoring services or credit restoration services or other relevant services to impacted individuals; adverse actions against our licenses to do business; and injunctive relief. Many statutory requirements, both in the United States and abroad, include obligations for companies to notify individuals of security breaches involving certain personal information, which could result from breaches experienced by us or our third-party service providers. For example, laws in all 50 U.S. states and the District of Columbia require businesses to provide notice to consumers whose unencrypted personal information has been disclosed as a result of a data breach. These laws are not consistent, and compliance in the event of a widespread data breach is difficult and may be costly. Moreover, states have been frequently amending existing laws, requiring attention to changing regulatory requirements. We also may be contractually required to notify affected customers, regulators, credit reporting agencies or other affected individuals of a security breach. Such notifications are costly, and the disclosures or the failure to comply with such requirements, could lead to material adverse effects, including without limitation, negative publicity, a loss of customer confidence in our services or security measures or breach of contract claims. There can be no assurance that the limitations of liability in our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages if we fail to comply with applicable Data Protection Laws, Data Protection Obligations or other legal obligations. In addition, although we may have contractual protections with our third-party service providers, contractors and consultants, any actual or perceived security breach by our subcontractors could harm our reputation and brand, expose us to potential liability or require us to expend significant resources on data security and in responding to any such actual or perceived breach. Any contractual protections we may have from our third-party service providers, contractors or consultants may not be sufficient to adequately protect us from any such liabilities and losses, and we may be unable to enforce any such contractual protections. We expect that there will continue to be new proposed laws and regulations concerning data privacy and security, and we cannot yet determine the impact such future laws, regulations and standards may have on our business. New laws, amendments to or re-interpretations of existing laws, regulations, standards and other obligations may require us to incur additional costs and restrict our business operations. Because the interpretation and application of health-related and Data Protection Laws and other obligations are still uncertain, and often contradictory and in flux, it is possible that the scope and requirements of these laws may be interpreted and applied in a manner that is inconsistent with our practices and our efforts to comply with the evolving data protection rules may be unsuccessful. If so, this could result in government-imposed fines or orders requiring that we change our practices, which could adversely affect our business. We cannot assure you that our third-party partners and service providers with access to our or our customers’, suppliers’ and employees’ personally identifiable and other sensitive or confidential information in relation to which we are responsible will not breach contractual obligations imposed by us or violate Data Protection Laws, or that they will not experience security breaches or attempts thereof, which could have a corresponding effect on our business, including putting us in breach of our obligations under the Data Protection Laws, which could in turn adversely affect our business, results of operations and financial condition. We cannot assure you that our contractual measures and our own privacy- and security-related safeguards will protect us from the risks associated with the third-party processing, storage and transmission of such information. We may receive inquiries or be subject to investigations, proceedings or actions, by various government entities regarding our privacy and information security practices and Processing (“Regulatory Proceedings”). These Regulatory Proceedings could result in a material adverse effect, including without limitation, interruptions of, or required changes to, our business practices, the diversion resources and the attention of management from our business, regulatory oversights and audits, discontinuance of necessary Processing, or other remedies that adversely affect our business. 19 In addition to the possibility of fines, lawsuits, regulatory investigations, public censure, other claims and penalties, and significant costs for remediation and damage to our reputation, we could be materially and adversely affected if legislation or regulations are expanded to require changes in our data processing practices and policies or if governing jurisdictions interpret or implement their legislation or regulations in ways that negatively impact our business. Complying with these various laws could cause us to incur substantial costs or require us to change our business practices and compliance procedures in a manner adverse to our business. Any inability to adequately address data privacy or security-related concerns, even if unfounded, or to comply with applicable laws, regulations, standards and other obligations relating to data privacy and security, could result in additional cost and liability to us, harm our reputation and brand, damage our relationships with customers and have a material and adverse impact on our business. While we maintain general liability insurance coverage, cyber insurance coverage and other insurance, we cannot assure that such coverage will be adequate or otherwise protect us from or adequately mitigate liabilities or damages with respect to claims, costs, expenses, litigation, fines, penalties, business loss, data loss, regulatory actions or material adverse effects arising out of our privacy and security practices, Processing or security breaches we may experience, or that such coverage will continue to be available on acceptable terms or at all. The successful assertion of one or more large claims against us that exceeds our available insurance coverage, or results in changes to our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements), could have an adverse effect on our business. In addition, we cannot be sure that our existing insurance coverage will continue to be available on acceptable terms or that our insurers will not deny coverage as to any future claim. We may incur substantial costs in our efforts to comply with evolving global data protection laws and regulations, and any failure or perceived failure by us to comply with such laws and regulations may harm our business and operations. The global data protection landscape is rapidly evolving, and we may be or become subject to or affected by numerous federal, state and foreign laws and regulations, as well as regulatory guidance, governing the collection, use, disclosure, transfer, security and processing of personal data, such as information that we collect about subjects and health care providers in connection with clinical trials. Implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, which may create uncertainty in our business; affect our or our service providers’ ability to operate in certain jurisdictions or to collect, store, transfer use and share personal data; result in liability; or impose additional compliance or other costs on us. Any failure or perceived failure by us to comply with federal, state, or foreign laws or self-regulatory standards could result in negative publicity, diversion of management time and effort and proceedings against us by governmental entities or others. In the United States, numerous federal and state laws and regulations, including federal health information privacy laws (e.g., the Health Insurance Portability and Accountability Act, as amended by the Health Information Technology for Economic and Clinical Health Act, or collectively HIPAA), state data breach notification laws, state health information privacy laws, and federal and state consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), that govern the collection, use, disclosure and protection of health-related and other personal information could apply to our operations or the operations of our collaborators. In addition, we may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy and security requirements under HIPAA or other privacy and data security laws. Depending on the facts and circumstances, we could be subject to criminal penalties if we knowingly obtain, use, or disclose protected health information maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA. However, determining whether protected health information has been handled in compliance with applicable privacy standards and our contractual obligations can be complex and may be subject to changing interpretation. If we are unable to properly protect the privacy and security of protected health information or other personal, sensitive, or confidential information in our possession, we could be found to have breached our contracts. Further, if we fail to comply with applicable privacy laws, including applicable HIPAA privacy and security standards, we could face significant administrative, civil and criminal penalties. Enforcement activity can also result in financial liability and reputational harm, and responses to such enforcement activity can consume significant internal and outside resources. Furthermore, state attorneys general are authorized to bring civil actions seeking either injunctions or damages in response to violations that threaten the privacy of state residents. In addition, our ongoing efforts to comply with evolving laws and regulations at the federal and state level may be costly and require continuous modifications to our compliance policies, procedures, and systems. 20 Many state laws govern the privacy and security of personal information and data in specified circumstances, many of which differ from each other in significant ways, are often not pre-empted by HIPAA, and may have a more prohibitive effect than HIPAA, thus complicating compliance efforts. For example, the California Consumer Privacy Act of 2018 (the “CCPA”), which went into effect in January 2020 and provides new data privacy rights for consumers and new operational requirements for companies, which may increase our compliance costs and potential liability. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. While there is currently an exception for protected health information that is subject to HIPAA and clinical trial regulations, as currently written, the CCPA may impact certain of our business activities. In addition, the California Consumer Rights Act, or CPRA, was recently enacted to strengthen elements of the CCPA and became effective on January 1, 2023. The CPRA imposes additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data and expands the application of the CCPA to all human resources personal information of California-based employees. In addition, the CPRA created a new California data protection agency authorized to issue substantive regulations and is expected to result in increased privacy and information security enforcement. A number of other states have considered similar privacy proposals, and states have recently enacted their own privacy laws. For example, the Virginia Consumer Data Protection Act became effective on January 1, 2023, and Colorado and Utah enacted similar laws that became effective in 2023, increasing the complexity of compliance and the risk of failures to comply. These privacy laws may impact our business activities and exemplify the vulnerability of our business to the evolving regulatory environment related to personal data. In addition to our operations in the United States, which may be subject to health care and other laws relating to the privacy and security of health information and other personal information, we may be or become subject to European data privacy laws, regulations and guidelines. The General Data Protection Regulation, (EU) 2016/679 (“GDPR”) became effective on May 25, 2018, and deals with the collection, use, storage, disclosure, transfer, or other processing of personal data, including personal health data, regarding individuals in the EEA. The GDPR imposes a broad range of strict requirements on companies subject to the GDPR, including requirements relating to having legal bases for processing personal information relating to identifiable individuals and transferring such information outside the EEA, including to the United States, providing details to those individuals regarding the processing of their personal health and other sensitive data, obtaining consent of the individuals to whom the personal data relates, keeping personal information secure, having data processing agreements with third parties who process personal information, responding to individuals’ requests to exercise their rights in respect of their personal information, reporting security breaches involving personal data to the competent national data protection authority and affected individuals, appointing data protection officers, conducting data protection impact assessments, and record-keeping. The GDPR increases substantially the penalties to which we could be subject in the event of any non-compliance, including fines of up to €10,000,000 or up to 2% of our total worldwide annual turnover for certain comparatively minor offenses, or up to €20,000,000 or up to 4% of our total worldwide annual turnover, whichever is greater, for more serious offenses. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. In addition, the GDPR includes restrictions on cross-border data transfers. Following the United Kingdom’s withdrawal from the European Union (i.e., Brexit), and the expiry of the Brexit transition period, which ended on December 31, 2020, the EU GDPR has been implemented in the United Kingdom (as the UK GDPR). The UK GDPR sits alongside the UK Data Protection Act 2018 which implements certain derogations in the EU GDPR into UK law. Under the UK GDPR, companies not established in the UK but who process personal data in relation to the offering of goods or services to individuals in the UK, or to monitor their behavior will be subject to the UK GDPR – the requirements of which are (at this time) largely aligned with those under the EU GDPR and as such, may lead to similar compliance and operational costs with potential fines of up to £17.5 million or 4% of global turnover. In 2022, the government of the United Kingdom proposed and debated the Data Protection and Digital Information Bill to harmonize the 2018 Data Protection Act, UK GDPR, and the Privacy and Electronic Communications Regulations under one legislative framework. However, progress on the bill stalled as the government continues to assess the most optimal approach to data protection reform. 21 We currently sell some of our products in the EEA, and the GDPR increases our responsibility and liability in relation to personal data that we process where such processing is subject to the GDPR, and we are required to have in place additional mechanisms and safeguards to ensure compliance with the GDPR, including as implemented by individual countries. Compliance with the GDPR is a rigorous and time-intensive process that increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation, and reputational harm in connection with our European activities. We expect that we will continue to face uncertainty as to whether our efforts to comply with any obligations under European privacy laws will be sufficient. If we are investigated by a European data protection authority, we may face fines and other penalties. Any such investigation or charges by European data protection authorities could have a negative effect on our existing business and on our ability to attract and retain new clients or partners. Risks Related to Our Intellectual Property If the combination of patents, trade secrets and contractual provisions that we rely on to protect our intellectual property is inadequate, our ability to commercialize our products successfully will be harmed, and we may not be able to operate our business profitably. Our success depends significantly on our ability to protect our proprietary rights to the technologies incorporated in our products. We rely on a combination of patent protection, trade secret laws and nondisclosure, confidentiality and other contractual restrictions to protect our proprietary technology. However, these may not adequately protect our rights or permit us to gain or keep any competitive advantage. The issuance of a patent is not conclusive as to its scope, validity or enforceability. The scope, validity or enforceability of our issued patents can be challenged in litigation or proceedings before the U.S. Patent and Trademark Office, or the USPTO, or foreign patent offices. In addition, our pending patent applications include claims to numerous important aspects of our products under development that are not currently protected by any of our issued patents. We cannot assure you that any of our pending patent applications will result in the issuance of patents to us. The USPTO or foreign patent offices may deny or require significant narrowing of claims in our pending patent applications. Patents issued as a result of the pending patent applications, if any, may not provide us with significant commercial protection or be issued in a form that is advantageous to us. Proceedings before the USPTO or foreign patent offices could result in adverse decisions as to the priority of our inventions and the narrowing or invalidation of claims in issued patents. The laws of some foreign countries may not protect our intellectual property rights to the same extent as the laws of the United States, if at all. Our competitors may successfully challenge and invalidate or render unenforceable our issued patents, including any patents that may issue in the future, which could prevent or limit our ability to market our products and could limit our ability to stop competitors from marketing products that are substantially equivalent to ours. In addition, competitors may be able to design around our patents or develop products that provide outcomes that are comparable to our products but that are not covered by our patents. In the event a competitor infringes upon any of our patents or other intellectual property rights, enforcing our rights may be difficult, time-consuming and expensive, and would divert management’s attention from managing our business. There can be no assurance that we will be successful on the merits in any enforcement effort. In addition, we may not have sufficient resources to litigate, enforce or defend our intellectual property rights. We could become subject to intellectual property litigation that could be costly, result in the diversion of management’s time and efforts, require us to pay damages, prevent us from marketing our commercially available products or product candidates and/or reduce the margins we may realize from our products that we may commercialize. Whether a product infringes a patent involves complex legal and factual issues, and the determination is often uncertain. There may be existing patents of which we are unaware that our products under development may inadvertently infringe. The likelihood that patent infringement claims may be brought against us increases as the number of participants in the in vitro diagnostics market increases and as we achieve more visibility in the marketplace and introduce products to market. Any infringement claim against us, even if without merit, may cause us to incur substantial costs, and would place a significant strain on our financial resources, divert the attention of management from our core business, and harm our reputation. In some cases, litigation may be threatened or brought by a patent holding company or other adverse patent owner who has no relevant product revenues and against whom our patents may provide little or no deterrence. If we were found to infringe any patents, we could be required to pay substantial damages, including triple damages if an infringement is found to be willful, and royalties and could be prevented from selling our products unless we obtain a license or are able to redesign our products to avoid infringement. We may not be able to obtain a license enabling us to sell our products on reasonable terms, or at all, and there can be no assurance that we would be able to redesign our products in a way that would not infringe those patents. If we fail to obtain any required licenses or make any necessary changes to our technologies or the products that incorporate them, we may be unable to commercialize one or more of our products or may have to withdraw products from the market, all of which would have a material adverse effect on our business, financial condition and results of operations. 22 We rely substantially on our trademarks and trade names. If our trademarks and trade names are not adequately protected, then we may not be able to build name recognition in our markets of interest and our business may be harmed. We rely substantially upon trademarks to build and maintain the integrity of our brand. Our registered and unregistered trademarks or trade names may be challenged, infringed, circumvented, declared unenforceable or determined to be violating or infringing on other intellectual property rights. We may not be able to protect or enforce our rights to these trademarks and trade names, which we rely upon to build name recognition among potential partners and customers in our markets of interest. At times, competitors or other third parties may adopt trade names or trademarks similar to ours, thereby impeding our ability to build brand identity and possibly leading to market confusion. Asserting claims against such third parties may be prohibitively expensive. In addition, there could be potential trade name or trademark infringement, or dilution claims brought by owners of other trademarks against us. Over the long term, if we are unable to establish name recognition based on our trademarks and trade names, then we may not be able to compete effectively, and our business may be adversely affected. Our efforts to enforce or protect our proprietary rights related to trademarks, trade secrets, domain names or other intellectual property may be ineffective, could result in substantial costs and diversion of resources and could harm our business, financial condition and results of operations. Risks Related to Litigation from Operating Our Business Current or future litigation, government investigations and other legal proceedings may harm our business. We have been, currently are and may in the future become, involved in legal proceedings that could have a negative impact on our reputation, business and financial condition and divert the attention of our management from the operation of our business. The types of legal proceedings we may be or become subject to include patent and other intellectual property claims, product liability claims, employee claims, tort or contract claims, federal or state regulatory investigations, securities class actions and shareholder derivative actions, and other legal proceedings, investigations or claims. For example, we are currently parties to two securities class action claims and three derivative actions. Litigation and other legal proceedings are inherently unpredictable and can result in excessive or unanticipated verdicts and/or injunctive relief that affect how we operate our business. We obtain business insurance, including executive and corporate securities liability insurance to insure against such claims should they arise. The insurance we have in place for such events may prove to be inadequate to pay a damage award, we may have to pay the excess of this award out of our cash reserves, which could significantly harm our financial condition. A legal proceeding claim, even one without merit, could harm our reputation in the industry, lead to significant legal fees, and result in the diversion of management’s attention from managing our business. We could incur judgments or enter into settlements of claims for monetary damages or for agreements to change the way we operate our business, or both. There may be an increase in the scope of these matters or there may be additional lawsuits, claims, proceedings or investigations in the future, which could harm our business, financial condition and results of operations. Adverse publicity about regulatory or legal action against us could damage our reputation and brand image, undermine our customers’ confidence and reduce long-term demand for any of our products or other offerings, even if the regulatory or legal action is unfounded or not material to our operations. For additional information, see “Item 3. Legal Proceedings.” 23 General Risk Factors The price of our common stock may fluctuate substantially. The market price of our common stock may be subject to wide fluctuation in response to various factors, some of which are beyond our control. Some factors that may cause the market price of our common stock to fluctuate, in addition to the other risks mentioned in this “Risk Factors” section and elsewhere in this report, are: ● sales or purchases of our common stock by our shareholders, executives, and directors; ● our ability to obtain regulatory approval to commercialize our PCR platform on a timely basis or at all; ● our ability to enter new markets; ● actual or unanticipated fluctuations in our annual and quarterly financial results; ● our ability to obtain financings to continue and expand our commercial activities, expand our manufacturing operations, conduct research and development activities including, but not limited to, human clinical trials, and other business activities; ● our ability to secure resources and the necessary personnel to continue and expand our commercial activities, develop additional diagnostic tests, conduct clinical trials and gain approval for our diagnostic tests on our desired schedule; ● commencement, enrollment or results of our clinical trials of our diagnostic tests or any future clinical trials we may conduct; ● changes in the development status of our diagnostic tests; ● any delays or adverse developments or perceived adverse developments with respect to review by the FDA or other similar foreign regulatory authorities of our planned clinical trials; ● any delay in our submission for studies or test approvals or adverse regulatory decisions, including failure to receive regulatory approval or clearance for our diagnostic tests; ● our announcements or our competitors’ announcements regarding new tests, enhancements, significant contracts, acquisitions or strategic investments; ● failures to meet external expectations or management guidance; ● changes in our capital structure or dividend policy, including future issuances of securities and sales of large blocks of common stock by our shareholders; ● announcements and events surrounding financing efforts, including debt and equity securities; ● competition from existing technologies and diagnostic tests or new technologies and diagnostic tests that may emerge; ● announcements of acquisitions, partnerships, collaborations, joint ventures, new diagnostic tests, capital commitments, or other events by us or our competitors; ● changes in general economic, political and market conditions in any of the regions in which we conduct our business; ● changes in industry conditions or perceptions; ● changes in valuations of similar companies or groups of companies; ● analyst research reports, recommendations and changes in recommendations, price targets and withdrawals of coverage; ● departures and additions of key personnel; ● disputes and litigations related to intellectual properties, proprietary rights, and contractual obligations; ● changes in applicable laws, rules, regulations, or accounting practices and other dynamics; ● other events or factors, many of which may be out of our control. In addition, if the market for stocks in our industry or industries related to our industry, or the stock market in general, experiences a loss of investor confidence, the trading price of our common stock could decline for reasons unrelated to our business, financial condition and results of operations. If any of the foregoing occurs, it could cause our stock price to fall and may expose us to lawsuits that, even if unsuccessful, could be costly to defend and a distraction to management. 24 Anti-takeover provisions in our charter documents and Utah law could discourage, delay, or prevent a change of control of our Company and may affect the trading price of our common stock. We are a Utah corporation and the anti-takeover provisions of the Utah Control Shares Acquisition Act may discourage, delay or prevent a change of control by limiting the voting rights of control shares acquired in a control share acquisition. In addition, our Articles of Incorporation and Bylaws may discourage, delay or prevent a change in our management or control over us that shareholders may consider favorable. Among other things, our Amended and Restated Articles of Incorporation and Bylaws: ● authorize the issuance of “blank check” preferred stock that could be issued by our board of directors in response to a takeover attempt; ● provide that vacancies on our board of directors, including newly created directorships, may be filled only by a majority vote of directors then in office, except a vacancy occurring by reason of the removal of a director without cause shall be filled by vote of the shareholders; ● no right to cumulative voting; ● limit who may call special meetings of shareholders These provisions could have the effect of delaying or preventing a change of control, whether or not it is desired by, or beneficial to, our shareholders. We do not currently intend to pay dividends on our common stock. We do not expect to pay cash dividends on our common stock. Any future dividend payments are within the absolute discretion of our board of directors and will depend on, among other things, our results of operations, working capital requirements, capital expenditure requirements, financial condition, contractual restrictions, business opportunities, anticipated cash needs, provisions of applicable law and other factors that our board of directors may deem relevant. We may not generate sufficient cash from operations in the future to pay dividends on our common stock. We are a “smaller reporting company” and the reduced disclosure requirements applicable to smaller reporting companies may make our common stock less attractive to investors. We are currently a “smaller reporting company” as defined in the Securities Exchange Act of 1934. Smaller reporting companies are able to provide simplified executive compensation disclosures in their filings, and have certain other decreased disclosure obligations in their SEC filings, including, among other things, only being required to provide two years of audited financial statements in annual reports. We cannot predict whether investors will find our common stock less attractive because of our reliance on any of these exemptions. If some investors find our common stock less attractive as a result, there may be a less active trading market for our common stock and our stock price may be more volatile. We incur substantial costs as a result of being a public company and our management expects to devote substantial time to public company compliance programs. As a public company, we incur significant legal, insurance, accounting and other expenses, including costs associated with public company reporting. We intend to invest resources to comply with evolving laws, regulations and standards, and this investment will result in increased general and administrative expenses and may divert management’s time and attention from product development and commercialization activities. If our efforts to comply with new laws, regulations and standards differ from the activities intended by regulatory or governing bodies due to ambiguities related to practice, regulatory authorities may initiate legal proceedings against us, and our business may be harmed. These laws and regulations could make it more difficult and costlier for us to obtain director and officer liability insurance for our directors and officers, and we may be required to accept reduced coverage or incur substantially higher costs to obtain coverage. These factors could also make it more difficult for us to attract and retain qualified executive officers and qualified members of our board of directors, particularly to serve on our audit and compensation committees. In addition, if we are unable to continue to meet the legal, regulatory and other requirements related to being a public company, we may not be able to maintain the listing of our common stock on The NASDAQ Capital Market, which would likely have a material adverse effect on the trading price of our common stock. We incur substantial costs as a result of being a public company and are subject to the continued listing requirements of the NASDAQ Capital Market, our management expects to devote substantial time to public company compliance programs. As a public company, we incur significant legal, insurance, accounting and other expenses, including costs associated with public company reporting. We intend to invest resources to comply with evolving laws, regulations and standards, and this investment will result in increased general and administrative expenses and may divert management’s time and attention from product development and commercialization activities. If our efforts to comply with new laws, regulations and standards differ from the activities intended by regulatory or governing bodies due to ambiguities related to practice, regulatory authorities may initiate legal proceedings against us, and our business may be harmed. These laws and regulations could make it more difficult and costlier for us to obtain director and officer liability insurance for our directors and officers, and we may be required to accept reduced coverage or incur substantially higher costs to obtain coverage. These factors could also make it more difficult for us to attract and retain qualified executive officers and qualified members of our board of directors, particularly to serve on our audit and compensation committees. In addition, if we are unable to continue to meet the legal, regulatory and other requirements related to being a public company, we may not be able to maintain the listing of our common stock on The NASDAQ Capital Market, which would likely have a material adverse effect on the trading price of our common stock. Currently our common stock is quoted on the NASDAQ Capital Market under the symbol “CODX”. We must satisfy certain minimum listing maintenance requirements to maintain the NASDAQ Capital Market quotation, including certain governance requirements and a series of financial tests relating to stockholders’ equity or net income or market value, public float, number of market makers and stockholders, market capitalization, and maintaining a minimum bid price of $1.00 per share. On January 10, 2025, we received a notice from the Listing Qualifications Department of The NASDAQ Stock Market (the “Staff”) stating that the bid price of our common stock for the previous 30 consecutive trading days had closed below the minimum $1.00 per share required for continued listing on The NASDAQ Capital Market under NASDAQ Listing Rule 5550(a)(2). The Company has a period of 180 calendar days, or until July 9, 2025 (the “Compliance Date”) to regain compliance with Listing Rule 5550(a)(2). To regain compliance, the bid price of the Company’s common stock must close at $1 or more for a minimum of ten consecutive business days before the Compliance Date. If the Company does not regain compliance with Rule 5550(a)(2) by July 9, 2025, the Company may be eligible for additional time. To qualify, the Company will be required to meet the continued listing requirement for market value of publicly held shares and all other initial listing standards for The Nasdaq Capital Market, with the exception of the bid price requirement, and will need to provide written notice of its intention to cure the deficiency during the second compliance period, by effecting a reverse stock split, if necessary. If the Company meets these requirements, the Staff will inform the Company that it has been granted an additional 180 calendar days. However, if it appears to the Staff that the Company will not be able to cure the deficiency, or if the Company is otherwise not eligible, the Staff will provide notice that its securities will be subject to delisting. We intend to actively monitor our bid price and will consider available options to resolve the deficiency and regain compliance with the Nasdaq Listing Rules. If Nasdaq delists our common stock from trading on its exchange and we are not able to list our securities on another national securities exchange, we expect our securities could be quoted on an over-the-counter market. If this were to occur, we could face significant material adverse consequences, including: ● a limited availability of market quotations for our securities; ● reduced liquidity for our securities; ● a determination that our common stock is a “penny stock” which will require brokers trading in our common stock to adhere to more stringent rules and possibly result in a reduced level of trading activity in the secondary trading market for our securities; ● a limited amount of news and analyst coverage; and ● a decreased ability to issue additional securities or obtain additional financing in the future.