What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-05-08 compared with 2024-11-14 · 11 added, 164 removed, 3 unchanged (98% of the section changed)

In addition to the other information

contained in this Quarterly Report you should consider the risk factors below which have been updated based on recent events as well as

the other risk factors and information in our Annual Report on Form 10-K for the year ended December 31, 2023, including our audited financial

statements and the related notes and “Management’s Discussion and Analysis of Financial Condition and Results of Operations.”

If any such risks actually occur, our business, financial condition, results of operations and future growth prospects would likely be

materially and adversely affected.

In these circumstances, the market price of our common stock would likely decline and you may lose

all or part of your investment.

Additional risks and uncertainties not presently known to us or that we currently deem immaterial also

may impair our business operations.

business and operations could suffer in the event of cybersecurity or other system failures.

the implementation of security measures, our internal computer systems and those of any third parties with which we partner are vulnerable

to damage from computer viruses, unauthorized access, natural disasters, terrorism, war and telecommunication and electrical failures.

While we have not experienced any cybersecurity or system failure, accident or breach to date that has been determined to have had a material

impact, if a significant event were to occur, it could result in a material disruption of our operations, substantial costs to rectify

or correct the failure, if possible, and potentially violation of HIPAA and other privacy laws applicable to our operations.

the California Consumer Privacy Act (the “CCPA”) became effective on January 1, 2020 and gave California residents expanded

rights to access and require deletion of their personal information, opt out of certain personal information sharing and receive detailed

information about how their personal information is used.

The CCPA provides for civil penalties for violations, as well as a private right

of action for data breaches that may increase data breach litigation.

Although the CCPA includes exemptions for certain clinical trials

data, and HIPAA-protected health information, the law may increase our compliance costs and potential liability with respect to other

personal information we collect about California residents.

The CCPA has prompted a number of proposals for new federal and state privacy

Other countries also have, or are developing, laws governing the collection, use and transmission of personal information,

such as the General Data Protection Regulation (“GDPR”) in the European Union (the “EU”) that became effective

in May 2018 and the Personal Information Protection and Electronic Documents Act that became effective in Canada in April 2000.

We anticipate

that over time we may expand our business outside of the United States.

With such expansion, we would be subject to increased governmental

regulation in the EU countries in which we might operate, including the GDPR.

These laws and similar laws adopted in the future could

increase our potential liability, increase our compliance costs and adversely affect our business.

If any disruption or security breach

resulted in a loss of or damage to our data or applications or inappropriate disclosure of confidential or protected information, we could

incur liability, further development of our proprietary formulations could be delayed, and our pharmacy operations could be disrupted,

subject to restriction or forced to terminate their operations, any of which could severely harm our business and prospects.

of our information technology systems, or a cyberattack or information security breach could significantly compromise the confidentiality,

integrity and availability of our information technology systems, network-connected control systems and/or our data, interrupt the operation

of our business and/or affect our reputation.

achieve our business objectives, we rely on sophisticated information technology systems, including hardware, software, technology infrastructure,

online sites and networks for both internal and external operations, mobile applications, cloud services and network-connected control

systems, some of which are managed, hosted, provided or serviced by third parties.

Internal or external events that compromise the confidentiality,

integrity and availability of our systems and data may significantly interrupt the operation of our business, result in significant costs

and/or adversely affect our reputation.

information technology systems are highly integrated into our business, including our customer service infrastructure, R&D efforts,

clinical and commercial manufacturing processes and product sales and distribution processes.

Further, as the large part of our employees

work remotely for some portion of their jobs, our reliance on our third-party information technology systems has increased substantially

and is expected to continue to increase.

Remote and hybrid working arrangements can increase cybersecurity risks due to the challenges

associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks.

The complexity and interconnected nature of software, hardware and our systems make them vulnerable to breakdown or other service interruptions,

and to software errors or defects, misconfiguration and other security vulnerabilities.

Upgrades or changes to our systems or the software

that we use have resulted and we expect, in the future, will result in the introduction of new cybersecurity vulnerabilities and risks.

Our systems are also subject to frequent perimeter network reconnaissance and scanning, phishing and other cyberattacks.

As the cyber-threat

landscape evolves, these attacks are growing in frequency, sophistication, and intensity, and are becoming increasingly difficult to detect

and increasingly sophisticated in using techniques and tools—including artificial intelligence—that circumvent security controls,

evade detection and remove forensic evidence.

Such attacks could include the use of harmful and virulent malware, including ransomware

or other denials of service, which can be deployed through various means, including the software supply chain, e-mail, malicious websites

and/or the use of social engineering/phishing.

have experienced attacks against our network, although none that have had a material adverse impact to our business.

Recently, in November

2024, we became aware of a cybersecurity incident that involved unauthorized access of an employee’s email account.

this unauthorized access the threat actor was able to fraudulently divert Company funds to its bank account.

We detected the incident

in a time that management believes minimized the financial, operational or reputational risk to the Company, and at no point was our ability

to generate revenues disrupted.

However, we, along with our external cybersecurity experts, are continuing to work diligently to fully

investigate and assess the impact of the incident and have notified, and are cooperating with, federal law enforcement.

As the investigation

of the incident is ongoing, the full scope, nature and impact of the incident are not yet fully known.

can be no assurance that our efforts to guard against the wide and growing variety of potential attack techniques will be successful.

Attacks such as those experienced by government entities (including those that approve and/or regulate our products) and other multi-national

companies, including some of our peers, could leave us unable to utilize key business systems or access or protect important data, and

could have a material adverse effect on our ability to operate our business, including developing, gaining regulatory approval for, manufacturing,

selling and/or distributing our products.

For example, in 2017, a pharmaceutical company experienced a cyberattack involving virulent

malware that significantly disrupted its operations, including its research and sales operations and the production of some of its medicines

and vaccines.

As a result of the cyberattack, its orders and sales for certain products were negatively affected.

In late 2020, SolarWinds

Corporation, a leading provider of software for monitoring and managing information technology infrastructure, disclosed that it had suffered

a cybersecurity incident whereby attackers had inserted malicious code into legitimate software updates for its products that were installed

by myriad private and government customers, enabling the attackers to access a backdoor to such systems.

In 2022, Okta, Inc., a provider

of software that helps companies manage user authentication, disclosed that several hundred of its corporate customers were vulnerable

to a security breach that allowed attackers to access Okta’s internal network.

Although this breach did not have a significant effect

on our business, there can be no assurance that a similar future breach would not result in a material adverse effect on our business

or results of operations .

systems contain and use a high volume of sensitive data, including intellectual property, trade secrets and other proprietary business

information, financial information, regulatory information, strategic plans, sales trends and forecasts, litigation materials and/or personal

identifiable information belonging to us, our staff, our patients, customers and/or other parties.

In some cases, we utilize third-party

service providers to collect, process, store, manage or transmit such data, which have increased our risk.

Intentional or inadvertent

data privacy or security breaches (including cyberattacks) resulting from attacks or lapses by employees, service providers (including

providers of information technology-specific services), business partners, nation states (including groups associated with or supported

by foreign intelligence agencies), organized crime organizations, “hacktivists” or others, create risks that our sensitive

data may be exposed to unauthorized persons, our competitors or the public.

System vulnerabilities and/or cybersecurity breaches experienced

by our third-party service providers constitute a substantial share of the information security risks to our business.

There can be no

assurance that a cybersecurity incident would not result in a material adverse effect on our business or results of operations.

the timeliness of our awareness of a cybersecurity incident affects our ability to respond to and work to mitigate the severity of such

Cyberattackers

are also increasingly exploiting vulnerabilities in commercially available software from shared or open-source code.

We rely on third

party commercial software that have had and may have such vulnerabilities, but as use of open-source code is frequently not disclosed,

our ability to fully assess this risk to our systems is limited.

There can be no assurances that a vulnerability in the software and services

that we use would not result in a material adverse effect on our business or results of operations.

and global government regulators, our business partners, suppliers with whom we do business, companies that provide us or our partners

with business services and companies we have acquired or may acquire face similar risks.

Security breaches of their systems or service

outages have adversely affected systems and could, in the future, affect our systems and security, leave us without access to important

systems, products, raw materials, components, services or information, or expose our confidential data or sensitive personal information.

An extended service outage affecting these or other vendors, particularly where such vendor is the single source from which we obtain

the services, could have a material adverse effect on our business or results of operations.

For example, in February 2024, UnitedHealth

Group announced that a suspected nation-state associated cyber security threat actor had gained access to some of the Change Healthcare

(“Change”) information technology systems.

Change is the largest clearinghouse for medical claims in the U.S.

was not directly impacted by this cybersecurity incident, it was reported that as a reaction to the cybersecurity incident, Change temporarily

disconnected over 100 related payment systems and Change was unable to process medical claims through its primary platforms.

This resulted

in the delays to the revenue and cash collection cycle for several ASCs and physician offices, putting a strain on their cash resources.

While temporary, the cash constraints for these ASCs and physician offices, we believe, impacted sales of some of our products, such as

IHEEZO, during this disrupted period of time.

In addition, we distribute our products in the United States primarily through three pharmaceutical

wholesalers, and a security breach that impairs the distribution operations of our wholesalers could significantly impair our ability

to deliver our products to healthcare providers and patients.

There can be no assurance that our cybersecurity risk management program

and processes, including our policies, controls, or procedures, will be effective in protecting our information technology systems and

sensitive data.

will continue to experience varying degrees of cyberattacks and other incidents in the future.

Even though we continue to invest in the

monitoring, protection and resilience of our critical and/or sensitive data and systems, there can be no assurances that our efforts will

detect, prevent or fully recover systems or data from all breakdowns, service interruptions, attacks and/or breaches of our systems that

could adversely affect our business and operations and/or result in the loss or exposure of critical, proprietary, private, confidential

or otherwise sensitive data, which could result in material financial, legal business or reputational harm to us or negatively affect

our stock price.

While we maintain cyber-liability insurance, our insurance is not sufficient to cover us against all losses that could

potentially result from a service interruption, breach of our systems or loss of our critical or sensitive data.

are also subject to various laws and regulations globally regarding privacy and data protection, including laws and regulations relating

to the collection, storage, handling, use, disclosure, transfer and security of personal data.

The legislative and regulatory environment

regarding privacy and data protection is continuously evolving and developing and the subject of significant attention globally.

we are subject to the CCPA, which became effective in January 2020, which can result in substantial penalties for noncompliance.

was amended in late 2020, to create the California Privacy Rights Act to create opt in requirements for the use of sensitive personal

data and the formation of a new dedicated agency for the enforcement of the law, the California Privacy Protection Agency.

Similar consumer

privacy laws went into effect in Virginia, Colorado, Utah, Connecticut and Florida in 2023.

Consumer privacy laws were also passed in

11 other states, with the earliest effective dates later this year, and proposed in three additional states.

Failure to comply with these

current and future laws could result in significant penalties and reputational harm and could have a material adverse effect on our business

and results of operations.

In addition to the other

information contained in this Quarterly Report you should consider the risk factors and the other information in our Annual Report on

Form 10-K for the year ended December 31, 2024, including our audited financial statements and the related notes and “Management’s

Discussion and Analysis of Financial Condition and Results of Operations.” If any such risks actually occur, our business, financial

condition, results of operations and future growth prospects would likely be materially and adversely affected.

In these circumstances,

the market price of our common stock would likely decline and you may lose all or part of your investment.

Additional risks and uncertainties

not presently known to us or that we currently deem immaterial also may impair our business operations.

Unregistered Sales of Equity Securities and Use of Proceeds

Defaults Upon Senior Securities

Not applicable.

Mine Safety Disclosures

Not applicable.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors