What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-02-25 compared with 2024-02-27 · 269 added, 231 removed, 1145 unchanged (30% of the section changed)

5 unchanged sentences

We have incurred net losses since our inception.

For the years ended December 31, 2023 and 2022, we had net losses of $60.8 million and $58.9 million, respectively, and we expect to continue to incur additional losses.

For the years ended December 31, 2024 and December 31, 2023, we had net losses of $56.4 million and $60.8 million, respectively, and we expect to continue to incur additional losses.

As of December 31, 2024, we had an accumulated deficit of $467.6 million.

4 unchanged sentences

We have limited experience marketing and selling our solution.

We began commercializing our solution and the Zephyr Valve in the United States in 2018 and, through our predecessors, in the EU and other European countries in 2003.

We began commercializing our solution and the Zephyr Valve in the United States in 2018 and, through our predecessors, in the European Union (the “EU”) and other European countries in 2003.

Our limited commercialization experience and limited number of approved or cleared products make it difficult to evaluate our current business and predict our future prospects.

5 unchanged sentences

• our third-party suppliers’ ability to supply the components of the Zephyr Valves in a timely manner, in accordance with our specifications and in compliance with applicable regulatory requirements, and to remain in good standing with regulatory agencies;

• the impact of any public health crisis, such as a resurgence of COVID-19 infections, on our business, financial condition and results of operations;

• the impact of any public health crisis on our business, financial condition and results of operations;

• the availability, perceived advantages, relative cost, relative safety and relative efficacy of alternative and competing therapies;

7 unchanged sentences

We have no other therapeutic products currently approved for sale in the United States and we may never be able to develop additional marketable products or enhancements to the Zephyr Valve solution.

Additionally, although we do sell and rent the Chartis System and sell the catheters used for the delivery of the Zephyr Valve and in connection with the Chartis System, these sales and rentals are ultimately dependent on sales of the Zephyr Valve as they are not used independently.

Currently, our solution is only available to treat patients with severe emphysema in the United States and additional limited indications internationally where we have obtained the necessary regulatory approvals, certification or clearances.

5 unchanged sentences

Our success will depend on our ability to bring awareness to our solution, and the Zephyr Valve in particular, and educate hospitals and physicians regarding the benefits of our solution over existing products and services and to encourage those parties to recommend our solution to their patients.

Sales of Zephyr Valves and delivery catheters accounted for most of our revenue for the years ended December 31, 2023 and 2022 and we expect that sales of Zephyr Valves and delivery catheters will continue to account for most of our revenue going forward.

Sales of Zephyr Valves and delivery catheters accounted for most of our revenue for the years ended December 31, 2024 and December 31, 2023 and we expect that sales of Zephyr Valves and delivery catheters will continue to account for most of our revenue going forward.

We do not know if our solution will be successful over the long term.

2 unchanged sentences

Additionally, adoption will be directly influenced by a number of financial factors, including the ability of providers to obtain sufficient reimbursement from payors for deploying our solution.

The safety, efficacy, performance and cost-effectiveness of our solution, on a stand-alone basis and relative to competing treatments and services, will determine the willingness of payors to cover the procedure.

including other plans in the Blue Cross Blue Shield family of plans, do not currently consider our solution medically necessary.

The safety, efficacy, performance and cost-effectiveness of our solution, on a stand-alone basis and relative to competing treatments and

services, will determine the willingness of payors to cover the procedure.

While we have established positive coverage policies with major national private payors, such as Aetna, Anthem Blue Cross Blue Shield, Blue Cross Blue Shield of Michigan, Humana, Health Care Service Corporation, and Highmark, other commercial payors, including other plans in the Blue Cross Blue Shield family of plans, do not currently consider our solution medically necessary.

No matter the level of coverage by the commercial payor, each patient is generally considered on a case-by-case basis.

17 unchanged sentences

• access to hospital bidding processes;

• a decrease or delay in the number of procedures performed using our solution as a result of a public health crisis, such as a resurgence of COVID-19 infections;

• a decrease or delay in the number of procedures performed using our solution as a result of a public health crisis;

• competing products and alternatives;

14 unchanged sentences

Furthermore, we may expend significant effort in these time-consuming processes and still may not obtain a purchase contract from such hospitals.

Public health crises, such as the COVID-19 pandemic, have in the past and may in the future have a material adverse impact on our business, financial condition and results of operations.

Public health crises, such as the COVID-19 pandemic, and other events beyond our control, have in the past and may in the future have a material adverse impact on our business, financial condition and results of operations.

For example, the COVID-19 pandemic and related governmental and societal responses to mitigate its impact had a material adverse impact on our business, financial condition and results of operations by decreasing and delaying procedures performed using our products due to healthcare organizations prioritizing the treatment of patients with COVID-19 and altering their operations to respond to the pandemic.

A public health crises could significantly disrupt economic activity globally and have a material adverse impact our ability to access capital and on our business, financial condition and results of operations as a result of hospitals reducing capital and overall spend and other potential changes in healthcare organizations’ prioritizing of patient treatment, significant job losses and unemployment, including the inability of patients to obtain or maintain health insurance policies, inflation, and reductions in disposable income.

Additionally, if a public health crisis or other event beyond our control were to emerge, there may be limited provider capacity due to labor shortages, or for other reasons, which could limit the ability of patients to receive treatment with Zephyr Valves.

This limited provider and hospital capacity could have a material adverse effect on our business, financial condition and results of operations, and it may have the effect of heightening other risks described in this “Risk Factors” section.

Use of our solution requires appropriate physician training, and inadequate training may lead to negative patient outcomes and negatively affect our business, financial condition and results of operations.

The successful implantation of the Zephyr Valve depends in part on the training and skill of the physician performing the procedure and on adherence to appropriate patient selection and proper techniques provided in training sessions conducted by our training faculty.

For example, we train physicians to ensure correct patient selection and treatment planning using the StratX Platform and Chartis System, and proper placement of the Zephyr Valve.

Physicians could experience difficulty with the technique necessary to successfully implant the valve and may not achieve the technical competency necessary to complete the training program, or they could fail to properly learn how to interpret our StratX Platform or Chartis System.

For example, we train physicians to ensure correct patient selection and treatment planning using the LungTraX Platform and Chartis System, and proper placement of the Zephyr Valve.

Moreover, physicians rely on their previous medical training and experience when using our solution, and we cannot guarantee that all such physicians will have the necessary skills to properly identify ideal candidates and to perform the procedure.

1 unchanged sentence

If physicians implant the Zephyr Valve incorrectly, or do so in a manner that is inconsistent with its labeled indications, with components that are not our products, in patients who are not good candidates, or without adhering to or completing our training sessions, their patient outcomes may not be consistent with the outcomes achieved in our clinical trials.

This result may negatively impact the perception of patient benefit and safety, and limit adoption of our solution as a treatment for severe emphysema and our products that facilitate the procedure, which will negatively affect our business, financial condition and results of operations.

This result may negatively impact

the perception of patient benefit and safety, and limit adoption of our solution as a treatment for severe emphysema and our products that facilitate the procedure, which will negatively affect our business, financial condition and results of operations.

In addition, we may experience difficulty growing the number of physicians who complete our training program if patient demand is low, if the length of time necessary to train each physician is longer than expected, if the capacity of our commercial organization to train physicians is less than expected or if we are unable to sufficiently grow our sales force.

14 unchanged sentences

Two of the pneumothorax-related deaths occurred early in the study when patients were being kept in the hospital for one night after the procedure.

In order to more closely

monitor patients, the study protocol was subsequently amended to keep patients in the hospital for five nights.

In order to more closely monitor patients, the study protocol was subsequently amended to keep patients in the hospital for five nights.

Based on the full study data, current practice is to keep patients in the hospital for a minimum of three nights post-treatment.

18 unchanged sentences

The Centers for Medicare & Medicaid Services (“CMS”) have established guidelines for the coverage and reimbursement of certain products and procedures by Medicare.

In general, in order to be reimbursed by Medicare, a

healthcare procedure furnished to a Medicare beneficiary must be reasonable and necessary for the diagnosis or treatment of an illness or injury, or to improve the functioning of a malformed body part.

In general, in order to be reimbursed by Medicare, a healthcare procedure furnished to a Medicare beneficiary must be reasonable and necessary for the diagnosis or treatment of an illness or injury, or to improve the functioning of a malformed body part.

The methodology for determining coverage status and the amount of Medicare reimbursement varies based upon, among other factors, the setting in which a Medicare beneficiary received healthcare products and services.

4 unchanged sentences

Whenever possible, prior authorization for coverage for the procedure is recommended before the procedure is performed.

When prior authorization is not obtained or not allowed, and the procedure is performed and not covered by third-party payors, physicians or hospitals typically directly bill patients enrolled with these third-party payors for the costs and fees associated with the procedures in which our products are used.

When prior authorization is not obtained or not allowed, and the procedure is

performed and not covered by third-party payors, physicians or hospitals typically directly bill patients enrolled with these third-party payors for the costs and fees associated with the procedures in which our products are used.

Moreover, because there is often no separate reimbursement for supplies used in surgical procedures, the additional cost associated with the use of our solution can affect the profit margin of the hospital or surgery center where the procedure is performed.

4 unchanged sentences

Reimbursement is obtained from a variety of sources, including government sponsors, hospital budgets, or private health insurance plans, or combinations thereof.

We have established market access in countries across Europe and Asia Pacific, including Australia, Austria, Belgium, France, Germany, Japan, the Netherlands, United Kingdom (the “UK”), Scotland, Switzerland and South Korea, and other countries.

We have established market access in countries across Europe and Asia Pacific, including Australia, Austria, Belgium, France, Germany, Japan, the Netherlands, the United Kingdom (the “UK”), Scotland, Switzerland and South Korea, and other countries.

Even if we succeed in bringing our products to market in additional foreign countries, uncertainties regarding future healthcare policy, legislation and regulation, as well as private market practices, could affect our ability to sell our products in commercially acceptable quantities at acceptable prices.

For example, in some markets, such as France, coverage and reimbursement are currently available for procedures using our products but are subject to constraints such as price controls or unit sales limitations.

Third-party payors, whether foreign or domestic, or governmental or commercial, are developing increasingly sophisticated methods of controlling healthcare costs.

7 unchanged sentences

Further, we believe that future coverage and reimbursement may be subject to increased restrictions, such as additional prior authorization requirements, both in the United States and in international markets.

Third-party coverage and reimbursement for procedures using our solution or any of our products in development for which we

may receive regulatory approval may not be available or adequate in either the United States or international markets, which will negatively affect our business, financial condition and results of operations.

Third-party coverage and reimbursement for procedures using our solution or any of our products in development for which we may receive regulatory approval may not be available or adequate in either the United States or international markets, which will negatively affect our business, financial condition and results of operations.

Third-party payors and physicians who do not cover or use the Zephyr Valve may require additional clinical data prior to maintaining coverage of or adopting the Zephyr Valve.

25 unchanged sentences

We have limited long-term data regarding the safety and effectiveness of our solution, including the Zephyr Valve.

The only safety and effectiveness data of our solution, including the Zephyr Valve, is limited to one year following placement and we are required to conduct extension studies to follow up on safety and effectiveness out to five years.

Although we have demonstrated the safety, effectiveness and clinical advantages of our solution in multiple clinical trials in approximately 450 patients selected using the Chartis System, the Zephyr Valve is still a relatively new treatment for severe emphysema.

The long-term effects of using our solution in a large number of patients are currently being studied, and the results of short-term clinical use of such products do not necessarily predict long-term clinical benefits or reveal long-term adverse effects.

We were required to conduct the LIBERATE extension study to follow up on safety and effectiveness out to five years.

After the completion of the one-year follow up, 115 Zephyr Valve patients and 47 crossover patients (162 total patients) entered the LIBERATE extension study.

Patient follow up for this extension study has been recently completed, and data analysis is ongoing.

Our ability to interpret the data from the LIBERATE extension study may be limited by the fact that the matched control group exited the study after one year.

In addition to the LIBERATE extension study, registry studies evaluating the safety and effectiveness of our solution out to three years in the United States, France and Japan are ongoing, with a total enrollment of over 300 patients.

Although we have demonstrated the safety, effectiveness and clinical advantages of our solution in multiple clinical trials in over 650 patients selected using the Chartis System, the Zephyr Valve is still a relatively new treatment for severe emphysema.

The long-term effects of using our solution have been studied in a small number of patients, and these results do not necessarily predict long-term clinical benefits or reveal long-term adverse effects in the broader eligible population.

The results of clinical trials of our solution conducted to date and ongoing or future studies and trials of our current, planned or future products may not be predictive of the results of later clinical trials, and interim results of a clinical trial do not necessarily predict final results.

12 unchanged sentences

Additional information regarding the laws impacting our relationships with physicians and other healthcare professionals can be found below under “Risks Related to Government Regulation and Our Industry.”

We rely on third parties to perform certain aspects of the CT scan analysis within the StratX Platform.

We rely on third-party service providers to upload and analyze CT scan data on the StratX Platform.

In order to make the StratX Platform available to physicians, we contract with a third-party cloud service.

This third-party cloud service enables physicians to upload CT scan data while removing protected health information (“PHI”) of patients from that data, in case the physicians have, inadvertently, not removed the PHI themselves.

We rely on third parties to perform certain aspects of the CT scan analysis within the LungTraX Platform.

We rely on third-party service providers to upload and analyze CT scan data on the LungTraX Platform.

In order to make the LungTraX Platform available to physicians, we contract with a third-party cloud service.

This third-party cloud service enables physicians to upload CT scan data while removing PHI of patients from that data.

We also contract with additional third-party service providers to analyze the CT scan data using their proprietary software, and provide quantitative results via an easy-to-read StratX Lung Report.

10 unchanged sentences

While our suppliers have generally met our demand for their products and services on a timely basis in the past, we cannot guarantee that they will in the future be able to meet our demand for their products, either because of acts of nature, the nature of our agreements with those manufacturers or our relative importance to them as a customer, and our suppliers may decide in the future to discontinue or reduce the level of business they conduct with us.

If we are required to change suppliers due to any change in or termination of our relationships with these third parties, or if our suppliers are unable to obtain the materials they need to produce our products at consistent prices or at all, we may lose sales, experience manufacturing or other delays, incur increased costs or otherwise experience impairment to our customer relationships.

to our customer relationships.

We cannot guarantee that we will be able to establish alternative relationships on similar terms, without delay or at all.

7 unchanged sentences

We currently produce the Zephyr Valve and Chartis System at this facility, and we do not have redundant facilities.

We also store finished

goods at secondary facilities in Redwood City, California, Memphis, Tennessee and the Netherlands.

We also store finished goods at secondary facilities in Redwood City, California, Memphis, Tennessee and the Netherlands.

If these facilities suffer damage, or a force majeure event, this could materially impact our ability to operate.

12 unchanged sentences

It may not be possible for us to manufacture these products at a cost or in quantities sufficient to make these products commercially viable or to maintain current operating margins, all of which will negatively affect our business, financial condition and results of operations.

If our information technology systems or data, or those of third parties with whom we work, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, interruptions to our operations such as to our LungTraX Platform services or our clinical trials, claims that we breached our data protection obligations, harm to our reputation, business operations, and financial condition, as well as a loss of customers or sales.

In the ordinary course of business, we or the third parties with whom we work, collect, store, receive, generate, use, transfer, disclose, make accessible, share, protect, secure, dispose of or transmit (collectively, “process”) proprietary, confidential, and sensitive data (including but not limited to intellectual property, proprietary business information and personal data).

We rely extensively on information technology (“IT”) systems, networks and services, including internet sites, data hosting and processing facilities and tools, physical security systems and other hardware, software and technical applications and platforms, some of which are managed, hosted, provided or used by third parties or their vendors, to assist in conducting our business.

Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place.

A third party with whom we work has experienced a security incident that affected us, and other such third parties may experience incidents that could affect us in the future.

In January 2025, Intelerad Medical Systems, a third party that provides CT scan transfer and storage services and PACS gateway connection services for our LungTraX Platform, notified us that it was affected by a security incident.

The vulnerability affected Intelerad’s vendor, SimpleHelp, which offers certain remote support services.

Our applications development and internal IT teams investigated the incident and concluded that it did not impact our account or the LungTraX network.

While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised.

Although we have implemented policies and procedures designed to ensure compliance with applicable data privacy and information security laws and regulations and we take measures to protect sensitive information from unauthorized access or disclosure, there can be no assurance that these measures will be effective.

We take steps designed to detect, mitigate, and remediate vulnerabilities in our IT systems (such as our hardware and/or software, including that of third parties with whom we work).

However, we have not in the past, and may not in the future, detect and remediate all such vulnerabilities including on a timely basis.

Unremediated high risk or critical vulnerabilities pose material risks to our business.

Further, we have in the past, and may in the future, experienced delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities.

Our IT and infrastructure, and other third parties, including technology partners and providers, face and may be vulnerable to a variety of evolving threats, including but not limited to social engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), ransomware attacks, software bugs, server malfunction, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fire,

flood, and other similar threats.

In addition to traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel misconduct or error (such as theft or misuse), sophisticated nation-state and nation-state supported actors now engage and are expected to continue to engage in cyberattacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities.

During times of war and other major conflicts, we and the third parties with whom we work may be vulnerable to a heightened risk of these attacks, including retaliatory cyberattacks that could materially disrupt our systems, operations and supply chain.

Ransomware attacks, including those perpetrated by organized criminal threat actors, nation-states, and nation-state supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds.

To alleviate the financial, operational and reputational impact of a ransomware attack, it may be preferable to make extortion payments, but we may be unwilling or unable to do so (including, for example, if applicable laws or regulations prohibit such payments).

Similarly, supply chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our platform, systems and networks or the systems and networks of third parties that support us and our services.

Although the aggregate impact of security incidents on our operations and financial condition has not been material to date, we have occasionally been the target of events of this nature and expect them to continue as security threats have been rapidly evolving in sophistication and becoming more prevalent in the industry.

For example, we have been the target of unsuccessful phishing attempts in the past and expect such attempts will continue in the future.

Additionally, the Company launched the LungTraX Platform in 2024 which will involve the processing of more patient PHI in the Company-managed system in our capacity as a Business Associate (as defined by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”)), the unintended release of which could have additional material adverse impacts on the Company financially and reputationally.

Advances in computer capabilities, new technological discoveries or other developments may result in cyberattacks becoming more sophisticated and more difficult to detect.

We and our third-party service providers may not have the resources or technical sophistication to anticipate or prevent all such cyberattacks.

Moreover, techniques used to obtain unauthorized access to systems or other information technology infrastructure change frequently and may not be detected until after an incident has occurred.

We are investing in protections and monitoring practices related to our data and IT to reduce these risks and continue to monitor our systems on an ongoing basis for any current or potential threats.

However, it may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident.

Our efforts to do so may not be successful.

Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business.

Threat actors may also gain access to other networks and systems after a compromise of our networks and systems.

We may expend significant resources or modify our business activities (including our clinical trial activities) to try to protect against security incidents.

Certain data privacy and information security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information.

We cannot assure you that our efforts will prevent breakdowns or breaches to our or our third-party providers’ databases or systems, and such breakdowns and breaches could negatively affect our business, financial condition and results of operations and our reputation.

We or the third parties with whom we work have in the past experienced, and may in the future experience, security incidents, or we may be perceived to have experienced, security incidents, we may experience material adverse consequences such as:

government enforcement actions that could include investigations, fines, penalties, consent decrees, audits and inspections;

additional reporting requirements and/or oversight;

temporary or permanent bans on all or some processing of personal data;

or orders to destroy or not use personal data.

Applicable data privacy and information security obligations may require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors of security incidents.

Such disclosures and related actions can be costly, and the disclosures or the failure to comply with such applicable requirements, could lead to adverse consequences.

Further, individuals or other relevant stakeholders could sue us for our actual or

perceived failure to comply with our security obligations, including, without limitation, in class action litigation.

Security incidents could also result in indemnity obligations, negative publicity and financial loss.

Security incidents and attendant consequences may cause some of our customers and users to stop using our services and our failure, or perceived failure, to meet expectations with regard to the security, integrity, availability and confidentiality of our systems and sensitive data could damage our reputation and affect our ability to retain customers, attract new customers and grow our business.

Any of these results could harm our growth prospects, our business and our reputation.

Moreover, security incidents can result in the diversion of funds, and interruptions, delays, or outages in our operations and services, including due to ransomware attacks.

Failures or significant downtime of our information technology or telecommunication systems or those used by our third-party service providers could cause significant interruptions to our operations and adversely impact the confidentiality, integrity and availability of sensitive, proprietary or confidential information, and prevent us from administering our business.

There can be no assurance that limitations of liability in our contracts are sufficient or adequate enough to protect us from liabilities, damages, or claims related to our security obligations.

We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.

In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

Additionally, sensitive information of the Company could be leaked, disclosed, or revealed as a result of or in connection with our employees’, personnel’s, or vendors’ use of generative artificial intelligence (“AI”) technologies.

Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies.

Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.

The reliability and continuous availability of our LungTraX Platform is critical to our success.

However, software such as ours, or that of third parties that we utilize within the LungTraX Platform, can contain errors, defects, security vulnerabilities or software bugs that are difficult to detect and correct, particularly when such vulnerabilities are first introduced or when new versions or enhancements of our platform are released.

The LungTraX Platform is a new service for us and we have limited experience installing and managing this platform and the services that we render though this platform.

Additionally, even if we are able to develop a patch or other fix to address such vulnerabilities, such fix may be difficult to push out to our customers or may otherwise be delayed.

Additionally, our business depends upon the appropriate and successful implementation of our platform by our customers.

If our customers fail to use our platform according to our specifications, our customers may suffer a security incident on their own systems or other adverse consequences.

Even if such an incident is unrelated to our security practices, it could result in our incurring of significant economic and operational costs in investigating, remediating, and implementing additional measures to further protect our customers from their own vulnerabilities, and could result in reputational harm.

Our results of operations will be materially harmed if we are unable to accurately forecast customer demand for our solution and manage our inventory.

1 unchanged sentence

Our ability to accurately forecast demand for our solution could be negatively affected by many factors, including our failure to accurately manage our expansion strategy, product introductions by competitors, an increase or decrease in customer demand for our solution or for products of our competitors, our failure to accurately forecast customer acceptance of new products, unanticipated changes in general market conditions or regulatory matters and weakening of economic conditions or consumer confidence in future economic conditions.

Inventory levels in excess of customer demand may result in inventory write-downs or write-offs, which would cause our gross margin to be adversely affected and could impair the strength of our brand.

Inventory levels in excess of customer demand may result in

inventory write-downs or write-offs, which would cause our gross margin to be adversely affected and could impair the strength of our brand.

Conversely, if we underestimate customer demand for our solution, our internal manufacturing team may not be able to deliver products to meet our requirements, and this could result in damage to our reputation and customer relationships.

In addition, if we experience a significant increase in demand, additional supplies of raw materials or additional manufacturing capacity may not be available when required on terms that are

acceptable to us, or at all, or suppliers or may not be able to allocate sufficient capacity in order to meet our increased requirements, which will negatively affect our business, financial condition and results of operations.

In addition, if we experience a significant increase in demand, additional supplies of raw materials or additional manufacturing capacity may not be available when required on terms that are acceptable to us, or at all, or suppliers or may not be able to allocate sufficient capacity in order to meet our increased requirements, which will negatively affect our business, financial condition and results of operations.

We seek to maintain sufficient levels of inventory in order to protect ourselves from supply interruptions.

18 unchanged sentences

• seasonality, including possible seasonal slowing of demand for our products in the beginning and end of the year and summer months based on the elective nature of procedures performed using our products, and which may become more pronounced in the future as our business grows;

• the impact of a public health crisis, such as a resurgence of COVID-19 infections, on our business, financial condition and results of operations;

• the impact of a public health crisis on our business, financial condition and results of operations;

• the timing and cost of, and level of investment in, research, development, licenses, regulatory approval, commercialization activities, acquisitions and other strategic transactions, or other significant events relating to our products, which may change from time to time;

17 unchanged sentences

The overall rate of smoking among the U.S.

adult population has been steadily declining from 42.4% in 1965 to a record low of 13.7% in 2018 and there are increased efforts to decrease the rate of smoking globally.

adult population

has been steadily declining from 42.4% in 1965 to 11.6% in 2022 and there are increased efforts to decrease the rate of smoking globally.

If the overall rate of smokers continues to decline, this may eventually decrease the number of patients suffering from COPD and emphysema and, accordingly, who would benefit from our solution.

If the actual number of patients who would benefit from our solution, the price at which we can sell future products, or the annual total addressable market for our solution is smaller than we have estimated, it may impair our sales growth and negatively affect our business, financial condition and results of operations.

Failure of an information technology system, process, or site could negatively affect our business, financial condition and results of operations.

Failure of our information technology system, process, or site, or those of the third parties with whom we work, could negatively affect our business, financial condition and results of operations.

We depend on our information technology systems for the efficient functioning of our business, including the manufacture, distribution, and maintenance of our products, as well as for accounting, data storage, compliance, purchasing, and inventory management.

We also depend on the information technology systems of third parties for the analysis, data storage, and communication associated with the StratX Platform.

We currently do not have redundant information technology systems.

Our information technology systems, and those of third parties, may be subject to computer viruses, ransomware or other malware, attacks by computer hackers, failures during the process of upgrading or replacing software, databases or components thereof, power outages, damage or interruption from fires or other natural disasters, hardware failures, telecommunication failures and user errors, among other malfunctions.

We, or the third parties we rely upon, could be subject to an unintentional event that involves a third party gaining unauthorized access to our or its systems, which could disrupt our operations, corrupt our data or result in release of our confidential information.

We also depend on the information technology systems of third parties for the analysis, data storage, and communication associated with the LungTraX Platform.

Our information technology systems, and those of the third parties with whom we work, have in the past been subject to and may in the future be subject to, or we may be perceived as having been subject to, security incidents.

These security incidents may include computer viruses, ransomware or other malware, attacks by computer hackers, failures during the process of upgrading or replacing software, databases or components thereof, power outages, damage or interruption from fires or other natural disasters, hardware failures, telecommunication failures and user errors, among other malfunctions.

We, and the third parties we rely upon, have in the past been subject to and may in the future be subject to an unintentional event that involves a third party gaining unauthorized access to our or our third parties’ systems, which could disrupt our operations, corrupt our data or result in release of our sensitive information.

Technological interruptions could disrupt our operations, including our ability to timely ship and track product orders, project inventory requirements, manage our supply chain and otherwise adequately service our customers or disrupt our customers’ ability use our products for treatments.

Moreover, a disruption in access to the system that controls the StratX Platform would prevent physicians using our solution from receiving the StratX Lung Report indicating whether their patients are good candidates for the Zephyr Valve.

Moreover, a disruption in access to the system that controls the LungTraX Platform would prevent physicians using our solution from receiving the StratX Lung Report indicating whether their patients are good candidates for the Zephyr Valve.

In the event we experience significant disruptions, we may be unable to repair our systems in an efficient and timely manner.

7 unchanged sentences

Claims may also be asserted by or on behalf of a variety of other parties, including government agencies, patients or vendors of our customers, or stockholders.

For example, our Swiss subsidiary is currently party to a lawsuit with a former distributor outside the United States alleging that our Swiss subsidiary conducted unfair competitive practices and violated the exclusive distribution rights as a result of its termination of its distribution agreement.

Our Swiss subsidiary is also currently party to a lawsuit with a former distributor outside the United States alleging that our Swiss subsidiary terminated the agreement without proper compensation.

While we believe these claims are meritless and, if successful, we do not believe the impact of such claims will be material to the Company’s results of operations or financial position, an unfavorable outcome in this litigation could harm our business.

Further, in the past, securities class action litigation has often been brought against a company following a decline in the market price of its securities, and this risk is especially relevant to industries that experience significant stock price volatility.

29 unchanged sentences

If we are unable to obtain insurance at an acceptable cost or on acceptable terms or otherwise protect against potential product liability claims, we could be exposed to significant liabilities.

A product liability claim, recall or other claim with respect to uninsured liabilities or for amounts in excess of insured liabilities could negatively affect our business, financial condition and results of operations.

We do not carry specific hazardous waste insurance coverage, and our property, casualty and general liability insurance policies specifically exclude

coverage for damages and fines arising from hazardous waste exposure or contamination.

A product liability claim,

recall or other claim with respect to uninsured liabilities or for amounts in excess of insured liabilities could negatively affect our business, financial condition and results of operations.

We do not carry specific hazardous waste insurance coverage, and our property, casualty and general liability insurance policies specifically exclude coverage for damages and fines arising from hazardous waste exposure or contamination.

Accordingly, in the event of contamination or injury, we could be held liable for damages or be penalized with fines in an amount exceeding our resources, and our clinical trials or regulatory approvals could be suspended.

Additionally, we do not carry cyber insurance, which may expose us to certain potential losses for damages or result in penalization with fines in an amount exceeding our resources.

Currently, we carry business cyber insurance to mitigate certain potential losses but this insurance is limited in amount, and we cannot be certain that such potential losses will not exceed our policy limits, which may expose us to certain potential losses for damages or result in penalization with fines in an amount exceeding our resources.

We also expect that operating as a public company will make it more difficult and more expensive for us to obtain director and officer liability insurance, and we may be required to accept reduced policy limits and coverage or incur substantially higher costs to obtain the same or similar coverage.

27 unchanged sentences

Our industry is subject to rapid change from the introduction of new products and technologies and other activities of industry participants.

There are a range of pharmaceutical and biologic agents on the market to manage COPD and emphysema symptoms.

New product introductions may lead some patients to become less symptomatic and no longer seek additional treatment or may delay referrals as physicians attempt an additional drug treatment before referring for a procedure.

Our goal is to establish our solution as a standard of care for severe emphysema.

Existing treatments include medical management, LVRS, lung transplantation as well as other minimally invasive treatments.

The major competitive products include the Spiration Valve System (Olympus Corporation) and the InterVapor System (Broncus Medical, Inc.;

The primary competitive products include the Spiration Valve System (Olympus Corporation) and the InterVapor System (Broncus Medical, Inc.;

not approved for use in the United States).

10 unchanged sentences

Our competitors may seek to discredit our products by challenging our short operating history or relatively limited number of scientific studies and publications.

Smaller companies could also launch new or enhanced products and services that we do not offer and that could gain market acceptance quickly.

Smaller companies could also launch new or enhanced products and services that

we do not offer and that could gain market acceptance quickly.

Additionally, certain of our competitors may challenge our intellectual property, may develop additional competing or superior technologies and processes and compete more aggressively and sustain that competition over a longer period of time than we could.

4 unchanged sentences

Any growth that we experience in the future will require us to expand our sales personnel and manufacturing operations and general and administrative infrastructure.

As a public company, we will need to support managerial, operational, financial and other resources.

In addition to the need to scale our organization, future growth will impose significant added responsibilities on management, including the need to identify, recruit, train and integrate additional employees.

Future growth will impose significant added responsibilities on management, including the need to identify, recruit, train and integrate additional employees.

Rapid expansion in personnel could mean that less experienced people manufacture, market and sell our solution, which could result in inefficiencies and unanticipated costs, reduced quality and disruptions to our operations.

19 unchanged sentences

We also expect to continue to make investments in research and development, regulatory affairs and clinical studies to develop future generations of our solution, broaden the addressable market and expand indications, support regulatory submissions and demonstrate the clinical efficacy of our solution.

We continue to make progress

with our CONVERT II pivotal trial of the AeriSeal System, a potential product in development for the treatment of severe emphysema patients who are not qualified for Zephyr Valve treatment due to excessive collateral ventilation.

Moreover, we expect to incur additional expenses associated with operating as a public company, including legal, accounting, insurance, exchange listing and Securities and Exchange Commission (“SEC”) compliance, investor relations and other expenses.

9 unchanged sentences

• the extent to which we acquire or invest in businesses, products or technologies, although we currently have no commitments or agreements relating to any of these types of transactions;

• the impact of public health crises, such as a resurgence of COVID-19 infections, on our business, financial condition, and results of operations.

We will require additional financing to fund working capital and pay our obligations.

• the impact of public health crises on our business, financial condition, and results of operations.

We may require additional financing to fund working capital and pay our obligations.

We may seek to raise any necessary additional capital through a combination of public or private equity offerings or debt financings.

15 unchanged sentences

Our facilities, equipment and inventory would be costly to replace and could require substantial lead time to repair or replace.

The facilities will be harmed or rendered inoperable by natural or man-made disasters, including, but not limited to, earthquakes, flooding, fire and power outages, which may render it difficult or

impossible for us to perform our research, development and commercialization activities for some period of time.

The facilities will be harmed or rendered inoperable by natural or man-made disasters, including, but not limited to, earthquakes, flooding, fire and power outages, which may render it difficult or impossible for us to perform our research, development and commercialization activities for some period of time.

The inability to perform those activities, combined with the time it may take to rebuild our manufacturing capabilities, inventory of finished product, may result in the loss of customers or harm to our reputation.

10 unchanged sentences

From time to time, there have been and may in the future be changes in our management team or other key employees resulting from the hiring or departure of these personnel.

For example, in March 2024, Glendon French retired as the President and Chief Executive Officer of the Company.

Our board of directors appointed Steven Williamson as our President and Chief Executive Officer and as a member of our board of directors.

Additionally, in April 2024, Mehul Joshi was appointed as Chief Financial Officer of the Company and John McKune, our Interim Chief Financial Officer, returned to his prior position as the Company’s Vice President Finance and Corporate Controller.

The failure to successfully execute this leadership transition could negatively impact our business and results of operations.

Although we have entered into employment letter agreements with our executive officers, each of them may terminate their employment with us at any time.

3 unchanged sentences

We may not be able to attract or retain qualified engineers and medical researchers in the future due to the competition for qualified personnel.

We have from time to time experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications.

We have from time to time experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate

qualifications.

Many of the companies with which we compete for experienced personnel have greater resources than us.

7 unchanged sentences

We have significant international operations, and to successfully market and sell our products in such international markets we must address international business risks with which we have limited experience.

Sales in markets outside of the United States accounted for approximately 33.1% and 39.5% of our revenue for the years ended December 31, 2023 and 2022, respectively.

Sales in markets outside of the United States accounted for approximately 32.6% and 33.1% of our revenue for the years ended December 31, 2024 and December 31, 2023, respectively.

We currently focus our international sales and marketing efforts in Australia, Austria, Belgium, China, Denmark, France, Germany, Ireland, Italy, Japan, the Netherlands, South Korea, Spain, Switzerland and the United Kingdom.

10 unchanged sentences

• political, social, and economic instability abroad, including as a result of armed conflict, war or the threat of war, terrorist activity and other security concerns in general;

• the impact of public health crises, such as a resurgence of COVID-19 infections;

• the impact of public health crises;

• preference for locally produced products;

3 unchanged sentences

• increased financial accounting and reporting burdens and complexities.

A public health crisis, such as a resurgence of COVID-19 infections, could adversely affect the economies and financial markets worldwide, resulting in an economic downturn that could affect demand for our products and impact our business, financial condition and results of operations.

A public health crisis could adversely affect the economies and financial markets worldwide, resulting in an economic downturn that could affect demand for our products and impact our business, financial condition and results of operations.

If one or more of these risks are realized, they may negatively affect our business, financial condition and results of operations.

If our information technology systems or data, or those third parties upon which we rely, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited

to, interruptions to our operations such as our clinical trials, claims that we breached our data protection obligations, harm to our reputation, and a loss of customers or sales.

In the ordinary course of business, we or the third parties upon whom we rely, collect, store, receive, generate, use, transfer, disclose, make accessible, protect, secure, dispose of or transmit (collectively, “process”) proprietary, confidential, and sensitive data (including but not limited to intellectual property, proprietary business information and personal data).

Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place.

We take steps designed to detect, mitigate, and remediate vulnerabilities in our IT systems (such as our hardware and/or software, including that of third parties upon which we rely).

We may not, however, detect and remediate all such vulnerabilities including on a timely basis.

Unremediated high risk or critical vulnerabilities pose material risks to our business.

Further, we may experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities.

Our IT and infrastructure, and other third parties, including technology partners and providers, may be vulnerable to a variety of evolving threats, including but not limited to social engineering attacks (including through phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), ransomware attacks, software bugs, server malfunction, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fire, flood, and other similar threats.

During times of war and other major conflicts, we and the third parties upon whom we rely may be vulnerable to a heightened risk of these attacks, including retaliatory cyberattacks that could materially disrupt our systems, operations and supply chain.

Advances in computer capabilities, new technological discoveries or other developments may result in cyberattacks becoming more sophisticated and more difficult to detect.

We and our third-party service providers may not have the resources or technical sophistication to anticipate or prevent all such cyberattacks.

Moreover, techniques used to obtain

unauthorized access to systems or other information technology infrastructure change frequently and may not be detected until after an incident has occurred.

We are investing in protections and monitoring practices related to our data and IT to reduce these risks and continue to monitor our systems on an ongoing basis for any current or potential threats.

We cannot assure you, however, that our efforts will prevent breakdowns or breaches to our or our third-party providers’ databases or systems, and such breakdowns and breaches could negatively affect our business, financial condition and results of operations and our reputation.

If we or our third-party service providers experience, or are perceived to have experienced, material security incidents, it may result in:

government enforcement actions that could include investigations, fines, penalties, consent decrees, audits and inspections;

additional reporting requirements and/or oversight;

temporary or permanent bans on all or some processing of personal data;

or orders to destroy or not use personal data.

Applicable data privacy and information security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors of security incidents.

Such disclosures are costly, and the disclosures or the failure to comply with such requirements, could lead to adverse impacts.

Further, individuals or other relevant stakeholders could sue us for our actual or perceived failure to comply with our security obligations, including, without limitation, in class action litigation.

Security incidents could also result in indemnity obligations, negative publicity and financial loss.

Security incidents and vulnerabilities may cause some of our customers and users to stop using our services and our failure, or perceived failure, to meet expectations with regard to the security, integrity, availability and confidentiality of our systems and sensitive data could damage our reputation and affect our ability to retain customers, attract new customers and grow our business.

Any of these results could harm our growth prospects, our business and our reputation.

Moreover, security incidents can result in the diversion of funds, and interruptions, delays, or outages in our operations and services, including due to ransomware attacks.

There can be no assurance that limitations of liability in our contracts are sufficient or adequate enough to protect us from liabilities, damages, or claims related to our security obligations.

We may enter into collaborations, in-licensing arrangements, joint ventures, strategic alliances or partnerships with third parties that may not result in the development of commercially viable products, product improvements or the generation of significant future revenues.

1 unchanged sentence

Proposing, negotiating and implementing collaborations, in-licensing arrangements, joint ventures, strategic alliances or partnerships may be a lengthy and complex process.

Other companies, including those with substantially greater financial, marketing, sales, technology or other business resources, may compete

with us for these opportunities or arrangements.

Other companies, including those with substantially greater financial, marketing, sales, technology or other business resources, may compete with us for these opportunities or arrangements.

We may not identify, secure, or complete any such transactions or arrangements in a timely manner, on a cost-effective basis, on acceptable terms or at all.

21 unchanged sentences

The pursuit of potential acquisitions may divert the attention of management and cause us to incur various costs and expenses in identifying, investigating and pursuing suitable acquisitions, whether or not they are consummated.

We may not be able to identify desirable acquisition targets or

be successful in entering into an agreement with any particular target or obtain the expected benefits of any acquisition or investment.

We may not be able to identify desirable acquisition targets or be successful in entering into an agreement with any particular target or obtain the expected benefits of any acquisition or investment.

We may not be able to successfully integrate acquired personnel, operations and technologies, or effectively manage the combined business following an acquisition.

7 unchanged sentences

If we fail to identify, acquire and develop other products, we may be unable to grow our business.

It is important to our business that we continue to enhance the Zephyr Valve, Chartis System and StratX Platform and develop and introduce new products.

It is important to our business that we continue to enhance the Zephyr Valve, Chartis System and LungTraX Platform and develop and introduce new products.

Developing products is expensive and time-consuming and could divert management’s attention away from our core business.

22 unchanged sentences

Foreign Corrupt Practices Act, as well as export control laws, customs laws, sanctions laws and other laws governing our operations.

If we fail to comply with these laws, we could be subject to civil or criminal penalties, other remedial measures and legal expenses, which could negatively affect our business, financial condition and results of operations.

If we fail to comply with these laws, we could be subject to civil or criminal penalties, other remedial

measures and legal expenses, which could negatively affect our business, financial condition and results of operations.

As we grow our international presence and global operations, we will be increasingly exposed to trade and economic sanctions and other restrictions imposed by the United States, the European Union and other governments and organizations.

6 unchanged sentences

A violation of these laws or regulations would negatively affect our business, financial condition and results of operations.

We are in the process of enhancing policies and procedures designed to ensure compliance by us and our directors, officers, employees, representatives, consultants and agents with the FCPA, OFAC restrictions, the Bribery Act and other export control, anti-corruption, anti-money-laundering and anti-terrorism laws and regulations.

assure you, however, that our policies and procedures are or will be sufficient or that directors, officers, employees, representatives, consultants and agents have not engaged and will not engage in conduct for which we may be held responsible, nor can we assure you that our business partners have not engaged and will not engage in conduct that could materially affect their ability to perform their contractual obligations to us or even result in our being held liable for such conduct.

We have various policies and procedures designed to ensure compliance by us and our directors, officers, employees, representatives, consultants and agents with the FCPA, OFAC restrictions, the Bribery Act and other export control, anti-corruption, anti-money-laundering and anti-terrorism laws and regulations.

We cannot assure you, however, that our policies and procedures are or will be sufficient or that directors, officers, employees, representatives, consultants and agents have not engaged and will not engage in conduct for which we may be held responsible, nor can we assure you that our business partners have not engaged and will not engage in conduct that could materially affect their ability to perform their contractual obligations to us or even result in our being held liable for such conduct.

Violations of the FCPA, OFAC restrictions, the Bribery Act or other export control, anti-corruption, anti-money laundering and anti-terrorism laws or regulations may result in severe criminal or civil sanctions, and we may be subject to other liabilities, which could negatively affect our business, financial condition and results of operations.

9 unchanged sentences

Future changes in our stock ownership, some of which might be beyond our control, could result in an ownership change under Section 382 of the Code.

For these reasons, in the event we experience a change of control, we may not be able to utilize a material portion of the NOLs, research and development credit carryforwards or disallowed interest expense carryovers, even if we attain profitability.

For these reasons,

in the event we experience a change of control, we may not be able to utilize a material portion of the NOLs, research and development credit carryforwards or disallowed interest expense carryovers, even if we attain profitability.

We may not be able to achieve or maintain satisfactory pricing and margins for our products.

8 unchanged sentences

Governmental regulation of the import or export of our products, or our failure to obtain any required import or export authorization for our products, when applicable, will harm our international sales and adversely affect our revenue.

Compliance with applicable regulatory requirements regarding the export of our products may create delays in the introduction of our products in international markets

or, in some cases, prevent the export of our products to some countries altogether.

Compliance with applicable regulatory requirements regarding the export of our products may create delays in the introduction of our products in international markets or, in some cases, prevent the export of our products to some countries altogether.

Furthermore, U.S.

3 unchanged sentences

Any decreased use of our products or limitation on our ability to export or sell access to our products would likely negatively affect our business, financial condition and results of operations.

Significant changes or developments in U.S.

and international laws or policies, including changes in U.S.

trade policies and tariffs and the reaction of other countries thereto, could have a material adverse effect on our business and financial condition.

From time to time, the U.S.

government has indicated a willingness to revise, renegotiate, or terminate various existing multilateral trade agreements and to impose new taxes and restrictions on certain goods imported into the U.S.

For example, the Trump administration has indicated various intentions to impose new tariffs on goods imported from China and on other U.S.

imports and make substantial changes to trade policies, which could result in the imposition of retaliatory tariffs on U.S.

exports in affected countries.

Because we rely on a global sourcing strategy and significant international sales, significant changes or developments in U.S.

and international laws and policies, such as laws and policies surrounding international trade, foreign affairs, manufacturing and development and investment in the territories and countries where we or our customers operate, could increase our costs, increase our customers’ costs and adversely impact our customers’ business and financial condition, make our products less competitive in the U.S.

and other markets affected by such actions, and materially adversely affect our business and financial condition.

Although the ultimate scope and timing of any such tariffs or changes to trade policies is indeterminable, if implemented, they could have a significant impact on our results of operations and financial condition.

Public health crises have in the past and may in the future have a material adverse impact on our business, financial condition and results of operations.

Public health crises and other events beyond our control, have in the past and may in the future have a material adverse impact on our business, financial condition and results of operations.

A public health crisis could significantly disrupt economic activity globally and have a material adverse impact our ability to access capital and on our business, financial condition and results of operations as a result of hospitals reducing capital and overall spend and other potential changes in healthcare organizations’ prioritizing of patient treatment, significant job losses and unemployment, including the inability of patients to obtain or maintain health insurance policies, inflation, and reductions in disposable income.

Potential natural disasters could damage, destroy or disrupt clinical study sites, our office spaces, manufacturing facilities, and/or warehouses, which could have a significant negative impact on our operations.

We are vulnerable to the increasing impact of climate change and other natural disasters.

Volatile changes in weather conditions, including extreme heat or cold, could increase the risk of wildfires, floods, blizzards, hurricanes and other weather-related disasters.

Such extreme weather events, or other natural disasters such as earthquakes, can cause power outages and network disruptions that may result in disruption to operations and may impact our ability to continue or complete our clinical studies, which will negatively impact our operations and delay our plans to commercialize our product candidates.

They could also cause significant damage to or destruction of our clinical study sites resulting in temporary or long-term closures of these facilities.

Such disasters could also result in loss or damage to office buildings, manufacturing facilities, employee and/or patient homes, employees and/or patients relocating to other parts of the country or being unwilling to travel to the clinical study site locations, and the inability to recruit key employees and/or enroll patients.

This could result in adverse impacts to the available workforce and/or patients, damage to or destruction of materials and/or data, or the inability to conduct clinical studies and deliver new data.

Risks Related to Government Regulation and Our Industry

1 unchanged sentence

If we fail to obtain and maintain necessary regulatory approvals for the Zephyr Valve and related products, or if approvals for future products and indications are delayed or not issued, it will negatively affect our business, financial condition and results of operations.

The Zephyr Valve is subject to extensive regulation by the FDA in the United States and comparable foreign regulatory authorities abroad.

The Zephyr Valve, and any other medical device products for which we obtain the necessary approvals are subject to extensive regulation by the FDA in the United States and comparable foreign regulatory authorities abroad.

Regulations specific to medical devices are wide ranging and govern, among other things:

12 unchanged sentences

Furthermore, even if we are granted regulatory clearances, certification or approvals, they may include significant limitations on the indicated uses for the product, which may limit the market for the product.

Although we have obtained PMA approval and CE marked our product after obtaining related CE Certificates of Conformity to market the Zephyr Valve, our approval can be revoked if safety or efficacy problems develop.

Although we have obtained PMA approval and CE marked our product after obtaining related CE Certificates of Conformity to market the Zephyr Valve, the AeriSeal System, the Chartis Catheter and the Chartis Console, our approval and CE Certificates of Conformity can be revoked if safety or efficacy problems develop.

The FDA, comparable foreign regulatory authorities and Notified Bodies can delay, limit or deny clearance, certification or approval of a device for many reasons, including:

34 unchanged sentences

In addition to changes to the regulatory environment in the United States, there have been changes to the regulatory environment in certain foreign jurisdiction in which we operate.

For example, the MDR became applicable in 2021 and includes transitional provisions.

We are currently placing our medical devices on the market in accordance with the stringent requirements of the transitional provisions of the MDR, the requirements of the MDD and the guidance of the European Commission’s Medical Devices Coordination Group.

We intend to complete conformity assessment procedures for our medical devices in accordance with the MDR prior to the expiration of our existing CE Certificate(s) of Conformity issued by our Notified Body BSI on the basis of the MDD, and the expiration of the transitional provisions of the MDR.

The changes to the regulatory system implemented in the EU by the MDR include stricter requirements for clinical evidence and pre-market assessment of safety and performance, new classifications to indicate risk levels, requirements for third party testing by Notified Bodies, tightened and streamlined quality management system assessment procedures and additional requirements for the quality management system, additional requirements for traceability of products and transparency as well a refined responsibility of economic operators.

For example, the European Union Medical Device Regulation (Regulation (EU) 2017/745) (“MDR”) became applicable in 2021 and includes transitional provisions that have been subject to multiple amendments.

We are currently placing our medical devices on the market in accordance with the requirements of the MDR, including the stringent requirements of the transitional provisions of the MDR which, among other conditions require continuous compliance with the requirements of the European Union Medical Devices Directive (Council Directive 93/42/EEC) (“MDD”) and the guidance of the European Commission’s Medical Devices Coordination Group.

For those devices that we place on the market in the EU on the basis of the transitional provisions of the MDR, we intend to complete conformity assessment procedures for such medical devices in accordance with the MDR prior to the expiration of our existing CE Certificate(s) of Conformity issued by our Notified Body, BSI, issued on the basis of the MDD, in accordance with the transitional provisions of the MDR.

The changes to the regulatory system implemented in the EU by the MDR include stricter requirements

for clinical evidence and pre-market assessment of safety and performance, new classifications to indicate risk levels, requirements for third party testing by Notified Bodies, tightened and streamlined quality management system assessment procedures and additional requirements for the quality management system, additional requirements for traceability of products and transparency as well a refined responsibility of economic operators.

We are also required to provide clinical data in the form of a clinical evaluation report.

10 unchanged sentences

For example, over the last several years, including for 35 days beginning on December 22, 2018, the U.S.

government has shut

down several times and certain regulatory agencies, such as the FDA, have had to furlough critical FDA employees and stop critical activities.

government has shut down several times and certain regulatory agencies, such as the FDA, have had to furlough critical FDA employees and stop critical activities.

If a prolonged government shutdown occurs, or if global health concerns prevent the FDA or other regulatory authorities from conducting business as usual or conducting inspections, reviews or other regulatory activities, it could significantly impact the ability of the FDA to timely review and process our regulatory submissions, which could have a material adverse effect on our business.

27 unchanged sentences

• federal criminal laws that prohibit executing a scheme to defraud any healthcare benefit program or making false statements relating to healthcare matters;

• the federal Physician Payments Sunshine Act, created under the Patient Protection and Affordable Care Act, as amended by the Health Care and Education Reconciliation Act of 2010 (collectively, the “Affordable Care Act”) and its implementing regulations, which requires certain manufacturers of drugs, medical devices, biologicals and medical supplies for which payment is available under Medicare, Medicaid, or the Children’s Health Insurance Program to report annually to CMS, information related to payments or other transfers of value made to physicians (defined to include doctors, dentists, optometrists, podiatrists and chiropractors), other health care professionals (such as physician assistants and nurse practitioners) and teaching hospitals, as well as information regarding ownership and investment interests held by physicians and their immediate family members;

Medicaid, or the Children’s Health Insurance Program to report annually to CMS, information related to payments or other transfers of value made to physicians (defined to include doctors, dentists, optometrists, podiatrists and chiropractors), other health care professionals (such as physician assistants and nurse practitioners) and teaching hospitals, as well as information regarding ownership and investment interests held by physicians and their immediate family members;

• federal consumer protection and unfair competition laws, which broadly regulate marketplace activities and activities that potentially harm consumers;

• the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and its implementing regulations, which impose certain requirements relating to the privacy, security and transmission of individually identifiable health information on covered entities, including certain healthcare providers, health plans and healthcare clearinghouses, and their respective business associates that create, receive, maintain or transmit individually identifiable health information for or on behalf of a covered entity as well as their covered subcontractors;

• HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and its implementing regulations, which impose certain requirements relating to the privacy, security and transmission of individually identifiable health information on covered entities, including certain healthcare providers, health plans and healthcare clearinghouses, and their respective Business Associates that create, receive, maintain or transmit individually identifiable health information for or on behalf of a Covered Entity as well as their covered subcontractors;

HIPAA also created criminal liability for, among other things, knowingly and willfully falsifying or concealing a material fact or making a materially false statement in connection with the delivery of or payment for healthcare benefits, items or services;

3 unchanged sentences

• state law equivalents of each of the above federal laws, such as anti-kickback and false claims laws which may apply to items or services reimbursed by any third-party payor, including commercial insurers, and state and foreign laws governing the privacy and security of health information in certain circumstances, many of which differ from each other in significant ways and often are not preempted by HIPAA, thus complicating compliance efforts;

• similar healthcare laws and regulations in the European Union, the UK and other jurisdictions, including national anti-bribery laws of European countries and national rules, regulations, industry self-regulation codes reporting requirements detailing interactions with and payments to healthcare providers and laws governing the privacy and security of certain protected information, such as personal data under the GDPR.

The Affordable Care Act was enacted in 2010.

5 unchanged sentences

Additionally, as a result of these investigations, healthcare providers and entities may have to agree to additional compliance and reporting requirements as part of a consent decree or corporate integrity agreement.

Any such investigation or settlement could increase our costs or otherwise negatively affect our business, financial condition and results of operations.

Any such investigation or settlement

could increase our costs or otherwise negatively affect our business, financial condition and results of operations.

Even an unsuccessful challenge or investigation into our practices could cause adverse publicity and be costly to respond to.

9 unchanged sentences

Any action brought against us for violation of these or other laws or regulations, even if we successfully defend against it, could cause us to incur significant legal expenses and divert our management’s attention from the operation of our business.

If our operations are found to be in violation of any of the federal, state and foreign laws described above or any other current or future fraud and abuse or other healthcare laws and regulations that apply to us, we may be subject to significant penalties, including significant criminal, civil, and administrative penalties, damages, fines, imprisonment for individuals, additional oversight and reporting obligations, exclusion from participation in government programs,

such as Medicare and Medicaid, or comparable foreign programs, imprisonment, contractual damages, reputation harm and disgorgement and we could be required to curtail or cease our operations.

Any of the foregoing consequences will negatively affect our business, financial condition and results of operations.

8 unchanged sentences

For those medical devices sold in the EU and for which we have obtained a CE Certificate of Conformity by a Notified Body, we must notify our Notified Body if significant changes are made to the devices or if there are substantial changes to our quality assurance systems affecting those products.

In addition, if we make any substantial changes to medical devices for which we have obtained a CE Certificate of Conformity on the basis of the MDD and which we continue to place on the EU market on the basis of the transitional provisions of the MDR, we will no longer be able to benefit from the transitional provisions of the MDR.

longer be able to benefit from the transitional provisions of the MDR.

Substantial changes to such devices will trigger immediate compliance with the full regulatory framework of the MDR.

6 unchanged sentences

Following its review of the periodic reports, the FDA might ask for additional information or initiate further investigation.

In addition, the PMA approval for the Zephyr Valve was subject to several conditions of approval, including extended follow-up of the pre-market study cohort and post market study.

Though we believe we have complied with these conditions to date, any failure to comply with the conditions of approval could result in the withdrawal of PMA approval and the inability to continue to market the device.

Failure to conduct the required studies in accordance with Institutional Review Board (“IRB”) and informed consent requirements, or adverse findings in these studies, could also be grounds for withdrawal of approval of the PMA.

In the EU, the MDR also imposes strict post-market regulatory requirements which are also applicable to those devices for which we have obtained a CE Certificate of Conformity on the basis of the MDD and which we continue to place on the EU market on the basis of the transitional provisions of the MDR.

In the EU, the MDR imposes strict post-market regulatory requirements which are also applicable to those devices for which we have obtained a CE Certificate of Conformity on the basis of the MDD and which we continue to place on the EU market on the basis of the transitional provisions of the MDR.

The regulations to which we are subject are complex and have become more stringent over time.

6 unchanged sentences

If treatment guidelines change so that different treatments become desirable, the clinical utility of one or more of our products could be diminished and will negatively affect our business, financial condition and results of operations.

If we or our suppliers fail to comply with the FDA’s QSR or the European Union Medical Devices Regulation, our manufacturing or distribution operations could be delayed or shut down and our revenue could suffer.

Our manufacturing and design processes and those of our third-party suppliers are required to comply with the FDA’s QSR and the European Union MDR, including Quality Management System requirements, both of which cover procedures and documentation of the design, testing, production, control, quality assurance, labeling, packaging, storage and shipping of Zephyr Valves.

We are also subject to similar state requirements and licenses, and comply with ongoing International Organization for Standardization (“ISO”) in all operations, including design, manufacturing, and service, to maintain our CE Mark.

If we or our suppliers fail to comply with the FDA’s QSR or the European Union MDR, our manufacturing or distribution operations could be delayed or shut down and our revenue could suffer.

In addition, we must engage in extensive recordkeeping and reporting and must make available our facilities and records for periodic unannounced inspections by governmental agencies, including the FDA, state authorities, competent authorities of EU Member States, European Union Notified Bodies and comparable authorities in other countries.

If we fail a regulatory inspection, our operations could be disrupted and our manufacturing interrupted.

If we fail a regulatory inspection, our operations could be disrupted and our

manufacturing interrupted.

Failure to take adequate corrective action in response to an adverse regulatory inspection could result in, among other things, a shutdown of our manufacturing or product distribution operations, significant fines, suspension of marketing clearances, certification and approvals, seizures or recalls of our device, operating restrictions and criminal prosecutions, any of which would negatively affect our business, financial condition and results of operations.

4 unchanged sentences

We believe that we are in compliance, in all material respects, with the QSR.

We also maintain CE Certificate of Conformity for the design and manufacture of our products issued by BSI in the Netherlands, our European Notified Body, in accordance with the MDD and MDR, as applicable to our products.

We also maintain a CE Certificate of Conformity in accordance with the MDD and a separate CE Certificate of Conformity in according with the MDR for the design and manufacture of our products issued by BSI in the Netherlands, our European Notified Body.

We believe that we are in compliance, in all material respects, with the MDD and MDR, as applicable to our products.

1 unchanged sentence

If the FDA, CDPH, BSI or competent authorities of EU Member States inspect any of our facilities and discover compliance problems, we may have to cease manufacturing and product distribution until we can take the appropriate remedial steps to correct the audit findings.

Taking corrective action may be expensive,

time consuming and a distraction for management and if we experience a delay at our manufacturing facility, we may be unable to produce our solutions, which will negatively affect our business, financial condition and results of operations.

Taking corrective action may be expensive, time consuming and a distraction for management and if we experience a delay at our manufacturing facility, we may be unable to produce our solutions, which will negatively affect our business, financial condition and results of operations.

The misuse or off-label use of our solution will harm our image in the marketplace, result in injuries that lead to product liability suits or result in costly investigations and sanctions by regulatory bodies if we are deemed to have engaged in the promotion of these uses, any of which will negatively affect our business, financial condition and results of operations.

18 unchanged sentences

Although our policy is to refrain from statements that could be considered off-label promotion of our products, the FDA or another regulatory authority could disagree and conclude that we have engaged in off-label promotion.

It is also possible that other federal, state or foreign enforcement authorities might take action, such as federal prosecution under the FCA, if they consider our business activities constitute promotion of an off-label use, which could result in significant penalties, including, but not limited to, criminal, civil or administrative penalties, damages, fines, disgorgement, exclusion from participation in government healthcare programs, additional reporting requirements and oversight if we become subject to a

corporate integrity agreement or similar agreement to resolve allegations of non-compliance with these laws, and the curtailment or restructuring of our operations.

In addition, the off-label use of our products may increase the risk of product liability claims.

2 unchanged sentences

If clinical studies of our future products do not produce results necessary to support regulatory clearance, certification or approval in the United States or, with respect to our current or future products, elsewhere, we will be unable to expand the indications for or commercialize these products and may incur additional costs or experience delays in completing, or ultimately be unable to complete, the commercialization of those products.

We have obtained PMA approval for the Zephyr Valve.

We have obtained PMA approval and a CE Certificate of Conformity for the Zephyr Valve in accordance with the MDD.

Additionally, we have received a CE Certification of Conformity for the AeriSeal System in accordance with the MDD and we are currently conducting a global clinical trial designed to support PMA approval for the AeriSeal System.

We have also obtained a CE Certificate of Conformity in accordance with the MDR for the Chartis Catheter and the Chartis Console.

In order to obtain PMA approval for a device, the sponsor must conduct well-controlled clinical trials designed to assess the safety and efficacy of the product candidate.

6 unchanged sentences

Successful results of pre-clinical studies are not necessarily indicative of future clinical trial results, and predecessor clinical trial results may not be replicated in subsequent clinical trials.

Additionally, the FDA or comparable foreign regulatory authorities may disagree with our interpretation of the data from our pre-clinical studies and clinical trials, or may find the clinical trial design, conduct or results inadequate to prove safety or efficacy, and may require us to pursue additional pre-clinical studies or clinical trials, which could further delay the clearance, certification or approval of our products.

approval of our products.

The data we collect from our pre-clinical studies and clinical trials may not be sufficient to support FDA or comparable foreign regulatory authority clearance or approval, or certification, and if we are unable to demonstrate the safety and efficacy of our future products in our clinical trials, we will be unable to obtain regulatory clearance, certification or approval to market our products.

34 unchanged sentences

In addition, patients participating in our clinical trials may drop out before completion of the trial or experience adverse medical events unrelated to our products.

Delays in patient enrollment or failure of patients to continue to participate in a clinical trial may delay commencement or completion of the clinical trial, cause an increase in the costs of the clinical trial and delays, or result in the failure of the clinical trial.

Delays in patient enrollment or failure of patients to continue to participate in any of our clinical trials may delay commencement or completion of the clinical trial, cause an increase in the costs of the clinical trial and delays, or result in the failure of the clinical trial.

Clinical trials must be conducted in accordance with the laws and regulations of the FDA and other applicable regulatory authorities’ legal requirements, regulations or guidelines, and are subject to oversight by these governmental authorities and IRBs or ethics committees at the medical institutions where the clinical trials are conducted.

3 unchanged sentences

To the extent our collaborators or the CROs fail to enroll participants for our clinical trials, fail to conduct the study to GCP standards or are delayed for a significant time in the execution of trials, including achieving full enrollment, we may be affected by increased costs, program delays or both.

In addition, clinical trials that are conducted in countries outside the United States may subject us to further delays and expenses as a result of increased shipment costs, additional regulatory requirements and the engagement of non-U.S.

In addition, clinical trials that are conducted in countries outside the United States may subject us to further delays and expenses as a result of increased shipment costs, additional regulatory

requirements and the engagement of non-U.S.

CROs, as well as expose us to risks associated with clinical investigators who are unknown to the FDA, and different standards of diagnosis, screening and medical care.

9 unchanged sentences

If we initiate a correction or removal for the Zephyr Valve to reduce a risk to health posed by it, we would be required to submit a publicly available correction and removal report to the FDA and, in many cases, similar reports to other regulatory authorities.

This report could be classified by the FDA or comparable foreign regulatory

authorities as a device recall which could lead to increased scrutiny by the FDA, other foreign regulatory authorities and our customers regarding the quality and safety of our solutions.

This report could be classified by the FDA or comparable foreign regulatory authorities as a device recall which could lead to increased scrutiny by the FDA, other foreign regulatory authorities and our customers regarding the quality and safety of our solutions.

Furthermore, the submission of these reports could be used by competitors against us and cause physicians to delay or cancel prescriptions, which will harm our reputation.

8 unchanged sentences

If we modify our products, we may need to apply for additional regulatory approvals or certification before we are permitted to sell the modified product.

In addition, we may not continue to meet the quality and safety standards required to maintain the authorizations or certification that we have received.

In addition, we may not continue to meet the quality and safety standards

required to maintain the authorizations or certification that we have received.

If we are unable to maintain our authorizations or certification in a particular country, we will no longer be able to sell the applicable product in that country.

7 unchanged sentences

For example, the Affordable Care Act contains a number of provisions that continue to impact the healthcare industry.

There have been executive, judicial and congressional challenges to certain aspects of the Affordable Care Act.

For example, on June 17, 2021, the U.S.

Supreme Court dismissed a challenge on procedural grounds that argued the Affordable Care Act is unconstitutional in its entirety because the “individual mandate” was repealed by Congress.

Further, on August 16, 2022, President Biden signed the Inflation Reduction Act of 2022 (“IRA”) into law, which among other things, extends enhanced subsidies for individuals purchasing health insurance coverage in Affordable Care Act marketplaces through plan year 2025.

The IRA also eliminates the “donut hole” under the Medicare Part D program beginning in 2025 by significantly lowering the beneficiary maximum out-of-pocket cost and through a

newly established manufacturer discount program.

There have been executive, judicial and congressional challenges and amendments to certain aspects of the Affordable Care Act.

On August 16, 2022, the Inflation Reduction Act of 2022 (“IRA”) was signed into law, which among other things, extends enhanced subsidies for individuals purchasing health insurance coverage in Affordable Care Act marketplaces through plan year 2025.

The IRA also eliminates the “donut hole” under the Medicare Part D program beginning in 2025 by significantly lowering the beneficiary maximum out-of-pocket cost and through a newly established manufacturer discount program.

It is possible that the Affordable Care Act will be subject to judicial or congressional challenges in the future, including congressional legislation to modify or replace the Affordable Care Act or elements of the Affordable Care Act.

It is unclear how any such challenges and the healthcare reform measures of the Biden administration will impact the Affordable Care Act and our business, financial condition and results of operations.

It is unclear how any such challenges and the healthcare reform measures of the current administration will impact the Affordable Care Act and our business, financial condition and results of operations.

In addition, other legislative changes have been proposed and adopted since the Affordable Care Act was enacted.

For example, the Budget Control Act of 2011, among other things, included reductions to CMS payments to providers of 2% per fiscal year, which went into effect on April 1, 2013 and, due to subsequent legislative amendments to the statute, will remain in effect until 2032 unless additional congressional action is taken.

Additionally, the American Taxpayer Relief Act of 2012, among other things, reduced CMS payments to several providers, including hospitals, and increased the statute of limitations period for the government to recover overpayments to providers from three to five years.

The Biden administration and Congress may pursue significant changes to the current healthcare laws.

The current administration and Congress may pursue significant changes to the current healthcare laws.

The impact of those changes on us and potential effect on the medical device industry as a whole is currently unknown.

7 unchanged sentences

In addition, changes in healthcare policy could increase our costs, decrease our revenue and impact sales of and reimbursement for our current and future products.

We are subject to stringent and evolving obligations related to data privacy and information security.

Our actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions;

We and the third parties with whom we work are subject to stringent and evolving obligations related to data privacy and information security.

Our (or the third-parties with whom we work) actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions;

fines and penalties;

2 unchanged sentences

loss of revenue or profits;

loss of customers;

and other adverse business impacts.

In the ordinary course of business, we or the third parties upon whom we rely, may collect, store, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, share or otherwise process proprietary, confidential, and sensitive data (including but not limited to intellectual property, proprietary business information and personal data).

In the ordinary course of business, we or the third parties with whom we work, may collect, store, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, share or otherwise process proprietary, confidential, and sensitive data (including but not limited to intellectual property, proprietary business information, and personal data including PHI).

We are subject to diverse laws and regulations relating to data privacy and information security.

2 unchanged sentences

New data privacy and information security laws are being enacted in the United States and globally, and existing ones are being updated and strengthened.

For example, the CCPA went into effect on January 1, 2020 and requires companies that process personal data on California residents to make new disclosures to consumers about their data collection, use and sharing practices, and allow consumers to opt out of certain data sharing with third parties.

CCPA also provides for civil penalties for violations (up to $7,500 per violation), as well as a private right of action for certain data breaches that is expected to increase data breach litigation.

In addition, the CPRA, which became effective on January 1, 2023, expands the compliance requirements and rights available to consumers under the CCPA.

For example, the California Consumer Privacy Act (“CCPA”) went into effect on January 1, 2020 and requires companies that process personal data on California residents to make new disclosures to consumers about their data collection, use and sharing practices, and allow consumers to opt out of certain data sharing with third parties.

The CCPA also provides for civil penalties for violations (up to $7,500 per intentional violation), as well as a private right of action for certain data breaches that is expected to increase data breach litigation.

In addition, the California Privacy Rights Act of 2020 (“CPRA”), which became effective on January 1, 2023, expands the compliance requirements and rights available to consumers under the CCPA.

The CPRA also establishes a new California Privacy Protection Agency to implement and enforce the CCPA (as amended), which could increase the risk of an enforcement action.

As such, the CPRA may require additional compliance investment and potential business process changes in the meantime.

Other states, such as Virginia, Colorado, Utah and Connecticut, have also passed comprehensive data privacy laws, and similar laws are being considered in several other states.

While these states, like the CCPA, also exempt some data processed in the context of clinical trials, these developments further complicate compliance efforts, and increase legal risk and compliance costs for us and the third parties upon whom we rely.

Other states, such as Virginia, Colorado, Utah and Connecticut, have also passed comprehensive data privacy laws, and similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future.

Complying with these numerous, complex and often changing regulations is expensive and difficult, and failure to comply with any data privacy and information security laws or any security incident or breach involving the misappropriation, loss or other unauthorized use or disclosure of sensitive data, such as personal data, confidential patient or consumer information, whether by us, one of our business associates or another third-party, could negatively affect our business, financial condition and results of operations, including but not limited to:

5 unchanged sentences

and injunctive relief.

Outside the United States, an increasing number of laws, regulations, and industry standards govern data privacy and security.

Outside the United States, an increasing number of laws, regulations, and industry standards govern data privacy and information security.

For example, the GDPR governs the processing (which can include any action, such as collection, use, storage adaptation or alteration, disclosure or transfer) of personal data relating to individuals located in Europe (including the UK).

1 unchanged sentence

granting various rights for data subjects in regard to their personal data, such as the right to delete certain personal data, as well as enhancing pre-existing rights (e.g., data subject access requests);

introducing the obligation to notify data protection regulators or supervisory authorities (and in certain cases, affected individuals) of significant data breaches;

introducing the obligation to notify data protection regulators or supervisory authorities

(and in certain cases, affected individuals) of significant data breaches;

imposing limitations on retention of personal data;

4 unchanged sentences

The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies and obtain compensation for damages resulting from violations of the GDPR.

In the ordinary course of business, we may transfer personal data from Europe and other jurisdictions to the United States or other countries.

In the ordinary course of business, we transfer personal data from Europe and other jurisdictions to the United States or other countries.

Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries.

In particular, the European Economic Area (“EEA”) and the United Kingdom (“UK”) have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it believes are inadequate.

Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws.

In particular, the EEA and the UK have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it believes are inadequate.

Other jurisdictions may adopt or have already adopted similarly stringent data localization and cross-border data transfer laws.

Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA and UK’s standard contractual clauses, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S.

Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States.

regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business.

If there is no lawful manner for us to transfer personal data from the EEA, the UK or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business.

Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups.

Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations.

We cannot assure you that our third-party service providers with access to our or our customers’, suppliers’, trial patients’ and employees’ personal data and other sensitive or confidential information in relation to which we are responsible will not breach contractual obligations imposed by us, or that they will not experience data security breaches or attempts thereof, which could have a corresponding effect on our business, including putting us in breach of our obligations under privacy and information security laws and regulations, which could in turn adversely affect our business, results of operations and financial condition.

Regulators in the United States such as the Department of Justice are also increasingly scrutinizing certain personal data transfers and have enacted data localization requirements, including, for example, the executive order on Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern issued in February 2024.

We cannot assure you that our third-party service providers with access to our or our customers’, suppliers’, trial patients’ and employees’ personal data and other sensitive or confidential information in relation to which we are responsible will not breach contractual obligations imposed by us, or that they will not experience security incidents or attempts thereof, which could have a corresponding effect on our business, including putting us in breach of our obligations under privacy and information security laws and regulations, which could in turn adversely affect our business, results of operations and financial condition.

We cannot assure you that our contractual measures and our own privacy and information security-related safeguards will protect us from the risks associated with the third-party processing, storage, and transmission of such information.

We publish privacy policies, marketing materials and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and information security.

If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.

We publish privacy policies, marketing materials, white papers and other statements, such as statements related to compliance with certain certifications or self-regulatory principles, concerning data privacy, information security and artificial intelligence.

Regulators in the United States are increasingly scrutinizing these statements, and if these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.

Moreover, complying with the various data privacy and information security laws that are applicable to us could require us to take on more onerous obligations in our contracts, restrict our ability to collect, use and disclose data, or in some cases, impact our ability to operate in certain jurisdictions.

In addition, these obligations may require us to change our business model.

Any failure (or perceived failure) to comply could result in government enforcement actions (which could include civil or criminal penalties), private litigation and/or adverse publicity and could negatively affect our operating results and business.

Claims that we have violated individuals’ privacy rights, failed to comply with data protection laws, or breached our contractual obligations, even if we are not found liable, could be expensive and time consuming to defend, could result in adverse publicity and could have a material adverse effect on our business, financial condition, and results of operations.

In addition, these obligations may require us

to change our business model.

Any failure (or perceived failure) to comply could result in government enforcement actions (which could include civil or criminal penalties), private litigation, imprisonment of company officials, and/or adverse publicity and could negatively affect our operating results and business.

Claims that we have violated individuals’ privacy rights, failed to comply with privacy laws, or breached our contractual obligations, even if we are not found liable, could be expensive and time consuming to defend, could result in adverse publicity and could have a material adverse effect on our business, financial condition, and results of operations.

Our employees and personnel use generative AI technologies to perform their work, and the disclosure and use of personal data in generative AI technologies is subject to various privacy laws and other privacy obligations.

4 unchanged sentences

states, have proposed or enacted laws governing AI/machine learning (“ML”).

For example, European regulators have proposed a stringent AI regulation, and we expect other jurisdictions will adopt similar laws.

For example, European regulators enacted a stringent AI regulation, and we expect other jurisdictions will adopt similar laws.

Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision making, which may be incompatible with our use of AI/ML.

4 unchanged sentences

Most healthcare providers, including hospitals from which we obtain patient health information, are subject to privacy and security regulations promulgated under HIPAA, as amended by the HITECH.

We are not currently classified as a covered entity or business associate under HIPAA and thus are not subject to its requirements or penalties.

However, any person may be prosecuted under HIPAA’s criminal provisions either directly or under aiding-and-abetting or conspiracy principles.

Consequently, depending on the facts and circumstances, we could

face substantial criminal penalties if we knowingly receive individually identifiable health information from a HIPAA-covered healthcare provider or research institution that has not satisfied HIPAA’s requirements for disclosure of individually identifiable health information.

In addition, we may maintain sensitive personally identifiable information, including health information, that we receive throughout the clinical trial process, in the course of our research collaborations, and directly from individuals (or their healthcare providers) who enroll in our patient reimbursement support programs.

As a result of our LungTrax Platform, we may be considered a Business Associate under HIPAA in some circumstances where we would be subjected to its requirements and significant penalties as well as related contractual obligations.

As a Business Associate, we would be responsible for implementing reasonable administrative, physical and technical safeguards as required by HIPAA, including, among other things, maintaining Business Associate Agreements with our customers and our subcontractors that have access to protected health information on our behalf.

Moreover, any person may be prosecuted under HIPAA’s criminal provisions either directly or under aiding-and-abetting or conspiracy principles.

Consequently, depending on the facts and circumstances, we could face substantial criminal penalties if we knowingly receive individually identifiable health information from a HIPAA-covered healthcare provider or research institution that has not satisfied HIPAA’s requirements for disclosure of individually identifiable health information.

In addition, we may maintain sensitive personally identifiable information, including health information, that we receive during the clinical trial process, through our research collaborations, via our LungTraX Platform, and directly from individuals (or their healthcare providers) who enroll in our patient reimbursement support programs.

As such, we may be subject to state laws requiring notification of affected individuals and state regulators in the event of a breach of personal data, which is a broader class of information than the health information protected by HIPAA.

15 unchanged sentences

It is not always possible to identify and deter misconduct by our employees, consultants and other third parties, and the precautions we take to detect and prevent this activity may not be effective in controlling unknown or unmanaged risks or losses or in protecting us from governmental investigations or other actions or lawsuits stemming from a failure to comply with these laws or regulations.

If any such actions are instituted against us and we are not successful in defending ourselves or asserting our rights, those actions could result in the imposition of significant fines or other sanctions, including the imposition of civil, criminal and administrative penalties, damages, monetary fines, disgorgement, possible exclusion from participation in Medicare, Medicaid and other federal healthcare programs, or comparable foreign programs, contractual damages, reputational harm, diminished profits and future earnings, and curtailment of

operations, any of which could adversely affect our ability to operate our business and our results of operations.

Whether or not we are successful in defending against such actions or investigations, we could incur substantial costs, including legal fees and reputational harm, and divert the attention of management in defending ourselves against any of these claims or investigations.

1 unchanged sentence

Our research, development and manufacturing operations involve the use of hazardous substances, and we are subject to a variety of federal, state, local and foreign environmental laws and regulations relating to the storage, use, handling, generation, manufacture, treatment, discharge and disposal of hazardous substances.

Our products may also contain hazardous substances, and they are subject laws and regulations relating to labeling requirements and to their sale, collection, recycling, treatment, storage and disposal.

Our products may also contain hazardous substances, and they are subject to laws and regulations relating to labeling requirements and to their sale, collection, recycling, treatment, storage and disposal.

Compliance with these laws and regulations may be expensive and noncompliance could result in substantial fines and penalties.

4 unchanged sentences

Risks Related to Our Intellectual Property

We may become a party to intellectual property litigation or administrative proceedings that could be costly and could interfere with our ability to sell and market our products.

We may become involved in intellectual property litigation, infringement claims, or administrative proceedings that could be costly and could interfere with our ability to sell and market our products.

The medical device industry has been characterized by extensive litigation regarding patents, trademarks, trade secrets, and other intellectual property rights, and companies in the industry have used intellectual property litigation to gain a competitive advantage.

11 unchanged sentences

If a court agrees, we would lose our rights to those challenged patents.

Because we have not conducted a formal freedom to operate analysis for patents

related to our products, we may not be aware of issued patents that a third party might assert are infringed by one of our current products or future product candidates, which could materially impair our ability to commercialize our products or product candidates.

Because we have not conducted a formal freedom to operate analysis for patents related to our products, we may not be aware of issued patents that a third party might assert are infringed by one of our current products or future product candidates, which could materially impair our ability to commercialize our products or product candidates.

Even if we diligently search third-party patents for potential infringement by our products or product candidates, we may not successfully find patents that our products or product candidates may infringe.

17 unchanged sentences

If we are found to infringe the intellectual property rights of third parties, we could be required to pay substantial damages (which may be increased up to three times of awarded damages) or substantial royalties and could be prevented from selling our products unless we obtain a license or are able to redesign our products to avoid infringement.

Any such license may not be available on reasonable terms, if at all, and there can be no assurance that we would be able to redesign our products in a way that would not infringe

the intellectual property rights of others.

Any such license may not be available on reasonable terms, if at all, and there can be no assurance that we would be able to redesign our products in a way that would not infringe the intellectual property rights of others.

We could encounter delays in product introductions while we attempt to develop alternative methods or products.

24 unchanged sentences

In addition, our trade secrets, data and know-how could be subject to unauthorized use, misappropriation, or disclosure to unauthorized parties, despite our efforts to enter into confidentiality agreements with our employees, consultants, clients and other vendors who have access to such information, and could otherwise become known or be independently discovered by third parties.

Our intellectual property, including trademarks, could be challenged,

invalidated, infringed, and circumvented by third parties, and our trademarks could also be diluted, declared generic or found to be infringing on other marks.

Our intellectual property, including trademarks, could be challenged, invalidated, infringed, and circumvented by third parties, and our trademarks could also be diluted, declared generic or found to be infringing on other marks.

If any of the foregoing occurs, we could be forced to re-brand our products, resulting in loss of brand recognition and requiring us to devote resources to advertising and marketing new brands, and suffer other competitive harm.

5 unchanged sentences

Despite our efforts to protect our proprietary rights, unauthorized parties may be able to obtain and use information that we regard as proprietary.

In addition, the issuance of a patent does not ensure that it is valid or enforceable, so even if we obtain patents, they may not be valid or enforceable against third parties.

In addition, the issuance of a patent does not ensure that it is valid or enforceable, so even if we obtain patents, they may not be valid or enforceable against

third parties.

Our patent applications may not result in issued patents and our patents may not be sufficiently broad to protect our technology.

15 unchanged sentences

Third parties may have blocking patents that could prevent us from marketing our own products and practicing our own technology.

Alternatively, third parties may seek approval to market their own products

similar to or otherwise competitive with our products.

Alternatively, third parties may seek approval to market their own products similar to or otherwise competitive with our products.

In these circumstances, we may need to defend or assert our patents, including by filing lawsuits alleging patent infringement.

9 unchanged sentences

These contracts may not provide meaningful protection for our trade secrets, know-how, or other proprietary information in the event of any unauthorized use, misappropriation, or disclosure of such trade secrets, know-how, or other proprietary information.

There can be no assurance that such third parties will not breach their agreements with us, that we will have adequate remedies for any breach, or that our trade secrets will not otherwise become known or independently developed by competitors.

There can be no

assurance that such third parties will not breach their agreements with us, that we will have adequate remedies for any breach, or that our trade secrets will not otherwise become known or independently developed by competitors.

Despite the protections we do place on our intellectual property or other proprietary rights, monitoring unauthorized use and disclosure of our intellectual property is difficult, and we do not know whether the steps we have taken to protect our intellectual property or other proprietary rights will be adequate.

13 unchanged sentences

Costly and time-consuming litigation could be necessary to enforce and determine the scope of our trade secret rights and related confidentiality and nondisclosure provisions.

If we fail to obtain or maintain trade

secret protection, or if our competitors obtain our trade secrets or independently develop technology or products similar to ours or competing technologies or products, our competitive market position could be materially and adversely affected.

If we fail to obtain or maintain trade secret protection, or if our competitors obtain our trade secrets or independently develop technology or products similar to ours or competing technologies or products, our competitive market position could be materially and adversely affected.

In addition, some courts are less willing or unwilling to protect trade secrets and agreement terms that address non-competition are difficult to enforce in many jurisdictions and might not be enforceable in certain cases.

4 unchanged sentences

The USPTO and various foreign governmental patent agencies require compliance with a number of procedural, documentary, fee payment and other similar provisions during the patent application process.

In addition, periodic maintenance fees on issued patents often must be paid to the USPTO and foreign patent agencies over the lifetime of the patent.

In addition, periodic maintenance fees on issued patents often must be paid to the USPTO and foreign patent agencies over the lifetime of

While an unintentional lapse can in many cases be cured by payment of a late fee or by other means in accordance with the applicable rules, there are situations in which noncompliance can result in abandonment or lapse of the patent or patent application, resulting in partial or complete loss of patent rights in the relevant jurisdiction.

12 unchanged sentences

The legal systems of certain countries, particularly certain developing countries, do not favor the enforcement of patents, trademarks and other intellectual property protection, which could make it difficult for us to stop the infringement of our patents and trademarks or marketing of competing products in violation of our proprietary rights generally.

Proceedings to enforce our patent and trademarks rights in foreign jurisdictions could result in substantial costs and divert our efforts and attention from other aspects of our business, could put our patents and trademarks at risk of being invalidated or interpreted narrowly and our patent or trademark applications

at risk, and could provoke third parties to assert claims against us.

We may not prevail in any lawsuits that we initiate, and the damages or other remedies awarded, if any, may not be commercially meaningful.

7 unchanged sentences

Some of these employees, consultants and contractors, may have executed proprietary rights, non-disclosure and non-competition agreements in connection with such previous employment.

Although we try to ensure that our employees and consultants do not use the intellectual property, proprietary information, know-how or trade secrets of others in their work for us, we may be subject to claims that we or these individuals have, inadvertently or otherwise, misappropriated the intellectual property or disclosed the alleged trade secrets or other proprietary information, of these former employers or competitors.

Although we try to ensure that our employees and consultants do not use the intellectual property, proprietary information, know-how or trade secrets of others in their

work for us, we may be subject to claims that we or these individuals have, inadvertently or otherwise, misappropriated the intellectual property or disclosed the alleged trade secrets or other proprietary information, of these former employers or competitors.

Additionally, we may be subject to claims from third parties challenging our ownership interest in intellectual property we regard as our own, based on claims that our employees or consultants have breached an obligation to assign inventions to another employer, to a former employer, or to another person or entity.

13 unchanged sentences

These also include provisions that switched the United States from a first-to-invent system to a first-to-file system, allow third-party submission of prior art to the USPTO during patent prosecution and set forth additional procedures to attack the validity of a patent by the USPTO administered post grant proceedings.

Under a first-to-file system, assuming the other requirements for patentability are met, the first inventor to file a patent application generally will be entitled to the patent on an invention regardless of whether another inventor had made

the invention earlier.

The USPTO recently developed new regulations and procedures to govern administration of the Leahy-Smith Act, and many of the substantive changes to patent law associated with the Leahy-Smith Act, and in particular, the first to file provisions, only became effective in 2013.

22 unchanged sentences

We rely on trademarks, service marks, tradenames and brand names to distinguish our products from the products of our competitors and have registered or applied to register these trademarks.

We have not yet registered certain of our trademarks, including “CHARITE” in Germany, and as a result we sell certain products using names that may not be protected or may be subject to third party challenges for infringement of such third party’s trademarks.

We have not yet registered certain of our trademarks and as a result we sell certain products using names that may not be protected or may be subject to third party challenges for infringement of such third party’s trademarks.

We cannot assure you that our trademark applications will be approved.

20 unchanged sentences

and extension is available for only those claims covering the approved device, a method for using it, or a method for manufacturing it.

We have applied for such an extension however, the applicable authorities, including the FDA and the USPTO in the United States, and any equivalent regulatory authority in other countries, may not agree with our assessment of whether such extensions are available, and may refuse to grant extensions to any patents we obtain, or may grant more limited extensions than we request.

We have applied for such an extension

however, the applicable authorities, including the FDA and the USPTO in the United States, and any equivalent regulatory authority in other countries, may not agree with our assessment of whether such extensions are available, and may refuse to grant extensions to any patents we obtain, or may grant more limited extensions than we request.

An extension may not be granted or may be limited where there is, for example, a failure to exercise due diligence during the testing phase or regulatory review process, failure to apply within applicable deadlines, failure to apply before expiration of relevant patents, or some other failure to satisfy applicable requirements.

17 unchanged sentences

• changes in the anticipated future size and growth rate of our market;

• general economic, regulatory, and market conditions, including inflation, rising interest rates, economic recessions or economic slowdowns;

• general economic, regulatory, and market conditions, including inflation, high interest rates, economic recessions or economic slowdowns;

• changes in the structure of healthcare payment systems;

1 unchanged sentence

Broad market and industry fluctuations, as well as general economic, political, regulatory, and market conditions, may negatively impact the market price of our common stock.

In addition, given the relatively small expected public float of shares of our common stock on the Nasdaq Global Select Market, the trading market for our shares may be subject to increased volatility.

In addition, given the relatively small expected public float of shares of our common stock on the Nasdaq Global Select Market, the trading market for our shares may be

subject to increased volatility.

In the past, companies that have experienced volatility in the market price of their securities have been subject to securities class action litigation.

12 unchanged sentences

Accordingly, investors must rely on sales of their common stock after price appreciation, which may never occur, as the only way to realize any future gains on their investments.

We are currently a “smaller reporting company” and our compliance with the scaled reporting and disclosure requirements applicable to smaller reporting companies could make our common stock less attractive to investors.

We are a “smaller reporting company” as defined by Rule 12b-2 of the Exchange Act.

As a result, we may take advantage of certain scaled disclosures available to smaller reporting companies, and we may take advantage of these scaled disclosures for so long as (i) our voting and non-voting common stock held by non-affiliates is less than $250.0 million measured on the last business day of our second fiscal quarter or (ii) our annual revenue is less than $100.0 million during the most recently completed fiscal year and our voting and non-voting common stock held by non-affiliates is less than $700.0 million measured on the last business day of our second fiscal quarter.

We have incurred, and will continue to incur, increased costs as a public company, and our management has devoted, and will continue to devote, substantial time to compliance with our public company responsibilities and corporate governance practices.

As a public company, we incur significant legal, accounting, and other expenses that we did not incur as a private company.

The Sarbanes-Oxley Act, the Dodd-Frank Wall Street Reform and Consumer Protection Act, the listing requirements of the Nasdaq Global Select Market, and other applicable securities rules and regulations impose various requirements on public companies.

As a public company, we are subject to the reporting requirements of the Exchange Act Sarbanes-Oxley Act, the Dodd-Frank Wall Street Reform and Consumer Protection Act, the listing requirements of the Nasdaq Global Select Market, and other applicable securities rules and regulations.

Furthermore, the senior members of our management team do not have significant experience with operating a public company.

1 unchanged sentence

Moreover, compliance with these rules and regulations increase our legal and financial costs and make some activities more time-consuming and costly.

In addition, changing laws, regulations, and standards relating to corporate governance and public disclosure are creating uncertainty for public companies.

These laws, regulations, and standards are subject to varying interpretations, in many cases due to their lack of specificity, and, as a result, their application in practice may evolve over time as new guidance is provided by regulatory and governing bodies.

This could result in continuing uncertainty regarding compliance matters and higher costs necessitated by ongoing revisions to disclosure and governance practices.

We intend to continue to invest resources to comply with evolving laws, regulations, and standards, and this investment may result in increased general and administrative expenses and a diversion of management’s time and attention from revenue-generating activities to compliance activities.

If, notwithstanding our efforts, we fail to comply with evolving laws, regulations, and standards, regulatory authorities may initiate legal proceedings against us, and our business may be harmed.

Failure to comply with these rules might also make it more difficult for us to obtain certain types of insurance, including director and officer liability insurance, and we might be forced to accept reduced policy limits and coverage or incur substantially higher costs to

obtain the same or similar coverage.

We cannot predict or estimate the amount of additional costs we will incur as a public company or the specific timing of such costs.

Anti-takeover provisions in our charter documents and under Delaware law could make an acquisition of our company more difficult, limit attempts by our stockholders to replace or remove our current management and limit the market price of our common stock.

14 unchanged sentences

Our amended and restated certificate of incorporation provides that the Court of Chancery of the State of Delaware and, to the extent enforceable, the federal district courts of the United States are the exclusive forums for substantially all disputes between us and our stockholders, which could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us or our directors, officers or employees.

Our amended and restated certificate of incorporation provides that the Court of Chancery of the State of Delaware (or, if the Court of Chancery of the State of Delaware lacks subject matter jurisdiction, any state court located within the State of Delaware or, if all such state courts lack subject matter jurisdiction, the federal district court for the District of Delaware) is the sole and exclusive forum for the following types of actions or proceedings under Delaware statutory or common law for:

the State of Delaware or, if all such state courts lack subject matter jurisdiction, the federal district court for the District of Delaware) is the sole and exclusive forum for the following types of actions or proceedings under Delaware statutory or common law for:

• any derivative action or proceeding brought on our behalf;

11 unchanged sentences

This may require significant additional costs associated with resolving such action in other jurisdictions and there can be no assurance that the provisions will be enforced by a court in those other jurisdictions.

These exclusive-forum provisions may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or our directors, officers or other employees, which may discourage lawsuits against

us and our directors, officers, and other employees.

If any court were to find either exclusive-forum provision in our amended and restated certificate of incorporation to be inapplicable or unenforceable, we may incur further significant additional costs associated with resolving the dispute in other jurisdictions, which could seriously harm our business.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors