What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2021-08-03 compared with 2021-05-06 · 75 added, 32 removed, 463 unchanged (19% of the section changed)

23 unchanged sentences

*We have a history of operating losses, may need additional financing to meet our future long-term capital requirements and may be unable to raise sufficient capital on favorable terms or at all.

We have recorded a net loss of approximately $7.4 million for the three months ended March 31, 2021 and we have a history of losses and may continue to incur operating and net losses for the foreseeable future.

We have recorded a net loss of approximately $12.9 million for the six months ended June 30, 2021 and we have a history of losses and may continue to incur operating and net losses for the foreseeable future.

We incurred net losses of approximately $19.9 million and $32.1 million for the years ended December 31, 2020 and December 31, 2019, respectively.

As of March 31, 2021, our accumulated deficit was approximately $149.2 million.

As of June 30, 2021, our accumulated deficit was approximately $154.8 million.

We have not achieved profitability on an annual basis.

1 unchanged sentence

If our revenues grow slower than anticipated, or if operating expenses exceed expectations, then we may not be able to achieve and sustain profitability in the near future or at all, which may depress our stock price.

As of March 31, 2021, our cash and cash equivalents totaled approximately $44.7 million.

As of June 30, 2021, our cash and cash equivalents totaled approximately $38.8 million.

While we anticipate that our current cash, cash equivalents, cash to be generated from operations and available line of credit up to $7 million from Western Alliance Bank will be sufficient to meet our projected operating plans through at least the next twelve months, we may require additional funds, either through additional equity or debt financings, including pursuant to the At Market Issuance Sales Agreement, dated as of June 12, 2020, with B.

63 unchanged sentences

The litigation includes multiple complaints and counterclaims by us and Elysium in venues in California and New York, as well as a patent infringement complaint filed by the Company and Trustees of Dartmouth College.

For further details on this litigation, please refer to Part II, Item 1 of this Quarterly Report on Form 10-Q.

For further details on this litigation, please refer to Note 12, Commitments and Contingencies, Legal Proceedings in the Notes to the Consolidated Financial Statements, included in Part I, Item 1 of this Quarterly Report on Form 10-Q.

The litigation is substantial and complex, and it has caused and could continue to cause us to incur significant costs, as well as distract our management over an extended period.

3 unchanged sentences

*Interruptions in our relationships or declines in our business with major customers could materially harm our business and financial results.

Watson Group accounted for approximately 11% of our sales during the quarter ended March 31, 2021.

Watson Group accounted for approximately 14% of our sales during the six months ended June 30, 2021.

Any interruption in our relationship or decline in our business with this customer or other customers upon whom we become highly dependent could cause harm to our business.

11 unchanged sentences

In November 2020, we received a warning letter (the “Letter”) from the FDA and Federal Trade Commission (“FTC”) and in April 2021 we received an additional warning letter from only the FTC.

For more information, see Note 12, Commitments and Contingencies, Contingencies of the Notes to Consolidated Financial Statements, included in Part I, Item 1 of this Quarterly Report on Form 10-Q.

For more information, see Note 12, Commitments and Contingencies, Contingencies in the Notes to the Consolidated Financial Statements, included in Part I, Item 1 of this Quarterly Report on Form 10-Q.

Our TRU NIAGEN® products are not approved by the FDA or any foreign regulatory authority to mitigate, prevent, treat, diagnose or cure COVID-19 or any other disease or condition, and are not intended for such use, and may never be approved for such use by the FDA or any foreign regulatory authority.

72 unchanged sentences

*We depend on key personnel, the loss of any of which could negatively affect our business .

We depend greatly on Frank L.

We depend greatly on the collective services of Frank L.

Jaksch Jr., Robert N.

Fried, Kevin M.

Farr, Lisa H.

Harrington and Fadi Karam, who are our Executive Chairman of the Board, Chief Executive Officer, Chief Financial Officer, General Counsel and Chief Marketing Officer, respectively.

Farr and Fadi Karam, who are our Executive Chairman of the Board, Chief Executive Officer, Chief Financial Officer and Chief Marketing Officer, respectively.

We also depend greatly on other key employees, including key scientific and marketing personnel.

133 unchanged sentences

If we are unable to establish and maintain adequate sales, marketing and distribution capabilities, independently or with others, we will not be able to generate product revenue, and may not become profitable.

Our business could be negatively impacted by cyber security threats.

In the ordinary course of our business, we use our data centers and our networks to store and access our proprietary business information.

We face various cyber security threats, including cyber security attacks to our information technology infrastructure and attempts by others to gain access to our proprietary or sensitive information.

Our business could be negatively impacted by cyber security threats , including without limitation a material interruption to our operations including our clinical trials, harm to our reputation, significant fines, penalties and liabilities, breach or triggering of data protection laws, privacy policies and data protection obligations, or a loss of customers or sales.

In the ordinary course of our business, we may collect, process, store and transmit proprietary, confidential and sensitive information, including personal information (including health information), intellectual property, trade secrets, and proprietary business information owned or controlled by ourselves or other parties.

We use our data centers and our networks, and those of third parties, to store and access our proprietary business and other sensitive information.

We face various cyber security threats, which are prevalent and continue to increase, including cyber security attacks to our information technology infrastructure and attempts by others to gain access to our proprietary or sensitive information.

Due to COVID-19, there may be additional cyber security threats as most of our employees work from home, utilizing network connections outside of the Company premises.

Information security risks have significantly increased in recent years in part due to the proliferation of new technologies and the increased sophistication and activities of organized crime, hackers, data and related privacy breaches, terrorists and other external parties, including foreign private parties and state actors.

Despite the implementation of preventative and detective security measures, our internal computer systems and those of our current and any future contractors, consultants, collaborators and third-party service providers, are vulnerable to damage or interruption from a variety of sources, including computer viruses, unauthorized access, accidental acts or omissions by those with authorized access, natural disasters, terrorism, war, telecommunication and electrical failure, and cybersecurity threats (including the deployment of harmful malware, ransomware, denial-of-service attacks, supply chain attacks, social engineering, and other means to affect service reliability and threaten the confidentiality, integrity, and availability of information).

Despite the implementation of preventative and detective security measures, our internal computer systems and those of our current and any future contractors, consultants, collaborators and third-party service providers, are vulnerable to damage or interruption from a variety of sources, including computer viruses, or worms, software bugs, employee theft or misuse, other unauthorized access, software or hardware failures, server malfunctions, accidental acts or omissions by those with authorized access, natural disasters, terrorism, war, telecommunication and electrical failure, and cybersecurity threats (including the deployment of harmful malware, ransomware, denial-of-service attacks (such as credential stuffing), supply chain attacks, social engineering, and other means to affect service reliability and threaten the confidentiality, integrity, and availability of information).

Ransomware attacks, including those from organized criminal threat actors, nation-states and nation-state supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions, delays, or outages in our operations, disruption of clinical trials, loss of data (including data related to clinical trials), loss of income, significant extra expenses to restore data or systems, reputational loss and the diversion of funds.

To alleviate the financial, operational and reputational impact of a ransomware attack it may be preferable to make extortion payments, but we may be unwilling or unable to do so (including, for example, if applicable laws or regulations prohibit such payments).

The procedures and controls we use to monitor these threats and mitigate our exposure may not be sufficient to prevent all cyber security incidents.

The result of these incidents could include disrupted operations, lost opportunities, misstated financial data, liability for stolen assets or information, theft of our intellectual property, loss of data and other personally identifiable information, increased costs arising from the implementation of additional security protective measures, litigation and reputational damage.

The result of these incidents could include disrupted operations, including suspension of our clinical trial activities, lost opportunities, misstated financial data, liability for stolen assets or information, theft of our intellectual property, loss of data and other personally identifiable or sensitive information, increased costs arising from the implementation of additional security protective measures, litigation and reputational damage.

We may expend significant resources, fundamentally change our business activities and practices, or modify our operations, including our clinical trial activities, or information technology in an effort to protect against security incidents and to mitigate, detect, and remediate actual and potential vulnerabilities.

If we, or a third party upon whom we rely, experience a security incident, or are perceived to have experienced a security incident, it may result in:

government enforcement actions that could include investigations, fines, penalties, audits and inspections;

additional reporting requirements and/or oversight;

temporary or permanent bans on all or some processing of personal data (which could impact our clinical trials);

or orders to destroy or not use personal data.

Further, individuals or other relevant stakeholders could sue us for our actual or perceived failure to comply with our security obligations, including, without limitation, in class action litigation.

Security incidents could also result in indemnity obligations, negative publicity and financial loss.

Security incidents and vulnerabilities may cause some of our customers and users to stop using our services and our failure, or perceived failure, to meet expectations with regard to the security, integrity, availability and confidentiality of our systems and sensitive data could damage our reputation and affect our ability to retain customers, attract new customers and grow our business.

Moreover, security incidents can result in the diversion of funds, and interruptions, delays, or outages in our operations and services, including due to ransomware attacks.

Failures or significant downtime of our information technology or telecommunication systems or those used by our third-party service providers could cause significant interruptions in our operations and adversely impact the confidentiality, integrity and availability of sensitive or confidential information, including preventing us from conducting clinical trials, tests or research and development activities and preventing us from managing the administrative aspects of our business.

Any remedial costs or other liabilities related to cyber security incidents may not be fully insured or indemnified by other means.

1 unchanged sentence

Notifications and follow-up actions related to a security breach could impact our reputation, cause us to incur significant costs, including legal expenses and remediation costs.

Compliance with global privacy and data security requirements could result in additional costs and liabilities to us or inhibit our ability to collect and, if applicable, process data globally, and the failure to comply with such requirements could have a material adverse effect on our business, financial condition or results of operations.

The regulatory framework for the collection, use, safeguarding, sharing, transfer and other processing of information worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future.

Compliance with stringent and changing global privacy and data security requirements could result in additional costs and liabilities to us or inhibit our ability to collect and, if applicable, process data globally, and the failure or perceived failure to comply with such requirements could have a material adverse effect on our business, financial condition or results of operations.

We collect, receive, store, process, use, generate, transfer, disclose, make accessible, protect and share personal information and other sensitive information, including but not limited to proprietary and confidential business information, trade secrets, intellectual property, information we collect about patients in connection with clinical trials, and sensitive third-party information, necessary to operate our business, for legal and marketing purposes.

Accordingly, we are, or may become, subject to numerous federal, state, local, and international data privacy and security laws, regulations, guidance and industry standards as well as external and internal privacy and security policies, contracts and other obligations that apply to the processing of personal data by us and on our behalf.

The legal framework for the collection, use, safeguarding, sharing, transfer and other processing of information worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future.

For example, the European Union’s General Data Protection Regulation (“GDPR”) imposes strict obligations on the processing of personal data, including, without limitation, personal health data, and the free movement of such data.

The GDPR applies to any company established in the European Union as well as any company outside the European Union that processes personal data in connection with the offering of goods or services to individuals in the European Union or the monitoring of their behavior.

The GDPR provides data protection obligations for processors and controllers of personal data, including, for example, obligations relating to:

The GDPR imposes data protection obligations on processors and controllers of personal data, including, for example, obligations relating to:

processing health and other sensitive data;

9 unchanged sentences

As of January 1, 2021, the GDPR has been converted into United Kingdom law and the United Kingdom is now a “third country” under the GDPR.

The United Kingdom and European Union agreed to an extendable four-month period as of January 1, 2021 during which the United Kingdom will be treated like an European Union member state in relation to transfers of personal data to the United Kingdom.

However, following the expiration of the specified period, there will be an increasing scope for divergence in application, interpretation and enforcement of the data protection law as between the United Kingdom and the European Economic Area (“EEA”).

The GDPR and other changes in laws or regulations associated with the enhanced protection of certain types of sensitive data, such as healthcare data or other personal information from our clinical trials, could require us to change our business practices or lead to government enforcement actions, private litigation or significant penalties against us and could have a material adverse effect on our business, financial condition or results of operations.

Similarly, European data protection laws also generally prohibit the transfer of personal data from Europe, including the EEA, United Kingdom and Switzerland, to the United States and most other countries unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data.

Similarly, European data protection laws also generally prohibit the transfer of personal data from Europe, to countries outside the European Economic Area ("EEA"), such as the United States, unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data.

One of the primary safeguards used for transfers of personal data from the European Union to the United States, namely, the Privacy Shield framework administered by the U.S.

1 unchanged sentence

The same decision also cast doubt on the ability to use one of the primary alternatives to the Privacy Shield, namely, the European Commission’s Standard Contractual Clauses, to lawfully transfer personal data from Europe to the United States and most other countries.

At present, there are few if any viable alternatives to the Privacy Shield and the Standard Contractual Clauses.

To the extent that we were to rely on the EU-U.S.

Privacy Shield Framework or the Standard Contractual Clauses, we will not be able to do so in the future, which could increase our costs and limit our ability to process personal data from the European Union.

On June 4, 2021, the European Commission adopted new SCCs under the GDPR for personal data transfers outside the EEA.

Under this legal mechanism, we may have obligations to conduct transfer impact assessments for such cross-border data transfers and implement additional security measures.

If we elect to rely on the new SCCs, we may be required to expend significant resources to update our contractual arrangements and to comply with such obligations.

In addition, Swiss and English law contain similar data transfer restrictions as the GDPR, and the Swiss Federal Data Protection and Information Commissioner recently opined that the Swiss-U.S.

Privacy Shield may also be inadequate for transfers of data from Switzerland to the United States.

As for the United Kingdom, on June 28, 2021, the European Commission issued an adequacy decision under the GDPR which allows transfers (other than those carried out for the purposes of United Kingdom immigration control) of personal data from the EEA to the United Kingdom to continue without restriction for a period of four years ending June 27, 2025.

After that period, the adequacy decision may be renewed, however, only if the United Kingdom continues to ensure an adequate level of data protection.

During these four years, the European Commission will continue to monitor the legal situation in the United Kingdom and could intervene at any point if the United Kingdom deviates from the level of data protection in place at the time of issuance of the adequacy decision.

If the adequacy decision is withdrawn or not renewed, transfers of personal data from the EEA to the United Kingdom will require a valid ‘transfer mechanism’ and we may be required to implement new processes and put new agreements in place, such as SCCs, to enable transfers of personal data from the EEA to the United Kingdom to continue.

If we are unable to implement a valid compliance mechanism for cross-border personal information transfers, we may face increased exposure to regulatory actions, substantial fines and injunctions against processing or transferring personal information from Europe or elsewhere.

Inability to import personal information from Europe or elsewhere to the United States may significantly and negatively impact our business operations, including by limiting our ability to conduct clinical trial activities in Europe and elsewhere;

limiting our ability to collaborate with Contract Research Organizations, service providers, contractors and other companies subject to European and other data protection laws;

or requiring us to increase our data processing capabilities in Europe or elsewhere at significant expense.

Additionally, the California Consumer Privacy Act (the “CCPA”), creates new individual privacy rights for consumers and places increased privacy and security obligations on entities handling personal data of consumers.

3 unchanged sentences

The CPRA also creates a new state agency that will be vested with authority to implement and enforce the CCPA and the CPRA.

Likewise, new legislation proposed or enacted in Illinois, Massachusetts, Nevada, New Jersey, New York, Rhode Island, Virginia, Washington and other states, imposes, or has the potential to impose, additional obligations on companies that collect, store, use, retain, disclose, transfer and otherwise process confidential, sensitive and personal information.

The CCPA, CPRA and other proposed or enacted state laws may increase our compliance costs and potential liability.

We expect that there will continue to be new proposed laws and regulations concerning data privacy and security, and we cannot yet determine the impact such future laws, regulations and standards may have on our business.

Although there are limited exemptions for clinical trial data under the CCPA, the CCPA and other similar laws could impact our business activities depending on how they are interpreted.

In addition, other states have enacted or proposed data privacy laws, which could further complicate the legal landscape.

For example, Virginia recently passed its Consumer Data Protection Act, and Colorado recently passed the Colorado Privacy Act, both effective 2023.

Collectively, these laws may increase our compliance costs and potential liability.

Although we endeavor to comply with our published policies, other documentation, and all applicable privacy and security laws, we may at times fail to do so or may be perceived to have failed to do so.

If we fail, or are perceived to have failed, to address or comply with obligations related to data privacy and security, we could face government enforcement actions that could include investigations, fines, penalties, audits and inspections;

additional reporting requirements and/or oversight;

temporary or permanent bans on all or some processing of personal data;

orders to destroy or not use personal data;

and imprisonment of company officials.

Further, individuals or other relevant stakeholders could sue us for our actual or perceived failure to comply with our data privacy and security obligations, including, without limitation, in class action litigation.

Any of these events could have a material adverse effect on our reputation, business, or financial condition, and could lead to a loss of actual or prospective customers, collaborators or partners;

interrupt or stop clinical trials;

result in an inability to process personal data or to operate in certain jurisdictions;

limit our ability to develop or commercialize our products;

or require us to revise or restructure our operations.

Moreover, such suits, even if we are not found liable, could be expensive and time-consuming to defend and could result in adverse publicity that could harm our business or have other material adverse effects.

Additionally, we expect that there will continue to be new proposed laws and regulations concerning data privacy and security, and we cannot yet determine the impact such future laws, regulations and standards may have on our business.

*Our failure to establish and maintain effective internal control over financial reporting could result in material misstatements in our financial statements, our failure to meet our reporting obligations and cause investors to lose confidence in our reported financial information, which in turn could cause the trading price of our common stock to decline.

Maintaining effective internal control over financial reporting is necessary for us to produce reliable financial statements.

Our management previously identified a material weakness in our internal control over financial reporting and concluded that the material weakness has not been remediated and our disclosure controls and procedures were not effective as of March 31, 2021.

The material weakness in internal control over financial reporting resulted from a deficiency in our disclosure controls and procedures which could have resulted in us not disclosing a material potential loss requiring a qualitative disclosure and recording a liability in our consolidated financial statements under ASC 450 - Contingencies.

51 unchanged sentences

• media coverage regarding our industry or us;

• litigation;

• disputes with or our inability to collect from significant customers;

14 unchanged sentences

Our federal net operating losses (“NOL”s) generated in taxable years beginning on or prior to December 31, 2017 could expire unused.

Under the Tax Cuts and Jobs Act, as modified by the CARES Act, federal NOLs incurred in taxable years beginning after December 31, 2017, may be carried forward indefinitely, but the deductibility of such federal NOLs in tax years beginning after December 31, 2020, is limited to 80% of taxable income.

Under legislation enacted in 2017, informally titled the Tax Cuts and Jobs Act, as modified by the Coronavirus Aid, Relief, and Economic Security Act (the "CARES Act") federal NOLs incurred in taxable years beginning after December 31, 2017, may be carried forward indefinitely, but the deductibility of such federal NOLs in tax years beginning after December 31, 2020, is limited to 80% of taxable income.

It is uncertain if and to what extent various states will conform to the Tax Cuts and Jobs Act or the CARES Act.

7 unchanged sentences

Future sales of these shares could adversely affect the market price of our common stock.

As of March 31, 2021, we had outstanding options for an aggregate of approximately 10.2 million shares of common stock at a weighted average exercise price of $4.27 per share and unvested restricted stock units of approximately 0.1 million shares.

As of June 30, 2021, we had outstanding options for an aggregate of approximately 10.5 million shares of common stock at a weighted average exercise price of $4.52 per share and unvested restricted stock units of approximately 0.1 million shares.

The holders may sell many of these shares in the public markets from time to time, without limitations on the timing, amount or method of sale.

20 unchanged sentences

Further, existing tax laws, statutes, rules, regulations or ordinances could be interpreted, changed, modified or applied adversely to us.

For example, legislation enacted in 2017, informally titled the Tax Cuts and Jobs Act, enacted many significant changes to the U.S.

For example, the Tax Cuts and Jobs Act, enacted many significant changes to the U.S.

Future guidance from the Internal Revenue Service and other tax authorities with respect to the Tax Cuts and Jobs Act may affect us, and certain aspects of the Tax Cuts and Jobs Act could be repealed or modified in future legislation.

For example, the Coronavirus Aid, Relief, and Economic Security Act (the “CARES Act”), modified certain provisions of the Tax Cuts and Jobs Act.

For example, the CARES Act modified certain provisions of the Tax Cuts and Jobs Act.

In addition, it is uncertain if and to what extent various states will conform to the Tax Cuts and Jobs Act, the CARES Act, or any newly enacted federal tax legislation.

9 unchanged sentences

In addition, the issuance of shares of our common stock upon the exercise of outstanding options or warrants may result in dilution to our stockholders.

UNREGISTERED SALES OF EQUITY SECURITIES AND USE OF PROCEEDS

Defaults upon Senior Securities

MINE SAFETY DISCLOSURES

Not applicable.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors