Allovir Inc

Previous wording

In addition, any strategic business combination or other transactions that we may consummate in the future could have a variety of negative consequences and we may implement a course of action or consummate a transaction that yields unexpected results that adversely affects our business and decreases the remaining cash available for use in our business or the execution of our strategic plan. Any potential transaction would be dependent on a number of factors that may be beyond our control, including, among other things, market conditions, industry trends, the interest of third parties in a potential transaction with us, obtaining stockholder approval and the availability of financing to third parties in a potential transaction with us on reasonable terms. Any failure of such potential transaction to achieve the anticipated results could significantly impair our ability to enter into any future strategic transactions and may significantly diminish or delay any future distributions to our stockholders.

Current wording

Any potential transaction would be dependent on a number of factors that may be beyond our control, including, among other things, market conditions, industry trends, the interest of third parties in a potential transaction with us, obtaining stockholder approval and the availability of financing to third parties in a potential transaction with us on reasonable terms. Any failure of such potential transaction to achieve the anticipated results could significantly impair our ability to enter into any future strategic transactions and may significantly diminish or delay any future distributions to our stockholders.

Previous wording

We may also be subject to additional privacy restrictions in various foreign jurisdictions around the world in which we operate or process personal information. The collection, use, storage, disclosure, transfer, or other processing of personal information regarding individuals in the European Economic Area, or EEA, including personal health data, is subject to the General Data Protection Regulation 2016/679, or EU GDPR (regarding individuals in the EEA) and, the UK General Data Protection Regulation, or UK GDPR (regarding individuals in the United Kingdom, or UK), as well as applicable data protection laws in effect in the Member States of the EEA and in the UK (including the UK Data Protection Act 2018). The EU and UK data protection regimes are independent of each other but remain largely aligned. In this Quarterly Report on Form 10-Q “GDPR” refers to both the EU GDPR and the UK GDPR, unless specified otherwise, and applies to any company established in the EEA/UK and to companies established outside the EEA/UK that process personal data in connection with the offering of goods or services to data subjects in the EEA/UK or the monitoring of the behavior of data subjects in the EEA/UK. The GDPR is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including requirements relating to processing health and other sensitive data, obtaining consent of the individuals to whom the personal data relates, providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of personal data, providing notification of data breaches, and taking certain measures when engaging third-party processors. The GDPR also imposes strict rules on the transfer of personal data to countries outside the European Union, including the United States, in certain circumstances, unless a derogation exists or a valid GDPR transfer mechanism is put in place and transfer impact assessments carried out to assess whether the data importer can ensure sufficient guarantees for safeguarding the personal information under the GDPR. The international transfer obligations under the GDPR will require significant effort and cost and may result in us needing to make strategic considerations around where EEA and UK personal data is transferred and which service providers we can utilize for the processing of EEA and UK personal data. Any inability to transfer personal data from the EEA and UK to the

Current wording

We may also be subject to additional privacy restrictions in various foreign jurisdictions around the world in which we operate or process personal information. The collection, use, storage, disclosure, transfer, or other processing of personal information regarding individuals in the European Economic Area, or EEA, including personal health data, is subject to the General Data Protection Regulation 2016/679, or EU GDPR (regarding individuals in the EEA) and, the UK General Data Protection Regulation, or UK GDPR (regarding individuals in the United Kingdom, or UK), as well as applicable data protection laws in effect in the Member States of the EEA and in the UK (including the UK Data Protection Act 2018). The EU and UK data protection regimes are independent of each other but remain largely aligned. In this Quarterly Report on Form 10-Q “GDPR” refers to both the EU GDPR and the UK GDPR, unless specified otherwise, and applies to any company established in the EEA/UK and to companies established outside the EEA/UK that process personal data in connection with the offering of goods or services to data subjects in the EEA/UK or the monitoring of the behavior of data subjects in the EEA/UK. The GDPR is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including requirements relating to having a legal basis for processing personal data, stricter requirements relating to the processing of sensitive data (such as health sensitive data), where required by GDPR obtaining consent of the individuals to whom the personal data relates, providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of personal data, providing notification of data breaches, requiring data protection impact assessments for high risk processing and taking certain measures when engaging third-party processors. The GDPR also imposes strict rules on the transfer of personal data to countries outside the European Union, including the United States, in certain circumstances, unless a derogation exists or a valid GDPR transfer mechanism is put in place and transfer impact assessments carried out to assess whether the data importer can ensure sufficient guarantees for safeguarding the personal information under the GDPR. The international transfer obligations under the GDPR will require significant effort and cost and may result in us needing to make strategic considerations around where EEA and UK personal data is transferred and which service providers we can utilize for the processing of EEA and UK personal data. Any inability to transfer personal data from the EEA and UK to the United States in compliance with data protection laws may impede our operations and may adversely affect our business and financial position.

Previous wording

United States in compliance with data protection laws may impede our operations and may adversely affect our business and financial position. The GDPR permits data protection authorities to issue warning letters, mandatory audits, orders to cease/change the use of data, and to impose large penalties for violations of the GDPR, including potential fines of up to €20 million (£17.5 million for the UK GDPR) or 4% of annual global revenues, whichever is greater. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. Compliance with the GDPR will be a rigorous and time-intensive process that may increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation, and reputational harm in connection with our European activities. Further, the United Kingdom’s decision to leave the EU, often referred to as Brexit, has created uncertainty with regard to data protection regulation in the United Kingdom and there will be increasing scope for divergence in application, interpretation and enforcement of the data protection laws between the UK and the EEA. For example, the UK government has recently introduced the Data Reform Bill into the UK legislative process with the intention for this bill to reform the UK’s data protection regime. If passed, the final version of the Data Reform Bill may have the effect of further altering the similarities between the UK and EEA data protection regimes and threaten the UK adequacy decision from the EU Commission which allows the free flow of personal data from the UK to the EEA. This may lead to additional compliance costs and could increase our overall risk. This lack of clarity on future UK laws and regulations and their interaction with those of the EEA could add legal risk, uncertainty, complexity, and cost to our handling of European personal data and our privacy and security compliance programs, and may require us to implement different compliance measures for the UK and EEA. In addition, EEA Member States have adopted national laws to implement the EU GDPR that may partially deviate from the EU GDPR and competent authorities in the EEA Member States may interpret the EU GDPR obligations slightly differently from country to country. Therefore, we do not expect to operate in a uniform legal landscape in the EEA. In addition, various other jurisdictions around the world continue to propose new and/or amended laws that regulate the privacy and/or security of certain types of personal data. Complying with these laws, if enacted, would require significant resources and leave us vulnerable to possible fines and penalties if we are unable to comply.

Current wording

The GDPR permits data protection authorities to issue warning letters, mandatory audits, orders to cease/change the use of data, and to impose large penalties for violations of the GDPR, including potential fines of up to €20 million (£17.5 million for the UK GDPR) or 4% of annual global revenues, whichever is greater. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. Compliance with the GDPR will be a rigorous and time-intensive process that may increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation, and reputational harm in connection with our European activities. Further, the United Kingdom’s decision to leave the EU, often referred to as Brexit, has created uncertainty with regard to data protection regulation in the United Kingdom and there will be increasing scope for divergence in application, interpretation and enforcement of the data protection laws between the UK and the EEA. The UK government had introduced the Data Reform Bill into the UK legislative process with the intention for this bill to reform the UK’s data protection regime. The Data Reform Bill failed in the legislative process but may be reintroduced at some point in the future. This may lead to additional compliance costs and could increase our overall risk. In addition, EEA Member States have adopted national laws to implement the EU GDPR that may partially deviate from the EU GDPR and competent authorities in the EEA Member States may interpret the EU GDPR obligations slightly differently from country to country. Therefore, we do not expect to operate in a uniform legal landscape in the EEA. In addition, various other jurisdictions around the world continue to propose new and/or amended laws that regulate the privacy and/or security of certain types of personal data. Complying with these laws, if enacted, would require significant resources and leave us vulnerable to possible fines and penalties if we are unable to comply.

Previous wording

Issues in the development and use of artificial intelligence, combined with an uncertain regulatory environment, may result in reputational harm, liability, or other adverse consequences to our business operations. As with many technological innovations, artificial intelligence presents risks and challenges that could impact our business. We may adopt and integrate generative artificial intelligence tools into our systems for specific use cases reviewed by legal and information security. Our vendors may incorporate generative artificial intelligence tools into their offerings without disclosing this use to us, and the providers of these generative artificial intelligence tools may not meet existing or rapidly evolving regulatory or industry standards with respect to privacy and data protection and may inhibit our or our vendors’ ability to maintain an adequate level of service and experience. Additionally, we expect to see increasing government and supranational regulation related to artificial intelligence use and ethics, which may also significantly increase the burden and cost of research, development and compliance in this area. For example, the EU’s Artificial Intelligence Act (“AI Act”) — the world’s first comprehensive AI law — is anticipated to enter into force in Spring 2024 and, with some exceptions, become effective 24 months thereafter. This legislation imposes significant obligations on providers and deployers of high risk artificial intelligence systems, and encourages providers and deployers of artificial intelligence systems to account for EU ethical principles in their development and use of these systems. If we develop or use AI systems that are governed by the AI Act, it may necessitate ensuring higher standards of data quality, transparency, and human oversight, as well as adhering to specific and potentially burdensome and costly ethical, accountability, and administrative requirements.

Current wording

As the regulatory framework for machine learning technology and AI evolves, it is possible that new laws and regulations will be adopted, or that existing laws and regulations may be interpreted in ways that would affect our business and the ways in which we use AI and machine learning technology, our financial condition and our results of operations, including as a result of the cost to comply with such laws or regulations. For example, the EU’s Artificial Intelligence Act (“AI Act”) - the world’s first comprehensive AI law – has entered into force in July 2024 and, with some exceptions, will become effective 24 months thereafter. This legislation imposes significant obligations on providers and deployers of high-risk artificial intelligence systems, and encourages providers and deployers of artificial intelligence systems to account for EU ethical principles in their development and use of these systems. If we develop or use AI systems that are governed by the AI Act, it may necessitate ensuring higher standards of data quality, transparency, and human oversight, as well as adhering to specific ethical, accountability, and administrative requirements, some of which may increase our costs and compliance obligations. Further, potential government regulation related to AI use and ethics may also increase the cost of research and development in this area, and failure to properly remediate AI usage or ethics issues may cause public confidence in AI to be undermined, which could slow adoption of AI in our products and services.

Previous wording

We conduct our operations at our facilities in Waltham, Massachusetts and Dublin, Ireland. Each of those regions serve as headquarters to many other biopharmaceutical companies and many academic and research institutions. Competition for skilled personnel in our market is intense and may limit our ability to hire and retain highly qualified personnel on acceptable terms or at all. Changes to U.S. immigration and work authorization laws and regulations, including those that restrain the flow of scientific and professional talent, can be significantly affected by political forces and levels of economic activity. Our business may be materially adversely affected if legislative or administrative changes to immigration or visa laws and regulations impair our hiring processes and goals or projects involving personnel who are not U.S. citizens.

Current wording

We conduct our operations remotely. Each of those regions serve as headquarters to many other biopharmaceutical companies and many academic and research institutions. Competition for skilled personnel in our market is intense and may limit our ability to hire and retain highly qualified personnel on acceptable terms or at all. Changes to U.S. immigration and work authorization laws and regulations, including those that restrain the flow of scientific and professional talent, can be significantly affected by political forces and levels of economic activity. Our business may be materially adversely affected if legislative or administrative changes to immigration or visa laws and regulations impair our hiring processes and goals or projects involving personnel who are not U.S. citizens.

Previous wording

As of March 31, 2024, we had 15 employees. If we resume development of our product candidates, our development and commercialization plans and strategies develop, and as we continue to operate as a public company, we would expect to need additional managerial, operational, sales, marketing, financial and other personnel, as well as additional facilities to expand our operations. Future growth would impose significant added responsibilities on members of management, including:

Current wording

As of June 30, 2024, we had 8 employees. If we resume development of our product candidates, our development and commercialization plans and strategies develop, and as we continue to operate as a public company, we would expect to need additional managerial, operational, sales, marketing, financial and other personnel, as well as additional facilities to expand our operations. Future growth would impose significant added responsibilities on members of management, including:

Previous wording

In addition, the computer systems of various third parties on which we rely, including our CROs and other contractors, consultants and law and accounting firms, may sustain damage from computer viruses, unauthorized access, data breaches, phishing attacks, cybercriminals, natural disasters (including hurricanes and earthquakes), terrorism, war and telecommunication and electrical failures. We rely on our third-party providers to implement effective security measures and identify and correct any such failures, deficiencies or cybersecurity incidents or breaches. If we or our third-party providers fail to maintain or protect our information technology systems and data integrity effectively or fail to anticipate, plan for or manage significant disruptions to our information technology systems, we or our third-party providers could have difficulty preventing, detecting and controlling such cyber-attacks and any such attacks could result in losses described above as well as disputes with physicians, patients and our partners, regulatory sanctions or penalties, increases in operating expenses, expenses or lost revenues or other adverse consequences, any of which could have a material adverse effect on our business, results of operations, financial condition, prospects and cash flows. Any failure by such third parties to prevent or mitigate cybersecurity incidents or breaches or improper access to or disclosure of such information could have similarly adverse consequences for us. If we are unable to prevent or mitigate the impact of such cybersecurity incidents or data privacy breaches, we could be exposed to litigation and governmental investigations, which could lead to a potential disruption to our business.

Current wording

In addition, the computer systems of various third parties on which we rely, including our CROs and other contractors, consultants and law and accounting firms, may sustain damage from computer viruses, unauthorized access, cybersecurity incidents or data breaches, phishing attacks, cybercriminals, natural disasters (including hurricanes and earthquakes), terrorism, war and telecommunication and electrical failures. We rely on our third-party providers to implement effective security measures and identify and correct any such failures, deficiencies or cybersecurity incidents or breaches. If we or our third-party providers fail to maintain or protect our information technology systems and data integrity effectively or fail to anticipate, plan for or manage significant disruptions to our information technology systems, we or our third-party providers could have difficulty preventing, detecting and controlling such cyber-attacks and any such attacks could result in losses described above as well as disputes with physicians, patients and our partners, regulatory sanctions or penalties, increases in operating expenses, expenses or lost revenues or other adverse consequences, any of which could have a material adverse effect on our business, results of operations, financial condition, prospects and cash flows. Any failure by such third parties to prevent or mitigate cybersecurity incidents or breaches or improper access to or disclosure of such information could have similarly adverse consequences for us. If we are unable to prevent or mitigate the impact of such cybersecurity incidents or data privacy breaches, we could be exposed to litigation and governmental investigations, which could lead to a potential disruption to our business. We also cannot be sure that our existing insurance coverage and coverage for errors and omissions will continue to be available on acceptable terms or be available in sufficient amounts to cover one or more large claims, or that our insurers will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceeds our available insurance coverage or changes in our insurance policies, including premium increases, or the imposition of large deductible or co-insurance requirements, could have an adverse effect on our business and results of operations.

Previous wording

Investment in biopharmaceutical product development is highly speculative because it entails substantial upfront capital expenditures and significant risk that any potential product candidate will fail to demonstrate adequate effect or an acceptable safety profile, gain regulatory approval and become commercially viable. We have no products approved for commercial sale and have not generated any revenue from product sales to date, and we will continue to incur significant research and development and other expenses related to our clinical development and ongoing operations. As a result, we are not profitable and have incurred losses in each period since our inception. Since our inception, we have devoted substantially all of our financial resources and efforts to research and development, including preclinical studies and our clinical trials. Our financial condition and operating results, including net losses, may fluctuate significantly from quarter to quarter and year to year. Accordingly, you should not rely upon the results of any quarterly or annual periods as indications of future operating performance. Additionally, net losses and negative cash flows have had, and will continue to have, an adverse effect on our stockholders’ equity and working capital. Our net losses were $190.4 million and $168.7 million for the years ended December 31, 2023 and 2022, respectively. As of March 31, 2024, we had an accumulated deficit of $686.5 million. We expect to continue to incur significant losses for the foreseeable future, and we expect these losses to increase as we continue our research and development of, and seek regulatory approvals for, our product candidates.

Current wording

Investment in biopharmaceutical product development is highly speculative because it entails substantial upfront capital expenditures and significant risk that any potential product candidate will fail to demonstrate adequate effect or an acceptable safety profile, gain regulatory approval and become commercially viable. We have no products approved for commercial sale and have not generated any revenue from product sales to date, and we will continue to incur significant research and development and other expenses related to our clinical development and ongoing operations. As a result, we are not profitable and have incurred losses in each period since our inception. Since our inception, we have devoted substantially all of our financial resources and efforts to research and development, including preclinical studies and our clinical trials. Our financial condition and operating results, including net losses, may fluctuate significantly from quarter to quarter and year to year. Accordingly, you should not rely upon the results of any quarterly or annual periods as indications of future operating performance. Additionally, net losses and negative cash flows have had, and will continue to have, an adverse effect on our stockholders’ equity and working capital. Our net losses were $190.4 million and $168.7 million for the years ended December 31, 2023 and 2022, respectively. As of June 30, 2024, we had an accumulated deficit of $692.6 million. We expect to continue to incur significant losses for the foreseeable future, and we expect these losses to increase as we continue our research and development of, and seek regulatory approvals for, our product candidates.

Previous wording

We had cash, cash equivalents and short-term investments of $140.5 million as of March 31, 2024. We cannot be certain that additional funding will be available on acceptable terms, or at all. We have no committed source of additional capital and if we are unable to raise additional capital in sufficient amounts or on terms acceptable to us, we may have to significantly delay, scale back or discontinue the development or commercialization of our product candidates or other research and development initiatives. Any of our current or future license agreements may also be terminated if we are unable to meet the payment or other obligations under the agreements.

Current wording

We had cash, cash equivalents and short-term investments of $129.6 million as of June 30, 2024. We cannot be certain that additional funding will be available on acceptable terms, or at all. We have no committed source of additional capital and if we are unable to raise additional capital in sufficient amounts or on terms acceptable to us, we may have to significantly delay, scale back or discontinue the development or commercialization of our product candidates or other research and development initiatives. Any of our current or future license agreements may also be terminated if we are unable to meet the payment or other obligations under the agreements.

Previous wording

Our amended and restated bylaws provide that, unless we consent in writing to an alternative forum, the Court of Chancery of the State of Delaware will be the sole and exclusive forum for any state law claim for (i) any derivative action or proceeding brought on our behalf, (ii) any action asserting a claim of breach of fiduciary duty owed by any of our directors, officers, and employees to us or our stockholders, (iii) any action asserting a claim arising pursuant to any provision of the Delaware General Corporation Law, our amended and restated certificate of incorporation or our amended and restated bylaws or (iv) any action asserting a claim that is governed by the internal affairs doctrine, in each case subject to the Court of Chancery having personal jurisdiction over the indispensable parties named as defendants therein, or the Delaware Forum Provision. The Delaware Forum Provision will not apply to any causes of action arising under the Securities Act or the Exchange Act. Our amended and restated bylaws further provide that, unless we consent in writing to the selection of an alternative forum, the United States District Court for the District of Massachusetts shall be the sole and exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act, or the Federal Forum Provision, as our principle office is located in Waltham, Massachusetts. In addition, our amended and restated bylaws provide that any person or entity purchasing or otherwise acquiring any interest in shares of our common stock is deemed to have notice of and consented to the foregoing provisions; provided, however, that stockholders cannot and will not be deemed to have waived our compliance with the federal securities laws and the rules and regulations thereunder.

Current wording

Our amended and restated bylaws provide that, unless we consent in writing to an alternative forum, the Court of Chancery of the State of Delaware will be the sole and exclusive forum for any state law claim for (i) any derivative action or proceeding brought on our behalf, (ii) any action asserting a claim of breach of fiduciary duty owed by any of our directors, officers, and employees to us or our stockholders, (iii) any action asserting a claim arising pursuant to any provision of the Delaware General Corporation Law, our amended and restated certificate of incorporation or our amended and restated bylaws or (iv) any action asserting a claim that is governed by the internal affairs doctrine, in each case subject to the Court of Chancery having personal jurisdiction over the indispensable parties named as defendants therein, or the Delaware Forum Provision. The Delaware Forum Provision will not apply to any causes of action arising under the Securities Act or the Exchange Act. Our amended and restated bylaws further provide that, unless we consent in writing to the selection of an alternative forum, the United States District Court for the District of Massachusetts shall be the sole and exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act, or the Federal Forum Provision. In addition, our amended and restated bylaws provide that any person or entity purchasing or otherwise acquiring any interest in shares of our common stock is deemed to have notice of and consented to the foregoing provisions; provided, however, that stockholders cannot and will not be deemed to have waived our compliance with the federal securities laws and the rules and regulations thereunder.