Lexeo Therapeutics Inc

Previous wording

Since our inception, we have incurred significant net losses, and we expect to continue to incur significant expenses and operating losses for the foreseeable future. We incurred net losses of $66.4 million for the year ended December 31, 2023, and $21.2 million and $42.9 million for the three and six months ended June 30, 2024, respectively. As of June 30, 2024, we had an accumulated deficit of $224.8 million. We have primarily financed our operations with approximately $100.3 million of net proceeds raised in our IPO and the subsequent partial exercise of the underwriters’ 30-day option to purchase additional shares of common stock, as well as totals of $88.7 million, $185.0 million and $3.9 million of net proceeds from the Private Placement, sales of our convertible equity securities and a convertible SAFE Note, respectively. We have no products approved for commercialization and have never generated any revenue from product sales.

Current wording

Since our inception, we have incurred significant net losses, and we expect to continue to incur significant expenses and operating losses for the foreseeable future. We incurred net losses of $66.4 million for the year ended December 31, 2023, and $29.5 million and $72.4 million for the three and nine months ended September 30, 2024, respectively. As of September 30, 2024, we had an accumulated deficit of $254.2 million. We have primarily financed our operations with approximately $100.3 million of net proceeds raised in our IPO and the subsequent partial exercise of the underwriters’ 30-day option to purchase additional shares of common stock, as well as totals of $88.7 million, $185.0 million and $3.9 million of net proceeds from the Private Placement, sales of our convertible equity securities and the convertible SAFE Note, respectively. We have no products approved for commercialization and have never generated any revenue from product sales.

Previous wording

As of June 30, 2024, we had cash and cash equivalents of $175.0 million. Following the $88.7 million of net proceeds received upon the closing of the Private Placement in March 2024, we believe that our cash and cash equivalents will be sufficient to fund our operating expenses and capital requirements into 2027. This estimate is based on assumptions that may prove to be wrong, and we could use our available capital resources sooner than we expect. Changes may occur beyond our control that would cause us to consume our available capital before that time, including changes in and progress of our development activities, acquisitions of additional product candidates, and changes in regulation. Our future capital requirements will depend on many factors, including:

Current wording

As of September 30, 2024, we had cash and cash equivalents of $157.0 million. Following the $88.7 million of net proceeds received upon the closing of the Private Placement in March 2024, we believe that our cash and cash equivalents will be sufficient to fund our operating expenses and capital requirements into 2027. This estimate is based on assumptions that may prove to be wrong, and we could use our available capital resources sooner than we expect. Changes may occur beyond our control that would cause us to consume our available capital before that time, including changes in and progress of our development activities, acquisitions of additional product candidates, and changes in regulation. Our future capital requirements will depend on many factors, including:

Previous wording

In addition, the FDA, EMA and other regulatory authorities may change their policies, issue additional regulations or revise existing regulations, or take other actions, which may prevent or delay approval of our future products under development on a timely basis. Such policy or regulatory changes could impose additional requirements upon us that could delay our ability to obtain approvals, increase the costs of compliance or restrict our ability to maintain any marketing authorizations we may have obtained. Recently, the Supreme Court overruled the Chevron doctrine, which had given deference to regulatory agencies’ statutory interpretations of ambiguous regulations in litigation against federal government agencies, such as the FDA. The overruling of the Chevron doctrine may significantly increase the number of challenges brought by companies and other stakeholders against federal agencies such as the FDA and its longstanding decisions and policies, including the FDA’s statutory interpretations of market exclusivities and the “substantial evidence” requirements for drug approvals, which could undermine the FDA’s authority, lead to uncertainties in the industry, and disrupt the FDA’s normal operations, any of which could delay the FDA’s review of our regulatory submissions. We cannot predict the full impact of this decision, future judicial challenges brought against the FDA, or the nature or extent of government regulation that may arise from future legislation or administrative action.

Current wording

In addition, the FDA, EMA and other regulatory authorities may change their policies, issue additional regulations or revise existing regulations, or take other actions, which may prevent or delay approval of our future products under development on a timely basis. Such policy or regulatory changes could impose additional requirements upon us that could delay our ability to obtain approvals, increase the costs of compliance or restrict our ability to maintain any marketing authorizations we may have obtained. In June 2024, the Supreme Court overruled the Chevron doctrine, which had given deference to regulatory agencies’ statutory interpretations of ambiguous regulations in litigation against federal government agencies, such as the FDA. The overruling of the Chevron doctrine may significantly increase the number of challenges brought by companies and other stakeholders against federal agencies such as the FDA and its longstanding decisions and policies, including the FDA’s statutory interpretations of market exclusivities and the “substantial evidence” requirements for drug approvals, which could undermine the FDA’s authority, lead to uncertainties in the industry, and disrupt the FDA’s normal operations, any of which could delay the FDA’s review of our regulatory submissions. We cannot predict the full impact of this decision, future judicial challenges brought against the FDA, or the nature or extent of government regulation that may arise from future legislation or administrative action.

Previous wording

From time to time, we may publish or present interim top-line or preliminary results from our clinical trials. Interim results from clinical trials that we may complete are subject to the risk that one or more of the clinical outcomes may materially change as patient enrollment continues and more patient data become available. Preliminary or top-line results also remain subject to audit and verification procedures that may result in the final data being materially different from the preliminary data we previously published. As a result, interim and preliminary data should be viewed with caution until the final data are available. Differences between preliminary or interim data and final data could significantly harm our business prospects and may cause the trading price of our common stock to fluctuate significantly.

Current wording

From time to time, we have and may continue to publish or present interim top-line or preliminary results from our clinical trials. Interim results from clinical trials that we may complete are subject to the risk that one or more of the clinical outcomes may materially change as patient enrollment continues and more patient data become available. Preliminary or top-line results also remain subject to audit and verification procedures that may result in the final data being materially different from the preliminary data we previously published. As a result, interim and preliminary data should be viewed with caution until the final data are available. Differences between preliminary or interim data and final data could significantly harm our business prospects and may cause the trading price of our common stock to fluctuate significantly.

Previous wording

Regulatory authorities in some jurisdictions, including the United States, may designate drugs or biologics intended to treat relatively small patient populations as orphan drug products. Under the Orphan Drug Act, the FDA may designate a drug or biologic as an orphan drug if it is intendsed to treat a rare disease or condition, which is generally defined as a patient population of fewer than 200,000 individuals in the United States, or a patient population of 200,000 or more in the United States where there is no reasonable expectation that the cost of developing the drug will be recovered from sales in the United States.

Current wording

Regulatory authorities in some jurisdictions, including the United States, may designate drugs or biologics intended to treat relatively small patient populations as orphan drug products. Under the Orphan Drug Act, the FDA may designate a drug or biologic as an orphan drug if it is intended to treat a rare disease or condition, which is generally defined as a patient population of fewer than 200,000 individuals in the United States, or a patient population of 200,000 or more in the United States where there is no reasonable expectation that the cost of developing the drug will be recovered from sales in the United States.

Previous wording

We have received Fast Track designation for LX1001 for the treatment of patients with early Alzheimer’s disease who are APOE4 homozygous, to slow disease progression, for LX2006 for the treatment of FA cardiomyopathy, and for LX2020 for the treatment of PKP2-ACM. While we may seek Fast Track, Breakthrough Therapy and/or RMAT designation for some or all of our product candidates, there is no guarantee that we will be successful in obtaining any such designation. Even if we do obtain such designation, we may not experience a faster development process, review or approval compared to conventional FDA procedures. A Fast Track, Breakthrough Therapy, or RMAT designation does not ensure that the product candidate will receive marketing approval or that approval will be granted within any particular time frame. In addition, the FDA may withdraw Fast Track, Breakthrough Therapy, or RMAT designation if it believes that the designation is no longer supported by data from our clinical development program. Fast Track, Breakthrough Therapy and/or RMAT designation alone does not guarantee qualification for the FDA’s priority review procedures.

Current wording

We have received Fast Track designation for LX1001 for the treatment of patients with early Alzheimer’s disease who are APOE4 homozygous, to slow disease progression, for LX2006 for the treatment of FA cardiomyopathy, and for LX2020 for the treatment of PKP2-ACM. We have also received RMAT designation for LX2006 for the treatment of FA cardiomyopathy. While we may seek Fast Track, Breakthrough Therapy and/or RMAT designation for some or all of our product candidates, there is no guarantee that we will be successful in obtaining any such designation. Even if we do obtain such designation, we may not experience a faster development process, review or approval compared to conventional FDA procedures. A Fast Track, Breakthrough Therapy, or RMAT designation does not ensure that the product candidate will receive marketing approval or that approval will be granted within any particular time frame. In addition, the FDA may withdraw Fast Track, Breakthrough Therapy, or RMAT designation if it believes that the designation is no longer supported by data from our clinical development program. Fast Track, Breakthrough Therapy and/or RMAT designation alone does not guarantee qualification for the FDA’s priority review procedures.

Previous wording

We are aware that our competitors are developing product candidates for the treatment of diseases that our product candidates will target. With respect to LX2006, we are aware of preclinical gene therapy programs in development at Solid Biosciences Inc., Lacerta Therapeutics, Inc. and Astellas Pharma Inc., and those being developed in collaborations between Voyager Therapeutics, Inc. and Neurocrine Biosciences, Inc. Additionally, we are aware that Prime Medicine, Inc. and Tune Therapeutics, Inc. have early-stage gene editing discovery efforts. Among other treatment modalities for FA, we are aware that Larimar Therapeutics, Inc. is developing a clinical stage product candidate, CTI-1601, that Design Therapeutics, Inc. is developing a product candidate, DT-216P2, and that Reata Pharmaceuticals, Inc.’s omaveloxolone (Skyclarys) was approved by the FDA in 2023. In 2023 Biogen Inc. acquired Reata Pharmaceuticals, Inc. for approximately $7.3 billion and is currently commercializing Skyclarys.

Current wording

We are aware that our competitors are developing product candidates for the treatment of diseases that our product candidates will target. With respect to LX2006, we are aware of a clinical stage gene therapy program in development at Astellas Pharma Inc., preclinical gene therapy programs in development at Solid Biosciences Inc. and those being developed in collaborations between Voyager Therapeutics, Inc. and Neurocrine Biosciences, Inc. Additionally, we are aware that Prime Medicine, Inc. and Tune Therapeutics, Inc. have early-stage gene editing discovery efforts. Among other treatment modalities for FA, we are aware that Larimar Therapeutics, Inc. is developing a clinical stage product candidate, CTI-1601, that Design Therapeutics, Inc. is developing a product candidate, DT-216P2, and that Reata Pharmaceuticals, Inc.’s omaveloxolone (Skyclarys) was approved by the FDA in 2023. In 2023 Biogen Inc. acquired Reata Pharmaceuticals, Inc. for approximately $7.3 billion and is currently commercializing Skyclarys.

Previous wording

With respect to LX2020, both Rocket Pharmaceuticals, Inc. and Tenaya Therapeutics Inc. are developing an AAV-based gene therapy candidate designed to deliver a functional PKP2 gene to patients with PKP2-ACM.

Current wording

With respect to LX2020, both Rocket and Tenaya Therapeutics Inc. are developing an AAV-based gene therapy candidate designed to deliver a functional PKP2 gene to patients with PKP2-ACM.

Previous wording

The principal decisions about reimbursement for new medicines are typically made by the Centers for Medicare & Medicaid Services, or CMS, an agency within the U.S. Department of Health and Human Services. CMS decides whether and to what extent products will be covered and reimbursed under Medicare and private payors tend to follow CMS to a substantial degree.

Current wording

The principal decisions about reimbursement for new medicines are typically made by the Centers for Medicare & Medicaid Services, or CMS, an agency within the U.S. Department of Health and Human Services. CMS decides whether and to what extent products will be covered and reimbursed under Medicare and private payors tend to follow CMS to a substantial degree. Most significantly, in August 2022, the Inflation Reduction Act of 2022, or IRA, was signed into law. Among other things, the IRA requires manufacturers of certain drugs to engage in price negotiations with Medicare, with prices that can be negotiated subject to a cap (with resulting prices for the initial ten drugs first effective in 2026); imposes rebates under Medicare Part B and Medicare Part D to penalize price increases that outpace inflation (first due in 2023); redesigns the Medicare Part D benefit (beginning in 2024); and replaces the Part D coverage gap discount program with a new discounting program (beginning in 2025). The IRA permits the Secretary of the HHS to implement many of these provisions through guidance, as opposed to regulation, for the initial years. On August 29, 2023, HHS announced the list of the first ten drugs that will be subject to price negotiations. HHS has issued and will continue to issue and update guidance implementing the IRA, although the Medicare drug price negotiation program is currently subject to legal challenges. While the impact of the IRA on the pharmaceutical industry cannot yet be fully determined, it is likely to be significant.

Previous wording

We are heavily reliant upon licenses to certain patent rights and proprietary technology for the development of each of our current product candidates. In particular, we in-license key patents, patent applications and know-how from Adverum related to LX2006, we in-license patent applications and know-how from Cornell related to our LX1001, LX1020 and LX1021 product candidates, and we in-license patent applications and know-how from UCSD, related to our LX2020, LX2021 and LX2022 product candidates. Our license agreements impose diligence and milestone and royalty payment obligations on us, and also contain certain development requirements. If we fail to comply with our obligations, our licensors may have the right to terminate our licenses, in which event we will not be able to develop, manufacture or market any product using the intellectual property under any such terminated agreement and may face other penalties. Such an occurrence would materially adversely affect our business prospects.

Current wording

We are heavily reliant upon licenses to certain patent rights and proprietary technology for the development of each of our current product candidates. In particular, we in-license key patents, patent applications and know-how from Adverum related to LX2006, we in-license patent applications and know-how from Cornell related to our LX2006, LX1001, LX1020 and LX1021 product candidates, and we in-license patent applications and know-how from UCSD, related to our LX2020, LX2021 and LX2022 product candidates. Our license agreements impose diligence and milestone and royalty payment obligations on us, and also contain certain development requirements. If we fail to comply with our obligations, our licensors may have the right to terminate our licenses, in which event we will not be able to develop, manufacture or market any product using the intellectual property under any such terminated agreement and may face other penalties. Such an occurrence would materially adversely affect our business prospects.

Previous wording

We employ individuals who were previously employed at other biotechnology or biopharmaceutical companies. Although we try to ensure that our employees, consultants and advisors do not use the proprietary information or know-how of others in their work for us, we may be subject to claims that we or our employees, consultants, or independent contractors have inadvertently or otherwise used or disclosed confidential information of our employees’ former employers or other third parties. We may also be subject to claims that former employers or other third parties have an ownership interest in our future patents. Litigation may be necessary to defend against these claims. There is no guarantee of success in defending these claims, and even if we are successful, litigation can have an adverse impact on us due to defense and settlement costs, diversion of management resources, harm to our reputation and other factors. For example, on October 12, 2023, Rocket filed a lawsuit against us and two individuals claiming, among other things, misappropriation of confidential information and trade secrets. The individual defendants are a current employee and a former employee of our analytical development team, both of whom were employed at Rocket before joining us in 2021. The complaint alleges the individual defendants downloaded confidential Rocket company documents and other proprietary materials prior to leaving Rocket in 2021 and that we used this information to advance our programs. The complaint seeks unspecified damages and asks the court to enjoin us from competing and working in the market for gene therapy treatments targeting cardiac diseases. We retained legal counsel to assist with our ongoing review of the allegations in Rocket’s complaint and are confident in our defenses to the allegations. On December 7, 2023, we filed a motion to dismiss the complaint, and the motion is fully briefed and pending before the court. It is not possible to predict the outcome with certainty and an estimate of the possible loss cannot be made. For additional information regarding this litigation, see "Item 1-Legal Proceedings".

Current wording

We employ individuals who were previously employed at other biotechnology or biopharmaceutical companies. Although we require, evidenced by written agreements, that all of our employees, consultants and advisors not use the proprietary information or know-how of others in their work for us, we may be subject to claims that we or our employees, consultants, or independent contractors have inadvertently or otherwise used or disclosed confidential information of our employees’ former employers or other third parties. We may also be subject to claims that former employers or other third parties have an ownership interest in our future patents. Litigation may be necessary to defend against these claims. There is no guarantee of success in defending these claims, and even if we are successful, litigation can have an adverse impact on us due to defense and settlement costs, diversion of management resources, harm to our reputation and other factors. For example, on October 12, 2023, Rocket filed a lawsuit against us and two individuals claiming, among other things, misappropriation of confidential information and trade secrets. The individual defendants are two former employees of our analytical development team, both of whom were employed at Rocket before joining us in 2021. The complaint alleges the individual defendants downloaded confidential Rocket company documents and other proprietary materials prior to leaving Rocket in 2021 and that we used this information to advance our programs. The complaint seeks unspecified damages and asks the court to enjoin us from competing and working in the market for gene therapy treatments targeting cardiac diseases. We retained legal counsel to assist with our ongoing review of the allegations in Rocket’s complaint and are confident in our defenses to the allegations. In addition, in August 2024, we asserted counterclaims against Rocket and Spacecraft Seven LLC, a wholly owned subsidiary of Rocket, for misappropriation of trade secrets, correction of inventorship of certain patents, breach of contract, and tortious interference with contract. The case is currently in the discovery phase. It is not possible to predict the outcome with certainty and an estimate of the possible loss cannot be made. For additional information regarding this litigation, see "Item 1-Legal Proceedings".

Previous wording

We maintain a large quantity of sensitive information, including confidential business and personal information in connection with the conduct of our clinical trials and related to our employees, and we are subject to laws and regulations governing the privacy and security of such information. In the United States, there are numerous federal and state privacy and data security laws and regulations governing the collection, use, disclosure and protection of personal information, including federal and state health information privacy laws, federal and state security breach notification laws and federal and state consumer protection laws. The legislative and regulatory landscape for privacy and data protection continues to evolve, and there has been an increasing focus on privacy and data protection issues, which may affect our business and is expected to increase our compliance costs and exposure to liability. In the United States, numerous federal and state laws and regulations could apply to our operations or the operations of our partners, including state and federal data breach notification laws, state health information privacy laws and federal and state consumer protection laws and regulations that govern the collection, use, disclosure and protection of health-related and other personal information. Among these regulations are: Section 5 of the Federal Trade Commission Act, which prohibits unfair or deceptive commercial practices; new rules adopted by the SEC in July 2023, which require public companies to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance; and HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, and the regulations promulgated thereunder.

Current wording

We maintain a large quantity of sensitive information, including confidential business and personal information in connection with the conduct of our clinical trials and related to our employees, and we are subject to laws and regulations governing the privacy and security of such information. In the United States, there are numerous federal and state privacy and data security laws and regulations governing the collection, use, disclosure and protection of personal information, including federal and state health information privacy laws, federal and state security breach notification laws and federal and state consumer protection laws. The legislative and regulatory landscape for privacy and data protection continues to evolve, and there has been an increasing focus on privacy and data protection issues, which may affect our business and is expected to increase our compliance costs and exposure to liability. In the United States, numerous federal and state laws and regulations could apply to our operations or the operations of our partners, including state and federal data breach notification laws, state health information privacy laws and federal and state consumer protection laws and regulations that govern the collection, use, disclosure and protection of health-related and other personal information. Among these regulations are: Section 5 of the Federal Trade Commission Act, which prohibits unfair or deceptive commercial practices; new rules adopted by the SEC in July 2023, which require public companies to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance; and the federal Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, or HIPAA and the regulations promulgated thereunder.

Previous wording

We may obtain health information from third parties, including research institutions from which we obtain clinical trial data, that are subject to privacy and security requirements under HIPPA, and depending on the facts and circumstances, we could be subject to significant penalties if we obtain, use or disclose individually identifiable health information in a manner that is not authorized or permitted by HIPAA.

Current wording

We may obtain health information from third parties, including research institutions from which we obtain clinical trial data, that are subject to privacy and security requirements under HIPAA, and depending on the facts and circumstances, we could be subject to significant penalties if we obtain, use or disclose individually identifiable health information in a manner that is not authorized or permitted by HIPAA.

Previous wording

In the European Economic Area, or EEA, and the UK, the collection, use, disclosure, transfer or other processing of personal data, including clinical trial data, of individuals is governed by the General Data Protection Regulation, or European Union GDPR (with regards to the EEA) and UK GDPR (with regards to the UK), as well as applicable national data protection legislation and requirements. In this document, “GDPR” refers to both the European Union GDPR and the UK GDPR, unless specified otherwise. The GDPR is wide ranging in scope imposes numerous requirements on companies that process personal data, including requirements relating to processing health and other sensitive data, obtaining consent of the individuals to whom the personal data relates, providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of personal data, providing notification of data breaches, and taking certain measures when engaging third-party processors. The GDPR imposes substantial fines for breaches and violations (up to the greater of €20 million (£17.5 million for the UK) or 4% of our consolidated annual worldwide gross revenue), and confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies and obtain compensation for damages resulting from violations of the GDPR.

Current wording

In the European Economic Area, or EEA, and the UK, the collection, use, disclosure, transfer or other processing of personal data, including clinical trial data, of individuals is governed by the General Data Protection Regulation, or European Union GDPR (with regards to the EEA) and UK GDPR (with regards to the UK), as well as applicable national data protection legislation and requirements. In this document, “GDPR” refers to both the European Union GDPR and the UK GDPR, unless specified otherwise. The GDPR is wide ranging in scope and imposes numerous requirements on companies that process personal data, including requirements relating to processing health and other sensitive data, obtaining consent of the individuals to whom the personal data relates, providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of personal data, providing notification of data breaches, and taking certain measures when engaging third-party processors. The GDPR imposes substantial fines for breaches and violations (up to the greater of €20 million (£17.5 million for the UK) or 4% of our consolidated annual worldwide gross revenue), and confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies and obtain compensation for damages resulting from violations of the GDPR.

Previous wording

Compliance with these and any other applicable privacy and data security laws and regulations is a rigorous and time-intensive process, and we may be required to put in place additional mechanisms ensuring compliance with the new data protection rules. If we fail to comply with any such laws or regulations, we may face significant fines and penalties that could adversely affect our business, financial condition and results of operations. Furthermore, the laws are not consistent, and compliance in the event of a widespread data breach is costly. In addition, states are constantly adopting new laws or amending existing laws, requiring attention to frequently changing regulatory requirements. For example, California enacted the California Consumer Privacy Act, or CCPA, which took effect on January 1, 2020, became enforceable by the California Attorney General on July 1, 2020 and has been dubbed the first “GDPR-like” law in the United States. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used by requiring covered companies to provide new disclosures to California consumers (as that term is broadly defined) and provide such consumers new ways to opt out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. Further, the California Privacy Rights Act, or CPRA, which became effective as of January 1, 2023, amended the CCPA and imposes additional data protection obligations on companies doing business in California, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data and opt outs for certain uses of sensitive data. The amendments introduced by the CPRA also created a new California data protection agency authorized to issue substantive regulations, and it is anticipated that this development could result in increased privacy and information security enforcement. Although the CCPA, as amended by the CPRA, currently exempts certain health-related information, including clinical trial data, the CCPA may increase our compliance costs and potential liability if we expand our operations into California. Similar broad consumer privacy laws have been enacted in Colorado, Connecticut, Virginia, Utah, Iowa and Indiana and have been proposed in numerous other states and at the federal level. If passed, these bills may have potentially conflicting requirements that would make compliance challenging.

Current wording

Compliance with these and any other applicable privacy and data security laws and regulations is a rigorous and time-intensive process, and we may be required to put in place additional mechanisms ensuring compliance with the new data protection rules. If we fail, or are alleged to fail, to comply with any such laws or regulations, we may face regulatory inquiries, investigations, and other proceedings, private claims and litigation, and significant fines and penalties that could adversely affect our business, financial condition and results of operations. Furthermore, the laws are not consistent, and compliance in the event of a widespread data breach is costly. In addition, states are constantly adopting new laws or amending existing laws, requiring attention to frequently changing regulatory requirements. For example, California enacted the California Consumer Privacy Act, or CCPA, which took effect on January 1, 2020, became enforceable by the California Attorney General on July 1, 2020 and has been dubbed the first “GDPR-like” law in the United States. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used by requiring covered companies to provide new disclosures to California consumers (as that term is broadly defined) and provide such consumers new ways to opt out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. Further, the California Privacy Rights Act, or CPRA, which became effective as of January 1, 2023, amended the CCPA and imposes additional data protection obligations on companies doing business in California, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data and opt outs for certain uses of sensitive data. The amendments introduced by the CPRA also created a new California data protection agency authorized to implement and enforce this legislation, and it is anticipated that this development could result in increased privacy and information security enforcement. Although the CCPA, as amended by the CPRA, currently exempts certain health-related information, including clinical trial data, the CCPA may increase our compliance costs and potential liability. Similar broad consumer privacy laws have been enacted in Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia and have been proposed in numerous other states and at the federal level. If passed, these bills may have potentially conflicting requirements that would make compliance challenging.

Previous wording

In addition to these consumer privacy laws, the state of Washington recently enacted a comprehensive privacy bill, called the My Health My Data Act. Effective March 2024, this new law will impose strict requirements on the collection, use and processing of health related information that is not subject to HIPAA. Other states are considering bills with similar requirements. The Washington law and, if passed, the other state bills, will add additional complexity to our existing compliance obligations.

Current wording

In addition to these consumer privacy laws, the state of Washington recently enacted health-focused privacy legislation, called the My Health, My Data Act, which became effective in March 2024. This law imposes strict requirements on the collection, use and processing of certain health-related information that is not subject to HIPAA. This law also provides for a private right of action. Other states are considering bills with similar requirements. The Washington law and, if passed, the other state bills, will add additional complexity to our existing compliance obligations.

Previous wording

With the GDPR, CCPA and other laws, regulations and other obligations relating to privacy and data protection imposing new and relatively burdensome obligations, and with the substantial uncertainty over the interpretation and application of these and other obligations, we may face challenges in addressing their requirements and making necessary changes to our policies and practices and may incur significant costs and expenses in an effort to do so. We will continue to assess, develop, update, and adapt our practices, procedures, and policies in order to address existing and new requirements under applicable data privacy and protection laws and regulations. However, it is possible that both existing and new laws, regulations, and other obligations to which we are or may be subject, may be interpreted and applied in a manner that is inconsistent with our existing or future privacy and data protection practices. Any failure or perceived failure by us to comply with our obligations may result in governmental investigations or enforcement actions, litigation, claims, or public statements against us and could result in significant liability, cause harm to our brand and reputation, and otherwise materially and adversely affect our reputation and business. We do not currently have any formal data privacy policies and procedures in place and have not completed formal assessments of whether we are in compliance with all applicable data privacy laws and regulations. Additionally, if third parties with which we work, such as vendors or service providers, violate applicable laws, rules or regulations or our policies, such violations may also put our or our clinical trial and employee data, including personal data, at risk, which could in turn have an adverse effect on our business.

Current wording

With the GDPR, CCPA and other laws, regulations and other obligations relating to privacy and data protection imposing new and relatively burdensome obligations, and with the substantial uncertainty over the interpretation and application of these and other obligations, we may face challenges in addressing their requirements and making necessary changes to our policies and practices and may incur significant costs and expenses in an effort to do so. It is possible that both existing and new laws, regulations, and other obligations to which we are or may be subject, may be interpreted and applied in a manner that is inconsistent with our existing or future privacy, data protection and cybersecurity practices. Any failure or perceived failure by us to comply with our obligations may result in governmental investigations or enforcement actions, litigation, claims, or public statements against us and could result in significant liability, cause harm to our brand and reputation, and otherwise materially and adversely affect our reputation and business. We do not currently have any formal data privacy policies and procedures in place and have not completed formal assessments of whether we are in compliance with all applicable data privacy laws and regulations. Additionally, if third parties with which we work, such as vendors or service providers, violate applicable laws, rules or regulations or our policies, such violations may also put our or our clinical trial and employee data, including personal data, at risk, which could in turn have an adverse effect on our business.

Previous wording

As of June 30, 2024, we had 69 full-time employees. As our development progresses, we expect to experience significant growth in the number of our employees and the scope of our operations, particularly in the areas of clinical product development, regulatory affairs and, if any of our product candidates receives marketing approval, sales, marketing and distribution. To manage our anticipated future growth, we must continue to implement and improve our managerial, operational and financial systems, expand our facilities and continue to recruit and train additional qualified personnel. Due to our limited financial resources and the limited experience of our management team in managing a company with such anticipated growth, we may not be able to effectively manage the expansion of our operations or recruit and train additional qualified personnel. Our choice to focus on multiple therapeutic areas may negatively affect our ability to develop adequately the specialized capability and expertise necessary for operations. The expansion of our operations may lead to significant costs and may divert our management and business development resources. Any inability to manage growth could delay the execution of our business plans or disrupt our operations.

Current wording

As of September 30, 2024, we had 72 full-time employees. As our development progresses, we expect to experience significant growth in the number of our employees and the scope of our operations, particularly in the areas of clinical product development, regulatory affairs and, if any of our product candidates receives marketing approval, sales, marketing and distribution. To manage our anticipated future growth, we must continue to implement and improve our managerial, operational and financial systems, expand our facilities and continue to recruit and train additional qualified personnel. Due to our limited financial resources and the limited experience of our management team in managing a company with such anticipated growth, we may not be able to effectively manage the expansion of our operations or recruit and train additional qualified personnel. Our choice to focus on multiple therapeutic areas may negatively affect our ability to develop adequately the specialized capability and expertise necessary for operations. The expansion of our operations may lead to significant costs and may divert our management and business development resources. Any inability to manage growth could delay the execution of our business plans or disrupt our operations.

Previous wording

The global economy, including credit and financial markets, has experienced extreme volatility and disruptions recently, including, among other things, diminished liquidity and credit availability, declines in consumer confidence, declines in economic growth, supply chain shortages, increases in inflation rates, higher interest rates, and uncertainty about economic stability. For example, the COVID-19 pandemic resulted in widespread unemployment, economic slowdown and extreme volatility in the capital markets. The Federal Reserve has raised interest rates multiple times in response to concerns about inflation and it may raise them again. Higher interest rates, coupled with reduced government spending and volatility in financial markets, may increase economic uncertainty and affect consumer spending. Similarly, the ongoing military conflict between Russia and Ukraine and increasing tensions between China and Taiwan have created extreme volatility in the global capital markets and may have further global economic consequences, including disruptions of the global supply chain. Any such volatility and disruptions may adversely affect our business or the third parties on whom we rely. If the equity and credit markets deteriorate, including as a result of political unrest or war, it may make any necessary debt or equity financing more difficult to complete, more costly, and more dilutive. Failure to secure any necessary financing in a timely manner and on favorable terms could have a material adverse effect on our growth strategy, financial performance and share price and could require us to delay or abandon development or commercialization plans. In addition, there is a risk that one or more of our service providers, manufacturers or other partners would not survive or be able to meet their commitments to us under such circumstances, which could directly affect our ability to attain our operating goals on schedule and on budget. We have experienced and may in the future experience disruptions as a result of such macroeconomic conditions, including delays or difficulties in initiating or expanding clinical trials and manufacturing sufficient quantities of materials. Any one or a combination of these events could have a material and adverse effect on our results of operations and financial condition.

Current wording

The global economy, including credit and financial markets, has experienced extreme volatility and disruptions recently, including, among other things, diminished liquidity and credit availability, declines in consumer confidence, declines in economic growth, supply chain shortages, increases in inflation rates, higher interest rates, and uncertainty about economic stability. For example, the COVID-19 pandemic resulted in widespread unemployment, economic slowdown and extreme volatility in the capital markets. The Federal Reserve has raised interest rates multiple times in response to concerns about inflation and it may raise them again. Higher interest rates, coupled with reduced government spending and volatility in financial markets, may increase economic uncertainty and affect consumer spending. Similarly, the ongoing military conflict between Israel and Hamas and Russia and Ukraine and increasing tensions between China and Taiwan have created extreme volatility in the global capital markets and may have further global economic consequences, including disruptions of the global supply chain. Any such volatility and disruptions may adversely affect our business or the third parties on whom we rely. If the equity and credit markets deteriorate, including as a result of political unrest or war, it may make any necessary debt or equity financing more difficult to complete, more costly, and more dilutive. Failure to secure any necessary financing in a timely manner and on favorable terms could have a material adverse effect on our growth strategy, financial performance and share price and could require us to delay or abandon development or commercialization plans. In addition, there is a risk that one or more of our service providers, manufacturers or other partners would not survive or be able to meet their commitments to us under such circumstances, which could directly affect our ability to attain our operating goals on schedule and on budget. We have experienced and may in the future experience disruptions as a result of such macroeconomic conditions, including delays or difficulties in initiating or expanding clinical trials and manufacturing sufficient quantities of materials. Any one or a combination of these events could have a material and adverse effect on our results of operations and financial condition.

Previous wording

Despite the implementation of security measures, our internal computer systems, as well as those of third parties on which we rely, are vulnerable to damage from, among other things, computer viruses, malware, unauthorized access, natural disasters, terrorism, war telecommunication and electrical failures, system malfunctions, cyberattacks or cyber-intrusions over the Internet, attachments to emails, phishing attacks, persons inside our organization, or persons with access to systems inside our organization. The risk of a security breach or disruption, particularly through cyberattacks or cyber intrusion, including by computer hackers, foreign governments and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. If such an event were to occur and cause interruptions in our operations, it could lead to the loss, destruction, alteration, prevention of access to, disclosure, dissemination of, or damage or unauthorized access to, our data (including trade secrets or other confidential information, intellectual property, proprietary business information and personal data) or data that is processed or maintained on our behalf, and cause interruptions in our operations, which could result in a material disruption of our product candidate development programs. For example, the loss of preclinical study or clinical trial data from completed, ongoing or planned trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. To the extent that any disruption or security breach were to result in a loss of or damage to our data or applications, or inappropriate disclosure of personal, confidential or proprietary information, we could incur liability and the further development of our product candidates could be delayed.

Current wording

Despite the implementation of security measures, our internal computer systems, as well as those of third parties on which we rely, are vulnerable to damage from, among other things, computer viruses, ransomware and other forms of malware, unauthorized access, natural disasters, terrorism, war telecommunication and electrical failures, system malfunctions, cyberattacks or cyber-intrusions over the Internet, attachments to emails, denial of service attacks, phishing attacks, persons inside our organization, or persons with access to systems inside our organization. The risk of a security breach or disruption, particularly through cyberattacks or cyber intrusion, including by computer hackers, foreign governments and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. If such an event were to occur and cause interruptions in our operations, it could lead to the loss, destruction, alteration, prevention of access to, disclosure, dissemination of, or damage or unauthorized access to, our data (including trade secrets or other confidential information, intellectual property, proprietary business information and personal data) or data that is processed or maintained on our behalf, and cause interruptions in our operations, which could result in a material disruption of our product candidate development programs. For example, the loss, corruption or unavailability of preclinical study or clinical trial data from completed, ongoing or planned trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. To the extent that any disruption or security breach or incident were to result in a loss of or damage to our data or applications, or inappropriate access to, or disclosure or other processing of, personal, confidential or proprietary information, we could incur liability and the further development of our product candidates could be delayed.

Previous wording

In the ordinary course of our business, we collect and store sensitive data, including intellectual property, clinical trial data, proprietary business information, personal data and personally identifiable information of our clinical trial subjects and employees, in our data centers and on our networks. The secure processing, maintenance and transmission of this information is critical to our operations. Despite our security measures, we cannot ensure that our information technology and infrastructure will prevent breakdowns or breaches in our or their systems or other cybersecurity incidents that cause loss, destruction, unavailability, alteration, dissemination of, or damage or unauthorized access to, our data, including personal data, assets and other data processed or maintained on our behalf, that could have a material adverse effect upon our reputation, business, operations or financial condition. Although, to our knowledge, we have not experienced any such material security breach to date, any such breach could compromise our networks and the information stored there could be accessed, publicly disclosed, lost or stolen. Any such access, disclosure or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, significant regulatory penalties, and such an event could disrupt our operations, damage our reputation, and cause a loss of confidence in us and our ability to conduct clinical trials, which could adversely affect our reputation and delay clinical development of our product candidates.

Current wording

In the ordinary course of our business, we collect and store sensitive data, including intellectual property, clinical trial data, proprietary business information, personal data and personally identifiable information of our clinical trial subjects and employees, in our data centers and on our networks. The secure processing, maintenance and transmission of this information is critical to our operations. Despite our security measures, we cannot ensure that our information technology and infrastructure will prevent breakdowns or breaches in our or third-party systems or other cybersecurity incidents that cause loss, destruction, unavailability, alteration, dissemination of, or damage or unauthorized access to, our data, including personal data, assets and other data processed or maintained on our behalf, that could have a material adverse effect upon our reputation, business, operations or financial condition. Although, to our knowledge, we have not experienced any such material security breach to date, any breach or incident could compromise our networks and the information stored there could be accessed, publicly disclosed, lost or stolen. Any such breach or incident could result in legal and regulatory claims or proceedings, liability under laws that protect the privacy of personal information, significant regulatory penalties, and other liabilities, and such an event could disrupt our operations, damage our reputation, and cause a loss of confidence in us and our ability to conduct clinical trials, which could adversely affect our reputation and delay clinical development of our product candidates.

Previous wording

To the extent that any disruption or security breach were to result in a loss of or damage to our data or applications, or inappropriate disclosure of confidential or proprietary information or personal data, we could incur material legal claims and liability and damage to our reputation, and the further development of our product candidates could be delayed. Any such event could also compel us to comply with federal and state breach notification laws, and foreign law equivalents, subject us to mandatory corrective action and otherwise subject us to substantial liability under laws, rules, regulations and standards that protect the privacy and security of personal data, which could result in significant legal and financial exposure and reputational damages that could potentially have an adverse effect on our business.

Current wording

To the extent that any disruption or security breach were to result in a loss of or damage to our data or applications, or inappropriate access to, or disclosure or other processing of, confidential or proprietary information or personal data, we could incur material legal claims and liability and damage to our reputation, and the further development of our product candidates could be delayed. Any such event could also compel us to comply with federal and state breach notification laws, and foreign law equivalents, subject us to mandatory corrective action and otherwise subject us to substantial liability, which could result in significant legal and financial exposure and reputational damages that could potentially have an adverse effect on our business.

Previous wording

Notifications and follow-up actions related to a data breach or other security incident could impact our reputation and cause us to incur significant costs, including significant legal expenses and remediation costs. We expect to incur significant costs in an effort to detect and prevent security incidents, and we may face increased costs and requirements to expend substantial resources in the event of an actual or perceived security incident. However, we cannot guarantee that we will be able to detect or prevent any such incidents, or that we can remediate any such incidents in an effective or timely manner. Our efforts to improve security and protect data from compromise may also identify previously undiscovered instances of data breaches or other cybersecurity incidents. To the extent that any data breach, disruption or security incident were to result in any loss, destruction, or alteration of, damage, unauthorized access to or inappropriate or unauthorized disclosure or dissemination of, our data, including personal data, or other information that is processed or maintained on our behalf, we could be exposed to litigation and governmental investigations and inquiries, the further development and commercialization of our product candidates could be delayed, and we could be subject to significant fines or penalties for any noncompliance with applicable state, federal and foreign privacy and security laws, rules, regulations and standards.

Current wording

Notifications and follow-up actions related to a data breach or other security incident could impact our reputation and cause us to incur significant costs, including significant legal expenses and remediation costs. We expect to incur significant costs in an effort to detect and prevent security incidents, and we may face increased costs and requirements to expend substantial resources in the event of an actual or perceived security incident. However, we cannot guarantee that we will be able to detect or prevent any such incidents, or that we can remediate any such incidents in an effective or timely manner. Our efforts to improve security and protect data from compromise may also identify previously undiscovered instances of data breaches or other cybersecurity incidents. To the extent that any data breach, disruption or security incident were to result in any loss, destruction, or alteration of, damage, unauthorized access to or inappropriate or unauthorized disclosure, dissemination or other processing of, our data, including personal data, or other information that is processed or maintained on our behalf, we could be exposed to litigation and governmental investigations and inquiries, the further development and commercialization of our product candidates could be delayed, and we could be subject to significant fines or penalties for any noncompliance with applicable state, federal and foreign privacy and security laws, rules, regulations and standards.