Annexon Inc

Previous wording

We have had significant operating losses since our inception. Our net loss for the years ended December 31, 2023 and 2022 was approximately $134.2 million and $141.9 million, respectively. As of December 31, 2023, we had an accumulated deficit of $572.5 million. Substantially all of our losses have resulted from expenses incurred in connection with our research and development programs and from general and administrative costs associated with our operations. We expect to continue to incur losses for the foreseeable future, and we anticipate these losses will continue as we develop our product candidates, conduct clinical trials and pursue research and development activities. Even if we achieve profitability in the future, we may not be able to sustain profitability in subsequent periods. Our prior losses, combined with expected future losses, have had and will continue to have an adverse effect on our stockholders’ equity and working capital.

Current wording

We have had significant operating losses since our inception. Our net loss for the years ended December 31, 2024 and 2023 was approximately $138.2 million and $134.2 million, respectively. As of December 31, 2024, we had an accumulated deficit of $710.7 million. Substantially all of our losses have resulted from expenses incurred in connection with our research and development programs and from general and administrative costs associated with our operations. We expect to continue to incur losses for the foreseeable future, and we anticipate these losses will continue as we develop our product candidates, conduct clinical trials and pursue research and development activities. Even if we achieve profitability in the future, we may not be able to sustain profitability in subsequent periods. Our prior losses, combined with expected future losses, have had and will continue to have an adverse effect on our stockholders’ equity and working capital.

Previous wording

As of December 31, 2023, we had capital resources consisting of cash and cash equivalents and short-term investments of approximately $259.7 million. We expect our existing capital resources to fund our planned operating expenses into mid-2026. However, our operating plans may change as a result of many factors currently unknown to us, and we may need to seek additional funds sooner than planned through public or private equity offerings or debt financings or other sources, such as strategic collaborations. Such financing may result in dilution to our stockholders, imposition of burdensome debt covenants and repayment obligations, or other restrictions that may affect our business. In addition, we may seek additional capital due to favorable market conditions or strategic considerations even if we believe we have sufficient funds for our current or future operating plans.

Current wording

As of December 31, 2024, we had capital resources consisting of cash and cash equivalents and short-term investments of approximately $312.0 million. We expect our existing capital resources to fund our planned operating expenses into the second half of 2026. However, our operating plans may change as a result of many factors currently unknown to us, and we may need to seek additional funds sooner than planned through public or private equity offerings or debt financings or other sources, such as strategic collaborations. Such financing may result in dilution to our stockholders, imposition of burdensome debt covenants and repayment obligations, or other restrictions that may affect our business. In addition, we may seek additional capital due to favorable market conditions or strategic considerations even if we believe we have sufficient funds for our current or future operating plans.

Previous wording

We are currently focused on developing product candidates to address classical complement-mediated autoimmune and neurodegenerative diseases. We seek to maintain a process of prioritization and resource allocation among our programs to balance time, risk and cost, due to the significant resources required for the development of our product candidates. For example, in 2023, based on clinical data, regulatory feedback, and cash runway considerations, we prioritized our resources to advance ANX005 in GBS, ANX007 in GA and ANX1502 in autoimmune diseases. In addition, we have designed a two-part global registrational program for ANX007 in GA, including the Phase 3 ARCHER II global sham-controlled trial and a second injection-controlled head-to-head study, ARROW, against SYFOVRE®. Our current cash and cash equivalents are sufficient to fund our operations into mid-2026. However, we will need to raise additional capital in order to complete the ARROW trial. If sufficient funding is not available, we may not be able to complete our planned clinical trials, or on the timelines we currently anticipate, and we may need to redesign, reduce the scope of or terminate some of our programs.

Current wording

We are currently focused on developing product candidates to address classical complement-mediated autoimmune and neurodegenerative diseases. We seek to maintain a process of prioritization and resource allocation among our programs to balance time, risk and cost, due to the significant resources required for the development of our product candidates. Our resources are currently focused on advancing ANX005 in GBS, ANX007 in GA and ANX1502 in autoimmune diseases. If sufficient funding is not available, we may not be able to complete our planned clinical trials, or on the timelines we currently anticipate, and we may need to redesign, reduce the scope of or terminate some of our programs.

Previous wording

Conducting a global, two-trial program in GA will be expensive and time consuming, and even if favorable, the FDA and comparable foreign regulatory authorities may not accept data from one or both of our trials in our global Phase 3 clinical program for ANX007.

Current wording

Conducting a global Phase 3 program for ANX007 in patients with dry AMD with GA will be expensive and time consuming, and we may need additional capital to complete the Phase 3 clinical program and even if favorable, the FDA and comparable foreign regulatory authorities may not accept data from our Phase 3 program.

Previous wording

Conducting two large Phase 3 trials in multiple jurisdictions is expensive and can take many years to complete, and we cannot guarantee that clinical trials will be conducted as planned or completed timely, if at all. In addition, there are two FDA-approved therapies for GA in the United States, which may adversely impact our ability to recruit patients into our clinical trials. We may need additional capital to complete both the ARCHER II and ARROW clinical trials and may not be able to raise sufficient capital in a timely manner. The occurrence of any such events could delay either trial, prevent us from completing one or more of our clinical trials, seeking FDA approval of ANX007 for GA, if ever, and could delay or prevent commercialization of ANX007.

Current wording

Conducting large Phase 3 trials in multiple jurisdictions is expensive and can take many years to complete, and we cannot guarantee that clinical trials will be conducted as planned or completed timely, if at all. In addition, there are two FDA-approved therapies for GA in the United States, which may adversely impact our ability to recruit patients into our clinical trials. Our timeline and costs for ARCHER II could be substantially longer and larger than we initially planned. We may need additional capital to complete the Phase 3 clinical program for ANX007 and may not be able to raise sufficient capital in a timely manner. The occurrence of any such events could delay either trial, prevent us from completing our clinical trials, prevent us from seeking FDA approval of ANX007, if ever, and could delay or prevent commercialization of ANX007.

Previous wording

Our business is heavily dependent on the successful development, regulatory approval and commercialization of our product candidates, which are in early stages of clinical development.

Current wording

Our business is heavily dependent on the successful development, regulatory approval and commercialization of our product candidates, some of which are in early stages of clinical development.

Previous wording

We have no products approved for sale, and our product candidates are in early stages of clinical development. The success of our business, including our ability to finance our company and generate revenue in the future, will primarily depend on the successful development, regulatory approval and commercialization of our product candidates and, in particular, the advancement of our current clinical-stage product candidates. However, given the stage of development of our product candidates, it may be many years, if we succeed at all, before we have demonstrated the safety, purity, potency and/or efficacy of a product candidate sufficient to warrant approval for commercialization. We cannot be certain that our product candidates will receive regulatory approval or be successfully commercialized even if we receive regulatory approval.

Current wording

We have no products approved for sale, and several of our product candidates are in early stages of clinical development. The success of our business, including our ability to finance our company and generate revenue in the future, will primarily depend on the successful development, regulatory approval and commercialization of our product candidates and, in particular, the advancement of our current clinical-stage product candidates. However, given the stage of development of our product candidates, it may be many years, if we succeed at all, before we have demonstrated the safety, purity, potency and/or efficacy of a product candidate sufficient to warrant approval for commercialization. We cannot be certain that our product candidates will receive regulatory approval or be successfully commercialized even if we receive regulatory approval.

Previous wording

In addition, if a product receives the first FDA approval for the indication for which it has orphan designation, the product is entitled to Orphan Drug exclusivity, which means the FDA may not approve any other application to market the same drug for the same disease or condition for a period of seven years, except in limited circumstances, such as a showing of clinical superiority over the product with Orphan exclusivity or where the manufacturer is unable to assure sufficient product quantity the orphan patient population. Exclusive marketing rights in the United States may also be unavailable if we or our collaborators seek approval for an indication broader than the orphan designated indication and may be lost if the FDA later determines that the request for designation was materially defective. In the EU, Orphan Drug designation entitles a party to financial incentives such as reduction of fees or fee waivers and ten years of market exclusivity following drug or biological product approval. This period may be reduced to six years if the Orphan Drug designation criteria are no longer met, including where it is shown that the product is sufficiently profitable to not justify maintenance of market exclusivity.

Current wording

In addition, if a product receives the first FDA approval for the indication for which it has orphan designation, the product is entitled to Orphan Drug exclusivity, which means the FDA may not approve any other application to market the same drug for the same disease or condition for a period of seven years, except in limited circumstances, such as a showing of clinical superiority over the product with Orphan exclusivity or where the manufacturer is unable to assure sufficient product quantity to the orphan patient population. Exclusive marketing rights in the United States may also be unavailable if we or our collaborators seek approval for an indication broader than the orphan designated indication and may be lost if the FDA later determines that the request for designation was materially defective. In the EU, Orphan Drug designation entitles a party to financial incentives such as reduction of fees or fee waivers and ten years of market exclusivity following drug or biological product approval. This period may be reduced to six years if the Orphan Drug designation criteria are no longer met, including where it is shown that the product is sufficiently profitable to not justify maintenance of market exclusivity.

Previous wording

We conduct clinical trials of our product candidates outside the United States, and plan to continue to do so. For example, we conducted our Phase 1b GBS clinical trial of ANX005 in Bangladesh, and are conducting our Phase 3 clinical trial of ANX005 in patients with GBS exclusively at sites in Southeast Asia. We have also designed a global Phase 3 program for ANX007 in GA. The acceptance of study data from clinical trials conducted outside the United States or the applicable jurisdiction by the FDA and comparable foreign regulatory authorities may be subject to certain conditions, or may not be accepted at all.

Current wording

We conduct clinical trials of our product candidates outside the United States, and plan to continue to do so. For example, we conducted our Phase 1b GBS clinical trial of ANX005 in Bangladesh, and have completed our Phase 3 clinical trial of ANX005 in patients with GBS at sites in Bangladesh and the Philippines. We are also conducting a global Phase 3 program for ANX007 in dry AMD with GA. The acceptance of study data from clinical trials conducted outside the United States or the applicable jurisdiction by the FDA and comparable foreign regulatory authorities may be subject to certain conditions, or may not be accepted at all.

Previous wording

GBS have been conducted exclusively at sites outside the United States, we are conducting a RWE study to assess comparability of disease populations in the US and ex-US using a large natural history database from the International Guillain-Barré syndrome Outcome Study (IGOS). Published data from IGOS presents baseline characteristics of GBS patients in various jurisdictions and patient outcomes at certain timepoints over the course of their disease. We intend to use the RWE study as part of our registration package in support of the ANX005 BLA. Conducting this RWE study may be expensive, or may result in delays of our BLA and any regulatory approval of ANX005. Any such expenses or delays may adversely impact our business and operations and may negatively impact our stock price. In addition, the results of this RWE study may not provide sufficient support of the comparability between the disease populations in the US and ex-US and thus may not be acceptable to the FDA as part of our BLA, which could adversely affect regulatory approval of ANX005.

Current wording

To support data from clinical trials conducted in foreign jurisdictions, applicants may submit clinical evidence, clinical trials, patient registries or other sources of RWE, such as electronic health records or the collection of larger confirmatory data sets. In particular, because all of our studies to date for ANX005 in GBS have been conducted at sites outside the United States, we have conducted a RWE study to assess comparability of disease populations in the US and ex-US using a large natural history database from IGOS. Published data from IGOS presents baseline characteristics of GBS patients in various jurisdictions and patient outcomes at certain timepoints over the course of their disease. We intend to use the results of the RWE study along with any other requested information for generalizability of Southeast Asian patients to a Western population as part of our data package in support of the ANX005 BLA. However, the FDA may not agree that the current data package is sufficient to accept for filing a BLA and we may receive a refusal to file letter and be required to conduct additional clinical trials of ANX005 for GBS prior to resubmission of a BLA, which would result in delays in our application process and increase our expenses, and delay or prevent commercialization of ANX005 in GBS. Even if accepted for filing by the FDA, any such BLA could be the subject of a complete response letter rather than approval, which would increase our expenses and delay or prevent commercialization of ANX005 in GBS.

Previous wording

In addition, we expect to conduct a global registrational program of ANX007 for the treatment of GA. To accomplish this objective, we must obtain and maintain regulatory approvals and comply with regulatory requirements in each jurisdiction. We are in ongoing discussions with the relevant regulatory authorities. While we believe we have designed a global clinical development program that could satisfy the regulators in all of our target markets, there is no assurance that our efforts will be successful or that the various regulators will be aligned or accept the data from the pivotal Phase 3 program are sufficient to warrant approval of ANX007.

Current wording

In addition, we are conducting a global registrational program of ANX007 for the treatment of dry AMD with GA. To accomplish this objective, we must obtain and maintain regulatory approvals and comply with regulatory requirements in each jurisdiction. We are in ongoing discussions with the relevant regulatory authorities. While we believe we have designed a global clinical development program that could satisfy the regulators in all of our target markets, there is no assurance that our efforts will be successful or that the various regulators will be aligned or accept the data from the Phase 3 program are sufficient to warrant approval of ANX007.

Previous wording

Certain alternative treatments offered by competitors may be available at lower prices and may offer greater efficacy or better safety profiles. Furthermore, currently approved products could be discovered to have application for the intended indication of our product candidates, which could give such products significant regulatory and market timing advantages over any of our product candidates. Our competitors also may obtain FDA, EMA, or other regulatory approval for their products more rapidly than we may obtain approval for ours and may obtain orphan product exclusivity from the FDA for indications our product candidates are targeting, which could result in our competitors establishing a strong market position before we are able to enter the market. For example, with respect to ANX007, there are two approved products for GA which may pose significant competition for ANX007, if approved. For additional information regarding our competition, see the section titled “Business—Competition” in this Annual Report on Form 10-K.

Current wording

Certain alternative treatments offered by competitors may be available at lower prices and may offer greater efficacy or better safety profiles. Furthermore, currently approved products could be discovered to have application for the intended indication of our product candidates, which could give such products significant regulatory and market timing advantages over any of our product candidates. Our competitors also may obtain FDA, EMA, or other regulatory approval for their products more rapidly than we may obtain approval for ours and may obtain orphan product exclusivity from the FDA for indications our product candidates are targeting, which could result in our competitors establishing a strong market position before we are able to enter the market. For example, with respect to ANX007, there are two approved products for GA which may pose competition for ANX007, if approved. For additional information regarding our competition, see the section titled “Business—Competition” in this Annual Report on Form 10-K.

Previous wording

As of December 31, 2023, we had 71 full-time employees. We will need to continue to expand our managerial, operational, finance and other resources in order to manage our operations and clinical trials, continue our development activities and commercialize our product candidates or any future product candidates. Our management and personnel, systems and facilities currently in place may not be adequate to support this future growth. Our need to effectively execute our growth strategy requires that we:

Current wording

As of December 31, 2024, we had 100 full-time employees. We will need to continue to expand our managerial, operational, finance and other resources in order to manage our operations and clinical trials, continue our development activities and commercialize our product candidates or any future product candidates. Our management and personnel, systems and facilities currently in place may not be adequate to support this or any future growth. Our need to effectively execute our growth strategy requires that we:

Previous wording

Manufacturers and manufacturers’ facilities are required to comply with extensive FDA and comparable foreign regulatory authority requirements, including ensuring that quality control and manufacturing procedures conform to cGMP regulations. As such, we and our contract manufacturers will be subject to continual review and inspections to assess compliance with cGMPs and adherence to commitments made in any approved marketing application.

Current wording

Manufacturers and manufacturers’ facilities are required to comply with extensive FDA and comparable foreign regulatory authority requirements, including ensuring that quality control and manufacturing procedures conform to cGMP regulations. As such, we and our contract manufacturers will be subject to continual review and inspections to assess compliance with cGMPs and adherence to commitments made in any approved marketing application. Accordingly, we and others with whom we work must continue to expend time, money and effort in all areas of regulatory compliance, including manufacturing, production and quality control.

Previous wording

In the United States, the EU and other jurisdictions, there have been, and we expect there will continue to be, a number of legislative and regulatory changes and proposed changes to the healthcare system that could affect our future results of operations. In particular, there have been and continue to be a number of initiatives at the U.S. federal and state levels that seek to reduce healthcare costs and improve the quality of healthcare. For example, in March 2010, the Patient Protection and Affordable Care Act, as amended by the Health Care and Education Reconciliation Act, or collectively the ACA, was enacted, which substantially changed the way healthcare is financed by both governmental and private insurers. Among the provisions of the ACA, those of greatest importance to the pharmaceutical, biopharmaceutical and biotechnology industries include the following:

Current wording

In the United States, the EU and other jurisdictions, there have been, and we expect there will continue to be, a number of legislative and regulatory changes and proposed changes to the healthcare system that could affect our future results of operations. In particular, there have been and continue to be a number of initiatives at the U.S. federal and state levels that seek to reduce healthcare costs and improve the quality of healthcare. For example, in March 2010, the Patient Protection and Affordable Care Act, as amended by the Health Care and Education Reconciliation Act, or collectively the ACA, was enacted, which substantially changed the way healthcare is financed by both governmental and private insurers. The ACA, among other things: (i) increased the minimum Medicaid rebates owed by manufacturers under the Medicaid Drug Rebate Program and extends the rebate program to individuals enrolled in Medicaid managed care organizations; (ii) established an annual, nondeductible fee on any entity that manufactures or imports certain specified branded prescription drugs and biologic agents apportioned among these entities according to their market share in some government healthcare programs; (iii) expanded the availability of lower pricing under the 340B drug pricing program by adding new entities to the program; (iv) increased the statutory minimum rebates a manufacturer must pay under the Medicaid Drug Rebate Program, to 23.1% and 13% of the average manufacturer price for most branded and generic drugs, respectively and capped the total rebate amount for innovator drugs at 100% of the Average Manufacturer Price, or AMP; (v) expanded the eligibility criteria for Medicaid programs by, among other things, allowing states to offer Medicaid coverage to additional individuals and by adding new mandatory eligibility categories for individuals with income at or below 133% of the federal poverty level, thereby potentially increasing manufacturers’ Medicaid rebate liability; (vi) created a new Patient-Centered Outcomes Research Institute to oversee, identify priorities in, and conduct comparative clinical effectiveness research, along with funding for such research; and (vii) established a Center for Medicare and Medicaid Innovation at the CMS to test innovative payment and service delivery models to lower Medicare and Medicaid spending, potentially including prescription drug spending.

Previous wording

Other legislative changes have been proposed and adopted in the United States since the ACA was enacted. On March 11, 2021, the American Rescue Plan Act of 2021 was signed into law, which eliminates the statutory Medicaid drug rebate cap, currently set at 100% of a drug’s average manufacturer price, or AMP, beginning January 1, 2024. Moreover, payment methodologies may be subject to changes in healthcare legislation and regulatory initiatives. For example, CMS may develop new payment and delivery models, such as bundled payment models.

Current wording

Other legislative changes have been proposed and adopted in the United States since the ACA was enacted. On March 11, 2021, the American Rescue Plan Act of 2021 was signed into law, which eliminates the statutory Medicaid drug rebate cap, currently set at 100% of a drug’s AMP, effective January 1, 2024. Moreover, payment methodologies may be subject to changes in healthcare legislation and regulatory initiatives. For example, CMS may develop new payment and delivery models, such as bundled payment models.

Previous wording

In addition, recently there has been heightened governmental scrutiny over the manner in which manufacturers set prices for their marketed products, which has resulted in several U.S. Congressional inquiries and proposed and enacted federal and state legislation designed to, among other things, bring more transparency to drug pricing, reduce the cost of prescription drugs under government payor programs, and review the relationship between pricing and manufacturer patient programs. Most recently, on August 16, 2022, the Inflation Reduction Act of 2022, or IRA, was signed into law. Among other things, the IRA requires manufacturers of certain drugs to engage in price negotiations with Medicare (beginning in 2026), with prices that can be negotiated subject to a cap; imposes rebates under Medicare Part B and Medicare Part D to penalize price increases that outpace inflation (first due in 2023); and replaces the Part

Current wording

In addition, recently there has been heightened governmental scrutiny over the manner in which manufacturers set prices for their marketed products, which has resulted in several U.S. Congressional inquiries and proposed and enacted federal and state legislation designed to, among other things, bring more transparency to drug pricing, reduce the cost of prescription drugs under government payor programs, and review the relationship between pricing and manufacturer patient programs. Most recently, the IRA, among other things, (1) directs the U.S. Department of Health and Human Services, or HHS to negotiate the price of certain single-source drugs and biologics that have been on the market for at least 7 years covered under Medicare, or the Medicare Drug Price Negotiation Program, and (2) imposes rebates under Medicare Part B and Medicare Part D to penalize price increases that outpace inflation. These provisions began to take effect beginning fiscal year 2023. On August 15, 2024, HHS announced the agreed-upon reimbursement price of the first ten drugs that were subject to price negotiations, although the Medicare Drug Price Negotiation Program is currently subject to legal challenges. On January 17, 2025, HHS selected fifteen additional products covered under Part D for price negotiation in 2025. Each year thereafter more Part B and Part D products will become subject to the Medicare Drug Price Negotiation Program. The IRA permits the Secretary of HHS to implement many of these provisions through guidance, as opposed to regulation, for the initial years. We expect that additional U.S. federal healthcare reform measures will be adopted in the future, particularly in light of the recent change in administration, any of which could limit the amounts that the U.S. federal government will pay for healthcare products and services, which could result in reduced demand for our product candidates or additional pricing pressures.

Previous wording

the U.S. federal civil and criminal Anti-Kickback Statute, which prohibits, among other things, persons or entities from knowingly and willfully soliciting, offering, receiving or providing any remuneration (including any kickback, bribe, or certain rebate), directly or indirectly, overtly or covertly, in cash or in kind, to induce or reward, or in return for, either the referral of an individual for, or the purchase, lease, order or recommendation of, any good, facility, item or service, for which payment may be made, in whole or in part, under U.S. federal and state healthcare programs such as Medicare and Medicaid. A person or entity does not need to have actual knowledge of the statute or specific intent to violate it in order to have committed a violation;

Current wording

the U.S. federal civil and criminal Anti-Kickback Statute, which prohibits, among other things, persons or entities from knowingly and willfully soliciting, offering, receiving or providing any remuneration (including any kickback, bribe, or certain rebate), directly or indirectly, overtly or covertly, in cash or in kind, to induce or reward, or in return for, either the referral of an individual for, or the purchase, lease, order or recommendation of, any good, facility, item or service, for which payment may be made, in whole or in part, under U.S. federal and state healthcare programs such as Medicare and Medicaid. A person or

Previous wording

We are subject to Section 404 of the Sarbanes-Oxley Act, or Section 404, and the related rules of the SEC, which generally require our management and independent registered public accounting firm to report on the effectiveness of our internal control over financial reporting. Pursuant to Section 404(a), we are required to file with the SEC an annual management assessment of the effectiveness of our internal control over financial reporting. Because we re-qualified as a smaller reporting company and we have less than $100 million in annual revenue, as of December 31, 2023, we are a non-accelerated filer and are no longer be required to comply with the auditor attestation requirements regarding the effectiveness of our internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act until we become an accelerated filer or large accelerated filer.

Current wording

We are subject to Section 404 of the Sarbanes-Oxley Act, or Section 404, and the related rules of the SEC, which generally require our management and independent registered public accounting firm to report on the effectiveness of our internal control over financial reporting. Pursuant to Section 404(a), we are required to file with the SEC an annual management assessment of the effectiveness of our internal control over financial reporting. Because we re-qualified as a smaller reporting company and we have less than $100 million in annual revenue, as of December 31, 2024, we are a non-accelerated filer and are not required to comply with the auditor attestation requirements regarding the effectiveness of our internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act until we become an accelerated filer or large accelerated filer.

Previous wording

We may from time to time issue additional shares of common stock, and as a result, our stockholders would experience immediate dilution. In addition, as opportunities present themselves, we may enter into financing or similar arrangements in the future, including the issuance of debt securities, preferred stock or common stock. For example, in August 2021, we entered into a sales agreement with Cowen and Company LLC, or TD Cowen, as sales agent, pursuant to which we may issue and sell shares of our common stock for an aggregate maximum offering price of $100.0 million under an at-the-market offering program under which we have sold approximately $48.0 million of shares of our common stock as of the date of this Annual Report on Form 10-K. In addition, in July 2022 and December 2023, we closed financings which included the sale of pre-funded warrants or common warrants to purchase shares of our common stock. Until exercised, the shares issuable upon the exercise of the pre-funded warrants or the common warrants are not included in the number of our outstanding shares of common stock. If we issue common stock or securities convertible into common stock in the future, our stockholders would experience additional dilution and such dilutive impact may be difficult to compute.

Current wording

We may from time to time issue additional shares of common stock, and as a result, our stockholders would experience immediate dilution. In addition, as opportunities present themselves, we may enter into financing or similar arrangements in the future, including the issuance of debt securities, preferred stock or common stock. For example, in March 2024, we entered into a sales agreement with Cowen and Company LLC, or TD Cowen, as sales agent, pursuant to which we may issue and sell shares of our common stock for an aggregate maximum offering price of $100.0 million under an at-the-market offering program under which we have sold approximately $4.5 million of shares of our common stock as of the date of this Annual Report on Form 10-K. In addition, in July 2022, December 2023, and June 2024, we closed financings which included the sale of pre-funded warrants or common warrants to purchase shares of our common stock. Until exercised, the shares issuable upon the exercise of the pre-funded warrants or the common warrants are not included in the number of our outstanding shares of common stock. If we issue common stock or securities convertible into common stock in the future, our stockholders would experience additional dilution and such dilutive impact may be difficult to compute.

Previous wording

If our existing stockholders sell, or indicate an intention to sell, substantial amounts of our common stock in the public market, the stock price of our common stock could decline. As of December 31, 2023, the number of shares of our common stock outstanding was 78,369,099. This number does not include 40,492,923 shares of common stock issuable upon the exercise of pre-funded warrants or 8,427,508 shares of common stock issuable upon the exercise of common warrants. Sales of a substantial number of shares of our common stock in the public market, or the perception that these sales might occur, may reduce the stock price of our common stock.

Current wording

If our existing stockholders sell, or indicate an intention to sell, substantial amounts of our common stock in the public market, the stock price of our common stock could decline. As of December 31, 2024, the number of shares of our common stock outstanding was 109,381,556. This number does not include 38,543,577 shares of common stock issuable upon the exercise of pre-funded warrants or 8,104,615 shares of common stock issuable upon the exercise of common warrants. On August 12, 2024, we filed a resale registration statement on Form S-3, pursuant to which, entities and trusts affiliated with Muneer Satter, a member of our board of directors, can sell up to 3,000,000 shares of common stock. Sales of a substantial number of shares of our common stock in the public market, or the perception that these sales might occur, may reduce the stock price of our common stock.

Previous wording

We completed a study through December 31, 2023, to determine whether an ownership change had occurred under Section 382 or 383 of the Code, and we determined that ownership changes occurred in 2011, 2014, 2020 and 2023. The Company has identified $0.1 million and $34.7 million of federal and state NOLs, respectively, that will expire unused due to ownership changes, and federal credits of $3.7 million that will not be able to be utilized due to ownership change limitation and excluded these amounts from deferred tax asset balances as of December 31, 2023. Federal NOLs of $321.9 million and state and local NOLs of $71.3 million are not expected to expire unutilized as a result of ownership changes identified through December 31, 2023.

Current wording

We completed a study through December 31, 2024, to determine whether an ownership change had occurred under Section 382 or 383 of the Code, and we determined that ownership changes occurred in 2011, 2014, 2020 and 2023. We have identified $0.1 million and $34.7 million of federal and state NOLs, respectively, that will expire unused due to ownership changes, and federal credits of $4.3 million that will not be able to be utilized due to ownership change limitation and excluded these amounts from deferred tax asset balances as of December 31, 2024. Federal NOLs of $367.6 million and state and local NOLs of $189.2 million are not expected to expire unutilized as a result of ownership changes identified through December 31, 2024.

Previous wording

We collect and maintain information in digital and other forms that is necessary to conduct our business, and we are increasingly dependent on information technology systems and infrastructure to operate our business. In the ordinary course of our business, we and the third parties upon which we rely process sensitive data. We have established physical, electronic and organizational measures designed to safeguard and secure our systems to prevent a data compromise; there can, however, be no assurance that these measures will be effective. We have also outsourced elements of our information technology infrastructure, and as a result a number of third-party vendors may have access to our sensitive data. Our information technology systems and infrastructure, and those of any future collaborators and our contractors, consultants, vendors and other third parties on which we rely, are vulnerable to and have experienced attack, damage and interruption from cyber-attacks, malicious internet-based activity, online and offline fraud, computer viruses, malware (e.g., ransomware), credential stuffing, credential harvesting, supply-chain attacks, natural disasters, fire, terrorism, war, telecommunication and electrical failures, attacks enhanced or facilitated by AI, denial or degradation of service attacks, hacking, sophisticated nation-state and nation-state supported actors, phishing and other social engineering attacks (including through deep fakes, which may be increasingly more difficult to identify), attachments to emails, fraud, personnel misconduct or error, server malfunctions, software or hardware failures, loss or theft of data or information technology assets, unauthorized access or use, and other similar threats. In particular, ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of sensitive data, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.

Current wording

We collect and maintain information in digital and other forms that is necessary to conduct our business, and we are increasingly dependent on information technology systems and infrastructure to operate our business. In the ordinary course of our business, we and the third parties with whom we work process sensitive data. We have established physical, electronic and organizational measures designed to safeguard and secure our systems in an effort to prevent a data compromise; there can, however, be no assurance that these measures will be or have been effective. We have also outsourced elements of our information technology infrastructure, and as a result a number of third-party vendors have access to our sensitive data. Our information technology systems and infrastructure, and those of any future collaborators and our contractors, consultants, vendors and other third parties with whom we work, are vulnerable to and have experienced attacks, damage and interruption from cyber-attacks, malicious internet-based activity, online and offline fraud, computer viruses, malware (e.g., ransomware), credential stuffing, credential harvesting, supply-chain attacks, natural disasters, fire, terrorism, war, telecommunication and electrical failures, attacks enhanced or facilitated by AI, denial or degradation of service attacks, hacking, sophisticated nation-state and nation-state supported actors, phishing and other social engineering attacks (including through deep fakes, which are increasingly more difficult to identify), attachments to emails, fraud, personnel misconduct or error, server malfunctions, software or hardware failures, loss or theft of data or information technology assets, unauthorized access or use, and other similar threats. In particular, ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of sensitive data, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.

Previous wording

The risk of a security breach or disruption, particularly through cyber-attacks, including by computer hackers, foreign governments and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. The prevalent use of mobile devices that access sensitive data also increases the risk of lost or stolen devices, security incidents and data security breaches, which could lead to the loss or other compromise of sensitive data. As a result of any global health crisis such as the COVID-19 pandemic and continued hybrid working environment, we may also face increased risks of a security breach or disruption due to our reliance on internet technology and the number of our personnel who are working remotely, which may create additional opportunities for cyber criminals to exploit vulnerabilities or other weaknesses. Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. We may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program. Furthermore, because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. We may also experience security breaches that may remain undetected for an extended period. Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers increasingly using tools and techniques that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence.

Current wording

The risk of a security breach or disruption, particularly through cyber-attacks, including by computer hackers, foreign governments and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. The prevalent use of mobile devices that access sensitive data also increases the risk of lost or stolen devices, security incidents and data security breaches, which could lead to the loss or other compromise of sensitive data. In a hybrid working environment, we also face risks of a security breach or disruption due to our reliance on internet technology and the number of our personnel who are working remotely, which creates additional opportunities for cyber criminals to exploit vulnerabilities or other weaknesses. Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. We may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program. Furthermore, because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. Security breaches may remain undetected for an extended period. Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers increasingly using tools and techniques that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence.

Previous wording

We rely upon third-party service providers and technologies to operate critical business systems and process sensitive data in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, encryption and authentication technology, employee email, and other functions. Our ability to monitor these third parties’ security practices is limited, and these third parties may not have adequate security measures in place. Our third-party service providers have experienced and may experience in the future a security incident or other interruption. For example, one of our third-party drug component suppliers experienced a cyber-attack, which did not materially impact our operations. In addition, in 2024, one of our vendors experienced a cyber-attack which resulted in our access to the third-party system being unavailable to us for a brief period of time before being restored. We continue to monitor the incident and have implemented mitigating procedures designed to limit any potential impacts on our operations. These types of incidents have and could lead to business interruption and additional costs. Any significant system failure, accident or security breach and resulting interruptions in our operations or our critical third parties’ operations could result in a material disruption of our product development programs, and ultimately, our financial results. For example, the loss of clinical trial data from completed or ongoing or planned clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

Current wording

We rely upon third-party service providers and technologies to operate critical business systems and process sensitive data in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, encryption and authentication technology, employee email, and other functions. Ourability to monitor these third parties’ security practices is limited, and these third parties may not have adequate security measures in place. Our third-party service providers have experienced and may experience in the future a security incident or other interruption. For example, one of our third-party drug component suppliers experienced a cyber-attack, which did not materially impact our operations. In addition, in 2024, one of our vendors experienced a cyber-attack which resulted in our access to the third-party system being unavailable to us for a brief period of time before being restored, which we concluded did not materially impact our operations or clinical data. These and similar incidents have and could lead to business interruptions and additional costs. Any significant system failure, accident or security breach and resulting interruptions in our operations or our critical third parties’ operations could result in a material disruption of our product development programs, and ultimately, our financial results. For example, the loss of clinical trial data from completed or ongoing or planned clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

Previous wording

The costs to us to investigate, mitigate and remediate security incidents, breaches, disruptions, network security problems, bugs, viruses, worms, malicious software programs and security vulnerabilities could be significant, and while we have implemented security measures designed to protect our data security and information technology systems and sensitive data, our efforts to address these problems may not be successful, and these problems could result in unexpected interruptions, delays, cessation of service, negative publicity and other harm to our business and our competitive position. Any security compromise affecting us or the third parties upon which we rely, our partners or our industry, whether real or perceived, could harm our reputation, erode confidence in the effectiveness of our security measures and lead to regulatory scrutiny. Moreover, if a security breach affects our systems or results in the unauthorized access to or unauthorized use, disclosure, release or other processing of sensitive data, it may be necessary to notify individuals, governmental authorities, supervisory bodies, the media and other parties pursuant to privacy and security laws or other obligations, and our reputation could be materially damaged. We would also be exposed to a risk of loss, governmental investigations or enforcement, or litigation (including class claims) and other potential liability, which could materially adversely affect our business, results of operations and financial condition. We maintain cyber liability insurance; however, this insurance may not be sufficient to cover the financial, legal, business or reputational losses that may result from an interruption or breach of our systems.

Current wording

We may expend significant resources or modify our business activities (including our clinical trial activities) to try to protect against security incidents. The costs to us to prevent, investigate, mitigate and remediate security incidents, breaches, disruptions, network security problems, bugs, viruses, worms, malicious software programs and security vulnerabilities could be significant, and while we have implemented security measures designed to protect our data security and information technology systems and sensitive data, our efforts to address these problems may not be successful, and these problems have and may in the future result in unexpected interruptions, delays, cessation of service, negative publicity and other harm to our business and our competitive position. Any security compromise affecting us or the third parties with whom we work, or our industry, whether real or perceived, could harm our reputation, erode confidence in the effectiveness of our security measures and lead to regulatory scrutiny. Moreover, if a security breach affects our systems or results in the unauthorized access to or unauthorized use, disclosure, release or other processing of sensitive data, we may be required, or we may voluntarily choose, to notify individuals, governmental authorities, supervisory bodies, the media and other parties, or to take other actions, such as providing credit monitoring and identity theft protection services pursuant to privacy and security laws or other obligations, and our reputation could be materially damaged. We would also be exposed to a risk of loss, governmental investigations or enforcement, or litigation (including class action claims) and other potential liability, which could materially adversely affect our business, results of operations and financial condition. We maintain cyber liability insurance; however, this insurance may not be sufficient to cover the financial, legal, business or reputational losses that may result from an interruption or breach of our systems.

Previous wording

In the ordinary course of business we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) personal data and other sensitive and confidential information, including proprietary and confidential business data, trade secrets, intellectual property, data we may collect about trial participants in connection with clinical trials, sensitive third-party data, and employee data (collectively, sensitive data). Our data processing activities actually or may subject us to numerous privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security. Data privacy and security obligations are stringent and changing, with new data privacy and security laws being proposed or enacted. Preparing for and complying with these obligations requires significant resources and may necessitate changes to our information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. The laws and regulations that may affect our ability to operate include, but may not be limited to:

Current wording

In the ordinary course of business we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) personal data and other sensitive and confidential information, including proprietary and confidential business data, trade secrets, intellectual property, data we may collect about trial participants in connection with clinical trials, sensitive third-party data, and employee data (collectively, sensitive data). Our data processing activities actually or may subject us to numerous privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security. Data privacy and security obligations are stringent and changing, with new data privacy and security laws being proposed or enacted. Preparing for and complying with these obligations requires significant resources and has in the past necessitated and may in the future necessitate changes to our information technologies, systems, and practices and to those of any third parties with whom we work. The laws and regulations that affect our ability to operate include, but may not be limited to:

Previous wording

the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 and its implementing regulations (“HIPAA”), which imposes, among other things, certain standards relating to the privacy, security, transmission and breach reporting of individually identifiable health information. Most healthcare providers, including research institutions from which we obtain patient health information, are subject to privacy and security regulations promulgated under HIPAA. We do not believe that we are currently acting as a covered entity or business associate under HIPAA and thus are not directly subject to its requirements or penalties. Depending on the facts and circumstances, however, we could be subject to significant administrative, civil and criminal penalties if we obtain, use or disclose individually identifiable health information maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA;

Current wording

the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 and its implementing regulations, or HIPAA, which imposes, among other things, certain standards relating to the privacy, security, transmission and breach reporting of individually identifiable health information. Most healthcare providers, including research institutions from which we obtain patient health information, are subject to privacy and security regulations promulgated under HIPAA. We do not believe that we are currently acting as a covered entity or business associate under HIPAA and thus are not directly subject to its requirements or penalties. Depending on the facts and circumstances, however, we could be subject to significant administrative, civil and criminal penalties if we obtain, use or disclose individually identifiable health information maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA;

Previous wording

the California Consumer Privacy Act of 2018 (“CCPA”), which requires covered businesses to provide certain disclosures in privacy notices to California residents, including consumers, business representatives, and employees, and requires businesses honor certain requests of California residents to exercise certain privacy rights. The CCPA provides for administrative fines of up to $7,500 per intentional violation, as well as a private right of action for data breaches that has increased the likelihood of, and risks associated with data breach litigation. Although there are limited exemptions for clinical trial data under the CCPA, the CCPA and other similar laws may impact our business activities depending on how it is interpreted. Further, the amendments to the CCPA expanded the CCPA’s requirements, including by adding a new right for individuals to correct their personal information and establishing a new regulatory agency to implement and enforce the law. Additional compliance investment and potential business process changes may be required. Similar laws have been passed in other states and are continuing to be proposed at the state and federal level, reflecting a trend toward more stringent privacy legislation in the United States. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging; and

Current wording

the California Consumer Privacy Act of 2018, or CCPA, which requires covered businesses to provide certain disclosures in privacy notices to California residents, including consumers, business representatives, and employees, and requires businesses honor certain requests of California residents to exercise certain privacy rights. The CCPA provides for administrative fines, as well as a private right of action for data breaches that has increased the likelihood of, and risks associated with data breach litigation. Although there are limited exemptions for clinical trial data under the CCPA, the CCPA and other similar laws may impact our business activities depending on how it is interpreted. Further, the amendments to the CCPA expanded the CCPA’s requirements, including by adding a right for individuals to correct their personal data and establishing a regulatory agency to implement and enforce the law. Additional compliance investment and business process changes may be required in an effort to address data protection laws. Similar laws have been passed in other states and are continuing to be proposed at the state and federal level, reflecting a trend toward more stringent privacy legislation in the United States. The enactment of such laws could have potentially conflicting requirements that make compliance challenging; and

Previous wording

foreign data protection laws, including the European Union’s General Data Protection Regulation (“EU GDPR”) and the United Kingdom GDPR (“UK GDPR”), which contain provisions specifically directed at the processing of health data and, more broadly, imposes significant and complex compliance burdens on processing personal data. Under the EU and UK GDPR, government regulators may impose temporary or definitive bans on data processing, as well as fines for noncompliance of up to €20 million under the EU GDPR (£17.5 million under the UK GDPR) or 4% of annual global revenue of the noncompliance company, whichever is greater. Noncompliance with the EU and UK GDPR could also result in private litigation related to the processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. These laws such as the EU and UK GDPR impose numerous requirements for the collection, use, storage and disclosure of personal data of data subjects, including requirements relating to providing notice to and obtaining consent from data subjects, personal data breach notification, cross-border transfers of personal data, and honoring and providing for the rights of individuals in relation to their personal data, including the right to access, correct and delete their data. Among other requirements, the EU and UK GDPR regulate transfers of personal data subject to the EU and UK GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the EU and the United States remains uncertain.

Current wording

foreign data protection laws, including the European Union’s General Data Protection Regulation, or EU GDPR, and the United Kingdom GDPR, or UK GDPR, which contain provisions specifically directed at the processing of health data and, more broadly, impose significant and complex compliance burdens on processing personal data. Under the EU and UK GDPR, government regulators may impose temporary or definitive bans on data processing, as well as fines for noncompliance of up to €20 million under the EU GDPR (£17.5 million under the UK GDPR) or 4% of annual global revenue of the noncompliance company, whichever is greater. Noncompliance with the EU and UK GDPR could also result in private litigation related to the processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. These laws such as the EU and UK GDPR impose numerous requirements for the collection, use, storage and disclosure of personal data of data subjects, including requirements relating to providing notice to and obtaining consent from data subjects, personal data breach notification, cross-border transfers of personal data, and honoring and providing for the rights of individuals in relation to their personal data, including the right to access, correct and delete their data. Among other requirements, the EU and UK GDPR regulate transfers of personal data subject to the EU and UK GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the EU and the United States remains uncertain.

Previous wording

Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA’s standard contractual clauses, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States or other relevant countries. If there were no lawful manner for us to transfer personal data from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activities groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers of personal data out of Europe for allegedly violating the EU GDPR’s cross-border data transfer limitations. Moreover, failure or perceived failure to comply with the EU GDPR and/or the UK GDPR, and other countries’ privacy or data security-related laws, rules or regulations could result in significant regulatory penalties and fines and affect our compliance with contracts entered into with our partners, collaborators and other third parties.

Current wording

In the ordinary course of business, we transfer personal data from Europe and other jurisdictions to the United States and other countries. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA’s standard contractual clauses, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States or other relevant countries. If there were no lawful manner for us to transfer personal data from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some

Previous wording

In addition to data privacy and security laws, clinical trial subjects about whom we or any of our potential collaborators obtain information, as well as the providers who share this information with us, may contractually limit our ability to use and disclose the information. Claims that we have violated individuals’ privacy rights, failed to comply with data protection laws or breached our contractual obligations, even if we are not found liable, could be expensive and time consuming to defend and could result in adverse publicity that could materially and adversely affect our business, financial condition, results of operations and prospects. We also publish policies, marketing materials, and other statements regarding data privacy and security and if these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators, or other adverse consequences.

Current wording

In addition to data privacy and security laws, clinical trial subjects about whom we or any of our potential collaborators obtain information, as well as the providers who share this information with us, have and may in the future limit our ability to use and disclose the information. Claims that we have violated individuals’ privacy rights, failed to comply with data protection laws or breached our contractual obligations, even if we are not found liable, could be expensive and time consuming to defend and could result in adverse publicity that could materially and adversely affect our business, financial condition, results of operations and prospects. We also publish policies, marketing materials, and other statements regarding data privacy and security. Regulators are increasingly scrutinizing these statements, and if these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators, or other adverse consequences.

Previous wording

Although we work to comply with applicable privacy and data security laws, regulations and standards, contractual obligations and other legal obligations, these requirements are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another or other legal obligations with which we must comply. Compliance with these data protection obligations could require us to take on more onerous obligations in our contracts, require us to engage in costly compliance exercises, restrict our ability to collect, use, disclose and otherwise process personal data, or in some cases, impact our or our partners’ or suppliers’ ability to operate in certain jurisdictions. Any actual or perceived failure to comply by us or our personnel, representatives, contractors, consultants, collaborators, or other third parties could result in government investigations and/or enforcement actions, fines, civil or criminal penalties, additional reporting requirements and/or oversight, bans on processing personal data (including clinical trial data), orders to destroy or not use personal data, private litigation (including class claims) or adverse publicity and could otherwise negatively affect our results of operations and business.

Current wording

Although we work to comply with applicable privacy and data security laws, regulations and standards, contractual obligations and other legal obligations, these requirements are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another or other legal obligations with which we must comply. Compliance with these data protection obligations has in the past and may in the future require us to take on more onerous obligations in our contracts, require us to engage in costly compliance exercises, restrict our ability to collect, use, disclose and otherwise process personal data, or in some cases, impact our or our partners’ or suppliers’ ability to operate in certain jurisdictions. Any actual or perceived failure to comply by us or our personnel, representatives, contractors, consultants, collaborators, or other third parties could result in government investigations and/or enforcement actions, fines, civil or criminal penalties, additional reporting requirements and/or oversight, bans on processing personal data (including clinical trial data), orders to destroy or not use personal data, private litigation (including class action claims) and mass arbitration demands, adverse publicity and could otherwise negatively affect our results of operations and business.