Acurx Pharmaceuticals, Inc.

Previous wording

We are not profitable and have incurred significant losses in each period since our inception, including net losses of $6.4 million for the nine months ended September 30, 2025 and $14.1 million for the year ended December 31, 2024. We have not commercialized any products and have never generated any revenue from product sales. We expect these losses to increase as we continue to incur significant research and development and other expenses related to our ongoing operations, seek regulatory approvals for our product candidates, scale-up manufacturing capabilities and hire additional personnel to support the development of our product candidates and to enhance our operational, financial and information management systems.

Current wording

We are not profitable and have incurred significant losses in each period since our inception, including net losses of $1.7 million for the three months ended March 31, 2026 and $8.0 million for the year ended December 31, 2025. We have not commercialized any products and have never generated any revenue from product sales. We expect these losses to increase as we continue to incur significant research and development and other expenses related to our ongoing operations, seek regulatory approvals for our product candidates, scale-up manufacturing capabilities and hire additional personnel to support the development of our product candidates and to enhance our operational, financial and information management systems.

Previous wording

As of September 30, 2025, we had approximately $5.9 million in cash. In June 2021, we completed the IPO for net proceeds of $14.8 million after deducting underwriting discounts and commissions and offering expenses. In July 2022, we completed a registered direct offering and concurrent private placement for net proceeds of $3.7 million after deducting placement agent fees and offering expenses. In May 2023, we completed a registered direct offering and concurrent private placement for net proceeds of $3.5 million after deducting placement agent fees and offering expenses. In November 2023, we entered into a Sales Agreement and established an ATM Program, pursuant to which we may offer and sell, from time to time through A.G.P./Alliance Global Partners, as sales agent, shares of our common stock having an aggregate offering price of up to $17.0 million. As of theperiod ended September 30, 2025, we sold a total of 145,516 shares of our common stock under the ATM Program, at a weighted-average price of $65.20 per share, raising $9.2 million of gross proceeds and net proceeds of $8.8 million after deducting commissions to the sales agent and other ATM Program related expenses. There remains approximately $7.8 million available for future sales of shares of common stock under the Sales Agreement. As of January 6, 2025, we suspended the ATM Program. In January 2025, we completed a registered direct offering and concurrent private placement for net proceeds of $2.1 million after deducting placement agent fees and offering expenses. In March 2025, we completed a registered direct offering and concurrent private placement for net proceeds of $0.9 million after deducting placement agent fees and offering expenses. On May 8, 2025, we entered into the ELOC with Lincoln Park, pursuant to which Lincoln Park committed to purchase up to $12.0 million in shares of our common stock, $0.001 par value per share. Under the ELOC, we raised net proceeds of approximately $2.3 million after deducting related fees and expenses as of September 30, 2025. On June 17, 2025, we entered into a warrant inducement agreement with existing warrant holders, receiving net proceeds of approximately $2.5 million after deducting fees and transaction expenses.

Current wording

As of March 31, 2026, we had approximately $9.3 million in cash. In June 2021, we completed the IPO for net proceeds of $14.8 million after deducting underwriting discounts and commissions and offering expenses. In July 2022, we completed a registered direct offering and concurrent private placement for net proceeds of $3.7 million after deducting placement agent fees and offering expenses. In May 2023, we completed a registered direct offering and concurrent private placement for net proceeds of $3.5 million after deducting placement agent fees and offering expenses. In November 2023, we entered into a Sales Agreement and established an ATM Program, pursuant to which we may offer and sell, from time to time through A.G.P./Alliance Global Partners, as sales agent, shares of our common stock having an aggregate offering price of up to $17.0 million. We sold a total of 145,516 shares of our common stock under the ATM Program, at a weighted-average price of $65.20 per share, raising $9.2 million of gross proceeds and net proceeds of $8.8 million after deducting commissions to the sales agent and other ATM Program related expenses. As of January 6, 2025, we suspended the ATM Program. In January 2025, we completed a registered direct offering and concurrent private placement for net proceeds of $2.1 million after deducting placement agent fees and offering expenses. In March 2025, we completed a registered direct offering and concurrent private placement for net proceeds of $0.9 million after deducting placement agent fees and offering expenses. On May 8, 2025, we entered into the ELOC with Lincoln Park, pursuant to which Lincoln Park committed to purchase up to $12.0 million in shares of our common stock, $0.001 par value per share. Under the ELOC, we raised net proceeds of approximately $6.9 million after deducting related fees and expenses as of March 31, 2026. On June 17, 2025, we entered into a warrant inducement agreement with existing warrant holders, receiving net proceeds of approximately $2.5 million after deducting fees and transaction expenses. In April 2026, we completed a registered direct offering and concurrent private placement for net proceeds of approximately $2.2 million after deducting placement agent fees and offering expenses.

Previous wording

We believe that, based upon our current operating plan, our existing capital resources will not be sufficient to fund our anticipated operations for at least 12 months from the issuance of our condensed interim financial statements for the period ended September 30, 2025. Our future capital requirements and the period for which we expect our existing resources to support our operations may vary significantly from what we expect. Our monthly spending levels vary based on new and ongoing research and development and other corporate activities. Because the length of time and activities associated with successful research and development of our product candidates is highly uncertain, we are unable to estimate the actual funds we will require for development and any approved marketing and commercialization activities.

Current wording

We believe that, based upon our current operating plan, our existing capital resources will not be sufficient to fund our anticipated operations for at least 12 months from the issuance of our condensed interim financial statements for the three months ended March 31, 2026. Our future capital requirements and the period for which we expect our existing resources to support our operations may vary significantly from what we expect. Our monthly spending levels vary based on new and ongoing research and development and other corporate activities. Because the length of time and activities associated with successful research and development of our product candidates is highly uncertain, we are unable to estimate the actual funds we will require for development and any approved marketing and commercialization activities.

Previous wording

We cannot be certain that additional funding will be available on acceptable terms, or at all. Any additional fundraising efforts may divert our management from their day-to-day activities, which may adversely affect our ability to develop and commercialize our product candidates. Our ability to raise additional funding will depend on financial, economic and market conditions and other factors, over which we may have no or limited control, including the conflict between Russia and Ukraine and the conflict in the Middle East between Israel and Hamas. In addition, our ability to obtain future funding when needed through equity financings, debt financings or strategic collaborations may be particularly challenging in light of the uncertainties and circumstances regarding the COVID-19 pandemic. We have no committed source of additional capital and if we are unable to raise additional capital in sufficient amounts or on terms acceptable to us, we may have to significantly delay, scale back or discontinue the development or commercialization of our product candidates or other research and development initiatives. We could be required to seek collaborators for our product candidates at an earlier stage than otherwise would be desirable or on terms that are less favorable than might otherwise be available or relinquish or license on unfavorable terms our rights to our product candidates in markets where we otherwise would seek to pursue development or commercialization ourselves.

Current wording

We cannot be certain that additional funding will be available on acceptable terms, or at all. Any additional fundraising efforts may divert our management from their day-to-day activities, which may adversely affect our ability to develop and commercialize our product candidates. Our ability to raise additional funding will depend on financial, economic and market conditions and other factors, over which we may have no or limited control, including the conflict between Russia and Ukraine, geopolitical tensions involving China, the conflict between U.S., Israel and Iran and tensions in the Middle East. In addition, our ability to obtain future funding when needed through equity financings, debt financings or strategic collaborations may be particularly challenging in light of the uncertainties and circumstances regarding the COVID-19 pandemic. We have no committed source of additional capital and if we are unable to raise additional capital in sufficient amounts or on terms acceptable to us, we may have to significantly delay, scale back or discontinue the development or commercialization of our product candidates or other research and development initiatives. We could be required to seek collaborators for our product candidates at an earlier stage than otherwise would be desirable or on terms that are less favorable than might otherwise be available or relinquish or license on unfavorable terms our rights to our product candidates in markets where we otherwise would seek to pursue development or commercialization ourselves.

Previous wording

The results of our operations could be adversely affected by general conditions in the global economy, the global financial markets and the global political conditions. The U.S. and global economies are facing growing inflation, higher interest rates and a potential recession. Furthermore, a severe or prolonged economic downturn, including a recession or depression resulting from public health crises such as a pandemic, or ongoing political disruption such as the war between Ukraine and Russia and the conflict involving Israel and Hamas, could result in a variety of risks to our business, including weakened demand for our programs and development candidates, if approved, relationships with any vendors or business partners located in affected geographies and our ability to raise additional capital when needed on acceptable terms, if at all. A weak or declining economy or political disruption, including any international trade disputes, could also strain our manufacturers or suppliers, possibly resulting in supply disruption, or cause our customers to delay making payments for our potential products. Any of the foregoing could seriously harm our business, and we cannot anticipate all of the ways in which the political or economic climate and financial market conditions could seriously harm our business.

Current wording

The results of our operations could be adversely affected by general conditions in the global economy, the global financial markets and the global political conditions. The U.S. and global economies are facing growing inflation, higher interest rates and a potential recession. Furthermore, a severe or prolonged economic downturn, including a recession or depression resulting from public health crises such as a pandemic, or ongoing political disruption such as the war between Ukraine geopolitical tensions involving China, the conflict between the U.S., Israel and Iran and as well as the tensions in the Middle East could result in a variety of risks to our business, including weakened demand for our programs and development candidates, if approved, relationships with any vendors or business partners located in affected geographies and our ability to raise additional capital when needed on acceptable terms, if at all. A weak or declining economy or political disruption, including any international trade disputes, could also strain our manufacturers or suppliers, possibly resulting in supply disruption, or cause our customers to delay making payments for our potential products. Any of the foregoing could seriously harm our business, and we cannot anticipate all of the ways in which the political or economic climate and financial market conditions could seriously harm our business.

Previous wording

cash equivalents and investments, that we would be able to maintain any required letters of credit or other credit support arrangements, or that we would be able to adequately fund our business for a prolonged period of time or at all, any of which could have a material adverse effect on our business, financial condition and results of operations. We cannot predict the impact that the high market volatility and instability of the banking sector more broadly could have on economic activity and our business in particular. In addition, there is a risk that one or more of our current service providers, manufacturers or other third parties with which we conduct business may not survive difficult economic times, including the ongoing conflict between Russia and Ukraine, the war between Israel and Hamas, the instability of the banking sector, and the uncertainty associated with current worldwide economic conditions, which could directly affect our ability to attain our operating goals on schedule and on budget.

Current wording

cash equivalents and investments, that we would be able to maintain any required letters of credit or other credit support arrangements, or that we would be able to adequately fund our business for a prolonged period of time or at all, any of which could have a material adverse effect on our business, financial condition and results of operations. We cannot predict the impact that the high market volatility and instability of the banking sector more broadly could have on economic activity and our business in particular. In addition, there is a risk that one or more of our current service providers, manufacturers or other third parties with which we conduct business may not survive difficult economic times, including the ongoing conflict between Russia and Ukraine, geopolitical tensions involving China, theconflict between the U.S., Israel and Iran and as well as the tensions in the Middle East, the instability of the banking sector, and the uncertainty associated with current worldwide economic conditions, which could directly affect our ability to attain our operating goals on schedule and on budget.

Previous wording

The Hatch-Waxman Amendments to the federal Food, Drug, and Cosmetic Act (“FDCA”) authorized the FDA to approve generic drugs that are the same as drugs previously approved for marketing under the NDA provisions of the statute pursuant to abbreviated new drug applications (“ANDAs”), and also created the Section 505(b)(2) NDA pathway. An ANDA relies on the preclinical and clinical testing conducted for a previously approved reference listed drug and must demonstrate to the FDA that the generic drug product is identical to the reference listed drug (“RLD”) with respect to the active ingredients, the route of administration, the dosage form, and the strength of the drug and also that it is “bioequivalent” to the reference listed drug. In contrast, Section 505(b)(2) enables the applicant to rely, in part, on the FDA’s prior findings of safety and efficacy data for an existing product, or published literature, in support of its application. Section 505(b)(2) provides an alternate path to FDA approval for new or improved formulations or new uses of previously approved products; for example, a follow-on applicant may be seeking approval to market a previously approved drug for new indications or for a new patient population that would require new clinical data to demonstrate safety or effectiveness. Such products, if approved and depending upon the scope of the changes made to the reference drug, may also compete with any product candidates for which we receive approval.

Current wording

The Hatch-Waxman Amendments to the federal Food, Drug, and Cosmetic Act (“FDCA”) authorized the FDA to approve generic drugs that are the same as drugs previously approved for marketing under the New Drug Application (“NDA”) provisions of the statute pursuant to abbreviated new drug applications (“ANDAs”), and also created the Section 505(b)(2) NDA pathway. An ANDA relies on the preclinical and clinical testing conducted for a previously approved reference listed drug and must demonstrate to the FDA that the generic drug product is identical to the reference listed drug (“RLD”) with respect to the active ingredients, the route of administration, the dosage form, and the strength of the drug and also that it is “bioequivalent” to the reference listed drug. In contrast, Section 505(b)(2) enables the applicant to rely, in part, on the FDA’s prior findings of safety and efficacy data for an existing product, or published literature, in support of its application. Section 505(b)(2) provides an alternate path to FDA approval for new or improved formulations or new uses of previously approved products; for example, a follow-on applicant may be seeking approval to market a previously approved drug for new indications or for a new patient population that would require new clinical data to demonstrate safety or effectiveness. Such products, if approved and depending upon the scope of the changes made to the reference drug, may also compete with any product candidates for which we receive approval.

Previous wording

If we cannot contract with acceptable third parties on commercially reasonable terms, or at all, or if these third parties do not carry out their contractual duties, satisfy legal and regulatory requirements for the conduct of preclinical studies or clinical trials or meet expected deadlines, our preclinical and clinical development programs could be delayed and otherwise adversely affected. In all events, we are responsible for ensuring that each of our preclinical studies and clinical trials is conducted in accordance with the general investigational plan and protocols for the trial. The FDA and other health authorities require preclinical studies to be conducted in accordance with GLP and clinical trials to be conducted in accordance with GCP, including conducting, recording and reporting the results of clinical trials to assure that data and reported results are credible and accurate and that the rights, integrity and confidentiality of clinical trial participants are protected. If we or our CROs fail to comply with these requirements, the data generated in our clinical trials may be deemed unreliable or uninterpretable and the FDA may require us to perform additional preclinical studies or clinical trials. Our reliance on third parties that we do not control does not relieve us of these responsibilities and requirements. Any such event could adversely affect our business, financial condition, results of operations and prospects.

Current wording

If we cannot contract with acceptable third parties on commercially reasonable terms, or at all, or if these third parties do not carry out their contractual duties, satisfy legal and regulatory requirements for the conduct of preclinical studies or clinical trials or meet expected deadlines, our preclinical and clinical development programs could be delayed and otherwise adversely affected. In all events, we are responsible for ensuring that each of our preclinical studies and clinical trials is conducted in accordance with the general investigational plan and protocols for the trial. The FDA and other health authorities require preclinical studies to be conducted in accordance with good laboratory practice and clinical trials to be conducted in accordance with GCP, including conducting, recording and reporting the results of clinical trials to assure that data and reported results are credible and accurate and that the rights, integrity and confidentiality of clinical trial participants are protected. If we or our CROs fail to comply with these requirements, the data generated in our clinical trials may be deemed unreliable or uninterpretable and the FDA may require us to perform additional preclinical studies or clinical trials. Our reliance on third parties that we do not control does not relieve us of these responsibilities and requirements. Any such event could adversely affect our business, financial condition, results of operations and prospects.

Previous wording

Even if resolved in our favor, litigation or other legal proceedings relating to intellectual property claims, regardless of their merit, would cause us to incur significant expenses, and could distract our technical and management personnel from their normal responsibilities. In the event of a successful claim of infringement against us, we may have to pay substantial damages, including treble damages and attorneys’ fees for willful infringement, in addition to paying royalties, redesign infringing products or obtain one or more licenses from third parties, which may be impossible or require substantial time and monetary expenditure. A court may also issue an injunction against us preventing us from manufacturing and bringing our products to market. In addition, there could be public announcements of the results of hearings, motions or other interim proceedings or developments and if securities analysts or investors perceive these results to be negative, it could have a substantial adverse effect on the price of our common stock. Such litigation or proceedings could substantially increase our operating losses and reduce the resources available for development activities or any future sales, marketing or distribution activities. We may not have sufficient financial or other resources to conduct such litigation or proceedings adequately. Some of our competitors may be able to sustain the costs of such litigation or proceedings more effectively than we can because of their greater financial resources. Uncertainties resulting from the initiation and continuation of patent litigation or other proceedings could compromise our ability to compete in the marketplace.

Current wording

Even if resolved in our favor, litigation or other legal proceedings relating to intellectual property claims, regardless of their merit, would cause us to incur significant expenses, and could distract our technical and management personnel from their normal responsibilities. In the event of a successful claim of infringement against us, we may have to pay substantial damages, including treble damages and attorneys’ fees for willful infringement, in addition to paying royalties, redesigning infringing products or obtaining one or more licenses from third parties, which may be impossible or require substantial time and monetary expenditure. A court may also issue an injunction against us preventing us from manufacturing and bringing our products to market. In addition, there could be public announcements of the results of hearings, motions or other interim proceedings or developments and if securities analysts or investors perceive these results to be negative, it could have a substantial adverse effect on the price of our common stock. Such litigation or proceedings could substantially increase our operating losses and reduce the resources available for development activities or any future sales, marketing or distribution activities. We may not have sufficient financial or other resources to conduct such litigation or proceedings adequately. Some of our competitors may be able to sustain the costs of such litigation or proceedings more effectively than we can because of their greater financial resources. Uncertainties resulting from the initiation and continuation of patent litigation or other proceedings could compromise our ability to compete in the marketplace.

Previous wording

Our officers, directors and their affiliates currently collectively own 323,629 shares of our common stock (on an as-converted basis) or approximately 16% of our outstanding shares of common stock (on an as-converted basis) as of September 30, 2025. Accordingly, if these stockholders were to choose to act together, they could have a significant influence over all matters requiring

Current wording

Our officers, directors and their affiliates currently collectively own 331,330 shares of our common stock (on an as-converted basis) or approximately 9% of our outstanding shares of common stock (on an as-converted basis) as of March 31, 2026. Accordingly,

Previous wording

stockholder approval, including the election of directors and approval of significant corporate transactions, such as a merger or other sale of our company or all or a significant percentage of our assets. This concentration of ownership could limit your ability to influence corporate matters and may have the effect of delaying or preventing a third party from acquiring control over us.

Current wording

if these stockholders were to choose to act together, they could have a significant influence over all matters requiring stockholder approval, including the election of directors and approval of significant corporate transactions, such as a merger or other sale of our company or all or a significant percentage of our assets. This concentration of ownership could limit your ability to influence corporate matters and may have the effect of delaying or preventing a third party from acquiring control over us.

Previous wording

On March 25, 2025, we received a letter from the Listing Qualifications Department (the “Staff”) of The Nasdaq Stock Market LLC (“Nasdaq”) notifying us that we are not in compliance with the minimum stockholders’ equity requirement for continued listing on The Nasdaq Capital Market (the “Notice”) based on the information provided in our Annual Report on Form 10-K for the year ended December 31, 2024. Nasdaq Listing Rule 5550(b)(1) requires that companies listed on The Nasdaq Capital Market with a market value of listed securities of less than $35,000,000 and annual net income of less than $500,000 maintain stockholders’ equity of at least $2,500,000 (the "Stockholders’ Equity Requirement”).

Current wording

On March 25, 2025, we received a letter from the Listing Qualifications Department (the “Staff”) of The Nasdaq Stock Market LLC (“Nasdaq”) notifying us that we were not in compliance with the minimum stockholders’ equity requirement for continued listing on The Nasdaq Capital Market (the “Notice”) based on the information provided in our Annual Report on Form 10-K for the year ended December 31, 2024. Nasdaq Listing Rule 5550(b)(1) requires that companies listed on The Nasdaq Capital Market with a market value of listed securities of less than $35,000,000 and annual net income of less than $500,000 maintain stockholders’ equity of at least $2,500,000 (the "Stockholders’ Equity Requirement”).

Previous wording

In accordance with Nasdaq rules, we were provided 45 calendar days to submit a plan to regain compliance with the Stockholders’ Equity Requirement (the "Compliance Plan”). We submitted the Compliance Plan on May 9, 2025. If the Compliance Plan is determined to be acceptable to the Staff, the Staff would have the discretion to grant the Company an extension of 180 calendar days from the date of the Notice to regain compliance with the Stockholders’ Equity Requirement. There can be no assurance that the Compliance Plan will be accepted or that, if it is, we will be able to regain compliance. The Notice has no immediate effect on our continued listing on The Nasdaq Capital Market, subject to our compliance with other continued listing requirements. If the Staff does not accept the Compliance Plan, the Staff will provide written notification to us that the Compliance Plan has been rejected and that our common stock is subject to delisting. At that time, we may appeal the Staff’s determination to a Nasdaq Hearing Panel.

Current wording

In accordance with Nasdaq rules, we were provided 45 calendar days to submit a plan to regain compliance with the Stockholders’ Equity Requirement (the "Compliance Plan”). We submitted the Compliance Plan on May 9, 2025.

Previous wording

On February 24, 2025, we received a letter from The Nasdaq Stock Market (“Nasdaq”) notifying us that for the preceding 31 consecutive business days our common stock did not maintain a minimum closing bid price of $1.00 per share as required by Nasdaq Listing Rule 5550(a)(2) (the “Minimum Bid Price Requirement”).

Current wording

Also, on February 24, 2025, we received a letter from The Nasdaq Stock Market (“Nasdaq”) notifying us that for the preceding 31 consecutive business days our common stock did not maintain a minimum closing bid price of $1.00 per share as required by Nasdaq Listing Rule 5550(a)(2) (the “Minimum Bid Price Requirement”).

Previous wording

On August 26, 2025, we received a letter from Nasdaq notifying us that we regained compliance with Nasdaq Listing Rule 5550(a)(2).

Current wording

On August 26, 2025, we received a letter from Nasdaq notifying us that we regained compliance with the Minimum Bid Price Requirement.

Previous wording

Should we fail to satisfy additional continued listing requirements, such as the corporate governance requirements, Stockholders’ Equity Requirement, or the Minimum Bid Price Requirement, Nasdaq may take steps to delist our common stock. Such a delisting would likely have a negative effect on the price of our common stock, and would impair your ability to sell or purchase our common stock when you wish to do so. In the event of a delisting, we would take actions to restore our compliance with Nasdaq’s

Current wording

Should we fail to satisfy additional continued listing requirements, such as the corporate governance requirements, Stockholders’ Equity Requirement, or the Minimum Bid Price Requirement, Nasdaq may take steps to delist our common stock. Such a delisting would likely have a negative effect on the price of our common stock, and would impair your ability to sell or purchase our common stock when you wish to do so. In the event of a delisting, we would take actions to restore our compliance with Nasdaq’s listing requirements, but we can provide no assurance that any such action taken by us would allow our common stock to become listed again, stabilize the market price or improve the liquidity of our common stock, prevent our common stock from dropping below Nasdaq’s Minimum Bid Price Requirement or prevent future non-compliance with the Nasdaq’s listing requirements.

Previous wording

Although we take measures to protect sensitive data from unauthorized access, use or disclosure, our information technology and infrastructure may be vulnerable to attacks by hackers or viruses or breached due to personnel error, malfeasance, or other malicious or inadvertent disruptions. Any such breach or interruption could compromise our networks and the information stored there could be accessed by unauthorized parties, manipulated, publicly disclosed, lost, or stolen.

Current wording

Although we take measures to protect sensitive data from unauthorized access, use or disclosure, our information technology and infrastructure may be vulnerable to attacks by hackers or viruses or breached due to personnel error, malfeasance, or other malicious or inadvertent disruptions. Any such breach or interruption could compromise our networks and the information stored there could be accessed by unauthorized parties, manipulated, publicly disclosed, lost, or stolen. Additionally, leveraging artificial intelligence (“AI”) capabilities to potentially improve internal functions and operations presents further risks and challenges, including the possibility of creating new attack methods for adversaries. The use of AI to support business operations carries inherent risks related to data privacy, intellectual property, and security, such as intended, unintended, or inadvertent transmission of proprietary, confidential, or sensitive information, as well as challenges related to implementing and maintaining AI tools, such as developing and maintaining appropriate datasets for such support. If we fail to implement adequate safeguards, the use of AI may introduce additional operational vulnerabilities by producing inaccurate outcomes based on flaws in the underlying data or methodologies, or unintended results.

Previous wording

Any such access, breach, or other loss of information could result in legal claims or proceedings, liability under domestic or foreign privacy, data protection and data security laws such as HIPAA and the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and penalties. Notice of certain security breaches must be made to affected individuals, the Secretary of HHS, and for extensive breaches, notice may need to be made to the media or state attorneys general. Such notice could harm our reputation and our ability to compete. Although we have implemented security measures, such data is currently accessible through multiple channels, and there is no guarantee we can protect our data from breach. Unauthorized access, loss or dissemination could also damage our reputation or disrupt our operations, including our ability to conduct our analyses, conduct research and development activities, collect, process and prepare company financial information, and manage the administrative aspects of our business.

Current wording

Any such access, breach, or other loss of information could result in legal claims or proceedings, liability under domestic or foreign privacy, data protection and data security laws such as HIPAA and the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and penalties. Notice of certain security breaches must be made to affected individuals, the Secretary of DHHS, and for extensive breaches, notice may need to be made to the media or state attorneys general. Such notice could harm our reputation and our ability to compete. Although we have implemented security measures, such data is currently accessible through multiple channels, and there is no guarantee we can protect our data from breach. Unauthorized access, loss or dissemination could also damage our reputation or disrupt our operations, including our ability to conduct our analyses, conduct research and development activities, collect, process and prepare company financial information, and manage the administrative aspects of our business.

Previous wording

New privacy and data security laws have been proposed in more than half of the states in the U.S. and in the U.S. Congress, reflecting a trend toward more stringent privacy legislation in the U.S., which trend may accelerate with increasing concerns about individual privacy. The existence of comprehensive privacy laws in different states in the U.S. may make our compliance obligations more complex and costly, may require us to modify our data processing practices and policies, and may require us to incur substantial costs and potential liability in an effort to comply.

Current wording

New privacy and data security laws have been proposed in more than half of the states in the U.S. and in the U.S. Congress, reflecting a trend toward more stringent privacy legislation in the U.S., which trend may accelerate with increasing concerns about individual privacy. The existence of comprehensive privacy laws in different states in the U.S. may make our compliance obligations

Previous wording

In the European Union (“EU”) and the United Kingdom (“UK”), we may face particular privacy, data security, and data protection risks in connection with requirements of EU’s General Data Protection Regulation (“GDPR”), the GDPR as it existed on December 31, 2020 but subject to certain UK specific amendments incorporated into UK law on January 1, 2021 under the UK GDPR and other data protection requirements. The regulatory framework for collecting, using, safeguarding, sharing, transferring and other processing of information worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future. The withdrawal of the UK from the EU and the subsequent separation of the data protection regimes of these territories means we are required to comply with separate data protection laws in the EU and the UK, which may lead to additional compliance costs and could increase our overall risk. Similar laws and regulations govern our processing of personal data, including the collection, access, use, analysis, modification, storage, transfer, security breach notification, destruction and disposal of personal data. For example, the collection, use, disclosure, transfer, or other processing of personal data regarding individuals in the EU, including personal health data, is subject to the GDPR, which took effect across all Member States of the European Economic Area (“EEA”) on May 25, 2018, and as still in effect in the UK as the “UK GDPR”. On June 28, 2021, the EU Commission adopted decisions on the UK’s adequacy under the EU GDPR, and the UK continues to operate under this adequacy decision. The GDPR applies to any company established in the EU as well as to those outside the EU that process personal data in connection with the offering of goods or services to individuals in the EU or the monitoring of their behavior. The GDPR imposes a broad range of data protection obligations on controllers and/or processors, as applicable, that must be complied with when processing personal data subject to the GDPR, including, for example, providing expanded disclosures about how their personal data will be used; higher standards for organizations to demonstrate that they have obtained valid consent or have another legal basis in place to justify their data processing activities; the obligation to appoint data protection officers in certain circumstances; new rights for individuals to be “forgotten” and rights to data portability, as well as enhanced current rights (e.g., access requests); the principal of accountability and demonstrating compliance through policies, procedures, training and audit; limitations on retention of information; mandatory data breach notification requirements; safeguards to protect the security and confidentiality of personal data; restrictions on transfers of personal data outside of the EU to third countries deemed to lack adequate privacy protections (such as the U.S.), and onerous new obligations and liabilities on services…

Excerpt shortened here; the source contains the full paragraph.

Current wording

with separate data protection laws in the EU and the UK, which may lead to additional compliance costs and could increase our overall risk. Similar laws and regulations govern our processing of personal data, including the collection, access, use, analysis, modification, storage, transfer, security breach notification, destruction and disposal of personal data. For example, the collection, use, disclosure, transfer, or other processing of personal data regarding individuals in the EU, including personal health data, is subject to the GDPR, which took effect across all Member States of the European Economic Area (“EEA”) on May 25, 2018, and as still in effect in the UK as the “UK GDPR”. On June 28, 2021, the EU Commission adopted decisions on the UK’s adequacy under the EU GDPR, and the UK continues to operate under this adequacy decision. The GDPR applies to any company established in the EU as well as to those outside the EU that process personal data in connection with the offering of goods or services to individuals in the EU or the monitoring of their behavior. The GDPR imposes a broad range of data protection obligations on controllers and/or processors, as applicable, that must be complied with when processing personal data subject to the GDPR, including, for example, providing expanded disclosures about how their personal data will be used; higher standards for organizations to demonstrate that they have obtained valid consent or have another legal basis in place to justify their data processing activities; the obligation to appoint data protection officers in certain circumstances; new rights for individuals to be “forgotten” and rights to data portability, as well as enhanced current rights (e.g., access requests); the principal of accountability and demonstrating compliance through policies, procedures, training and audit; limitations on retention of information; mandatory data breach notification requirements; safeguards to protect the security and confidentiality of personal data; restrictions on transfers of personal data outside of the EU to third countries deemed to lack adequate privacy protections (such as the U.S.), and onerous new obligations and liabilities on services providers or data processors. In particular, medical or health data, genetic data and biometric data are all classified as “special category” data under the GDPR and afford greater protection and require additional compliance obligations. Further, the UK and EU member states have a broad right to impose additional conditions—including restrictions—on these data categories. This is because the GDPR allows EU member states to derogate from the requirements of the GDPR mainly in regard to specific processing situations (including special category data and processing for scientific or statistical purposes). Non-compliance with the GDPR may result in monetary penalties of up to €20 million or 4% of worldwide revenue, whichever is greater. Moreover, data subjects can …

Excerpt shortened here; the source contains the full paragraph.

Previous wording

In addition, we may be unable to transfer personal data from the EU, UK, and other jurisdictions to U.S. or other countries due to limitations on cross-border data flows. In particular, the EEA and the UK have significantly regulated the transfer of personal data to the U.S. and other countries whose privacy laws it believes are inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and the UK to the U.S. in compliance with law, such as the EEA and UK’s standard contractual clauses and the newly-adopted Data Privacy Framework, these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the U.S. If there is no lawful manner for us to transfer personal data from the EEA, the UK or other jurisdictions to the U.S., or if the requirements for a legally-compliant transfer

Current wording

In addition, we may be unable to transfer personal data from the EU, UK, and other jurisdictions to U.S. or other countries due to limitations on cross-border data flows. In particular, the EEA and the UK have significantly regulated the transfer of personal data to the U.S. and other countries whose privacy laws it believes are inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and the UK to the U.S. in compliance with law, such as the EEA and UK’s standard contractual clauses and the newly-adopted Data Privacy Framework, these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the U.S. If there is no lawful manner for us to transfer personal data from the EEA, the UK or other jurisdictions to the U.S., or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and the UK to other jurisdictions, particularly to the U.S., are subject to increased scrutiny from regulators, individual litigants, and activist groups.