Pulmonx Corp

Previous wording

•We have limited long-term data regarding the safety and effectiveness of our solution, including the Zephyr Valve. The only safety and effectiveness data of our solution, including the Zephyr Valve, is limited to one year following placement and we are required to conduct extension studies to follow up on safety and effectiveness out to five years;

Current wording

•We have limited long-term data regarding the safety and effectiveness of our products, including the Zephyr Valve;

Previous wording

We have incurred net losses since our inception. For the six months ended June 30, 2024 and June 30, 2023, we had net losses of $29.1 million and $32.1 million, respectively, and we expect to continue to incur additional losses. As of June 30, 2024, we had an accumulated deficit of $440.2 million. We expect to continue to incur significant sales and marketing, research and development, regulatory and other expenses as we grow our sales force and expand our marketing efforts to increase adoption of our products, expand existing relationships with our customers, obtain regulatory clearances, certification or approvals for our planned or future products, conduct clinical trials on our existing and planned or future products and develop new products or add new features to our existing products. The net losses that we incur may fluctuate significantly from period to period. We will need to generate significant additional revenue in order to achieve and sustain profitability. Even if we achieve profitability, we cannot be sure that we will remain profitable for any substantial period of time.

Current wording

We have incurred net losses since our inception. For the nine months ended September 30, 2024 and September 30, 2023, we had net losses of $43.2 million and $47.0 million, respectively, and we expect to continue to incur additional losses. As of September 30, 2024, we had an accumulated deficit of $454.4 million. We expect to continue to incur significant sales and marketing, research and development, regulatory and other expenses as we grow our sales force and expand our marketing efforts to increase adoption of our products, expand existing relationships with our customers, obtain regulatory clearances, certification or approvals for our planned or future products, conduct clinical trials on our existing and planned or future products and develop new products or add new features to our existing products. The net losses that we incur may fluctuate significantly from period to period. We will need to generate significant additional revenue in order to achieve and sustain profitability. Even if we achieve profitability, we cannot be sure that we will remain profitable for any substantial period of time.

Previous wording

Our success will depend on our ability to bring awareness to our solution, and the Zephyr Valve in particular, and educate hospitals and physicians regarding the benefits of our solution over existing products and services and to encourage those parties to recommend our solution to their patients. Sales of Zephyr Valves and delivery catheters accounted for most of our revenue for the six months ended June 30, 2024 and June 30, 2023 and we expect that sales of Zephyr Valves and delivery catheters will continue to account for most of our revenue going forward. We do not know if our solution will be successful over the long term. Moreover, market acceptance may be hindered if physicians are not presented with compelling data demonstrating the efficacy of our solution compared to alternative procedures and technologies. Any studies we, or third parties which we sponsor, may conduct comparing our solution with alternative treatments for severe emphysema will be expensive, time consuming and may not yield positive results. Additionally, adoption will be directly influenced by a number of financial factors, including the ability of providers to obtain sufficient reimbursement from payors for deploying our solution. The safety, efficacy, performance and cost-effectiveness of our solution, on a stand-alone basis and relative to competing treatments and services, will determine the willingness of payors to cover the procedure. While we have established positive coverage policies with major national private payors, such as Aetna, Anthem Blue Cross Blue Shield, Blue Cross Blue Shield of Michigan, Humana, Health Care Service Corporation, and Highmark, other commercial payors, including other plans in the Blue Cross Blue Shield family of plans, do not currently consider our solution medically necessary. No matter the level of coverage by the commercial payor, each patient is generally considered on a case-by-case basis. In addition, Medicare, currently without a public coverage policy, covers our solution for patients when medically necessary on a case-by-case basis. Physicians may be reluctant to recommend our solution to patients covered by such plans with no specific policies because of the uncertainty surrounding reimbursement, rates and the administrative burden of interfacing with patients to answer their questions and support their efforts to obtain adequate reimbursement for our solution. If physicians do not adopt and recommend our solution, it will negatively affect our business, financial condition and results of operations.

Current wording

Our success will depend on our ability to bring awareness to our solution, and the Zephyr Valve in particular, and educate hospitals and physicians regarding the benefits of our solution over existing products and services and to encourage those parties to recommend our solution to their patients. Sales of Zephyr Valves and delivery catheters accounted for most of our revenue for the nine months ended September 30, 2024 and September 30, 2023 and we expect that sales of Zephyr Valves and delivery catheters will continue to account for most of our revenue going forward. We do not know if our solution will be successful over the long term. Moreover, market acceptance may be hindered if physicians are not presented with compelling data demonstrating the efficacy of our solution compared to alternative procedures and technologies. Any studies we, or third parties which we sponsor, may conduct comparing our solution with alternative treatments for severe emphysema will be expensive, time consuming and may not yield positive results. Additionally, adoption will be directly influenced by a number of financial factors, including the ability of providers to obtain sufficient reimbursement from payors for deploying our solution. The safety, efficacy, performance and cost-effectiveness of our solution, on a stand-alone basis and relative to competing treatments and services, will determine the willingness of payors to cover the procedure. While we have established positive coverage policies with major national private payors, such as Aetna, Anthem Blue Cross Blue Shield, Blue Cross Blue Shield of Michigan, Humana, Health Care Service Corporation, and Highmark, other commercial payors, including other plans in the Blue Cross Blue Shield family of plans, do not currently consider our solution medically necessary. No matter the level of coverage by the commercial payor, each patient is generally considered on a case-by-case basis. In addition, Medicare, currently without a public coverage policy, covers our solution for patients when medically necessary on a case-by-case basis. Physicians may be reluctant to recommend our solution to patients covered by such plans with no specific policies because of the uncertainty surrounding reimbursement, rates and the administrative burden of interfacing with patients to answer their questions and support their efforts to obtain adequate reimbursement for our solution. If physicians do not adopt and recommend our solution, it will negatively affect our business, financial condition and results of operations.

Previous wording

The successful implantation of the Zephyr Valve depends in part on the training and skill of the physician performing the procedure and on adherence to appropriate patient selection and proper techniques provided in training sessions conducted by our training faculty. For example, we train physicians to ensure correct patient selection and treatment planning using the StratX Platform and Chartis System, and proper placement of the Zephyr Valve. Physicians could experience difficulty with the technique necessary to successfully implant the valve and may not achieve the technical competency necessary to complete the training program, or they could fail to properly learn how to interpret our StratX Platform or Chartis System. Moreover, physicians rely on their previous medical training and experience when using our solution, and we cannot guarantee that all such physicians will have the necessary skills to properly identify ideal candidates and to perform the procedure. We do not control which physicians use our solution or how much training they receive, and physicians who have not completed our training sessions may nonetheless attempt to use our solution. If physicians implant the Zephyr Valve incorrectly, or do so in a manner that is inconsistent with its labeled indications, with components that are not our products, in patients who are not good candidates, or without adhering to or completing our training sessions, their patient outcomes may not be consistent with the outcomes achieved in our clinical trials. This result may negatively impact the perception of patient benefit and safety, and limit adoption of our solution as a treatment for severe emphysema and our products that facilitate the procedure, which will negatively affect our business, financial condition and results of operations.

Current wording

The successful implantation of the Zephyr Valve depends in part on the training and skill of the physician performing the procedure and on adherence to appropriate patient selection and proper techniques provided in training sessions conducted by our training faculty. For example, we train physicians to ensure correct patient selection and treatment planning using the LungTraX Platform and Chartis System, and proper placement of the Zephyr Valve. Physicians could experience difficulty with the technique necessary to successfully implant the valve and may not achieve the technical competency necessary to complete the training program, or they could fail to properly learn how to interpret our LungTraX Platform or Chartis System. Moreover, physicians rely on their previous medical training and experience when using our solution, and we cannot guarantee that all such physicians will have the necessary skills to properly identify ideal candidates and to perform the procedure. We do not control which physicians use our solution or how much training they receive, and physicians who have not completed our training sessions may nonetheless attempt to use our solution. If physicians implant the Zephyr Valve incorrectly, or do so in a manner that is inconsistent with its labeled indications, with components that are not our products, in patients who are not good candidates, or without adhering to or completing our training sessions, their patient outcomes may not be consistent with the outcomes achieved in our clinical trials. This result may negatively impact the perception of patient benefit and safety, and limit adoption of our solution as a treatment for severe emphysema and our products that facilitate the procedure, which will negatively affect our business, financial condition and results of operations.

Previous wording

Outside of the United States, reimbursement levels vary significantly by country and by patient. Reimbursement is obtained from a variety of sources, including government sponsors, hospital budgets, or private health insurance plans, or combinations thereof. We have established market access in countries across Europe and Asia Pacific, including Australia, Austria, Belgium, France, Germany, Japan, the Netherlands, the United Kingdom (the “UK”), Scotland, Switzerland and South Korea, and other countries. Even if we succeed in bringing our products to market in additional foreign countries, uncertainties regarding future healthcare policy, legislation and regulation, as well as private market practices, could affect our ability to sell our products in commercially acceptable quantities at acceptable prices. For example, in some markets, such as France, coverage and reimbursement are currently available for procedures using our products but are subject to constraints such as price controls or unit sales limitations.

Current wording

Outside of the United States, reimbursement levels vary significantly by country and by patient. Reimbursement is obtained from a variety of sources, including government sponsors, hospital budgets, or private health insurance plans, or combinations thereof. We have established market access in countries across Europe and Asia Pacific, including Australia, Austria, Belgium, France, Germany, Japan, the Netherlands, the United Kingdom (the “UK”), Scotland, Switzerland and South Korea, and other countries. Even if we succeed in bringing our products to market in additional foreign countries, uncertainties regarding future healthcare policy, legislation and regulation, as well as private market practices, could affect our ability to sell our products in commercially acceptable quantities at acceptable prices.

Previous wording

Although we have demonstrated the safety, effectiveness and clinical advantages of our solution in multiple clinical trials in approximately 450 patients selected using the Chartis System, the Zephyr Valve is still a relatively new treatment for severe emphysema. The long-term effects of using our solution in a large number of patients are currently being studied, and the results of short-term clinical use of such products do not necessarily predict long-term clinical benefits or reveal long-term adverse effects. We were required to conduct the LIBERATE extension study to follow up on safety and effectiveness out to five years. After the completion of the one-year follow up, 115 Zephyr Valve patients and 47 crossover patients (162 total patients) entered the LIBERATE extension study. Patient follow up and data analysis for this extension study has been completed. Our ability to interpret the data from the LIBERATE extension study may be limited by the fact that the matched control group exited the study after one year. In addition to the LIBERATE extension study, registry studies evaluating the safety and effectiveness of our solution out to three years in the United States, France and Japan are ongoing, with a total enrollment of over 300 patients. The results of clinical trials of our solution conducted to date and ongoing or future studies and trials of our current, planned or future products may not be predictive of the results of later clinical trials, and interim results of a clinical trial do not necessarily predict final results. Our interpretation of data and results from our clinical trials do not ensure that we will achieve similar results in future clinical trials in other patient populations. In addition, pre-clinical and clinical data are often susceptible to various interpretations and analyses, and many companies that have believed their products performed satisfactorily in pre-clinical studies and earlier clinical trials have nonetheless failed to replicate results in later clinical trials and subsequently failed to obtain marketing approval. Products in later stages of clinical trials may fail to show the desired safety and efficacy despite having progressed through nonclinical studies and earlier clinical trials.

Current wording

Although we have demonstrated the safety, effectiveness and clinical advantages of our solution in multiple clinical trials in over 650 patients selected using the Chartis System, the Zephyr Valve is still a relatively new treatment for severe emphysema. The long-term effects of using our solution have been studied in a small number of patients, and these results do not necessarily predict long-term clinical benefits or reveal long-term adverse effects in the broader eligible population. The results of clinical trials of our solution conducted to date and ongoing or future studies and trials of our current, planned or future products may not be predictive of the results of later clinical trials, and interim results of a clinical trial do not necessarily predict final results. Our interpretation of data and results from our clinical trials do not ensure that we will achieve similar results in future clinical trials in other patient populations. In addition, pre-clinical and clinical data are often susceptible to various interpretations and analyses, and many companies that have believed their products performed satisfactorily in pre-clinical studies and earlier clinical trials have nonetheless failed to replicate results in later clinical trials and subsequently failed to obtain marketing approval. Products in later stages of clinical trials may fail to show the desired safety and efficacy despite having progressed through nonclinical studies and earlier clinical trials.

Previous wording

We rely on third parties to perform certain aspects of the CT scan analysis within the StratX Platform.

Current wording

We rely on third parties to perform certain aspects of the CT scan analysis within the LungTraX Platform.

Previous wording

We rely on third-party service providers to upload and analyze CT scan data on the StratX Platform. In order to make the StratX Platform available to physicians, we contract with a third-party cloud service. This third-party cloud service enables physicians to upload CT scan data while removing protected health information (“PHI”) of patients from that data, in case the physicians have, inadvertently, not removed the PHI themselves. We also contract with additional third-party service providers to analyze the CT scan data using their proprietary software, and provide quantitative results via an easy-to-read StratX Lung Report. The StratX Lung Report is then made available to physicians in the third-party cloud service.

Current wording

We rely on third-party service providers to upload and analyze CT scan data on the LungTraX Platform. In order to make the LungTraX Platform available to physicians, we contract with a third-party cloud service. This third-party cloud service enables physicians to upload CT scan data while removing protected health information (“PHI”) of patients from that data, in case the physicians have, inadvertently, not removed the PHI themselves. We also contract with additional third-party service providers to analyze the CT scan data using their proprietary software, and provide quantitative results via an easy-to-read StratX Lung Report. The StratX Lung Report is then made available to physicians in the third-party cloud service.

Previous wording

We depend on our information technology systems for the efficient functioning of our business, including the manufacture, distribution, and maintenance of our products, as well as for accounting, data storage, compliance, purchasing, and inventory management. We also depend on the information technology systems of third parties for the analysis, data storage, and communication associated with the StratX Platform. We currently do not have redundant information technology systems. Our information technology systems, and those of third parties, may be subject to computer viruses, ransomware or other malware, attacks by computer hackers, failures during the process of upgrading or replacing software, databases or components thereof, power outages, damage or interruption from fires or other natural disasters, hardware failures, telecommunication failures and user errors, among other malfunctions. We, or the third parties we rely upon, could be subject to an unintentional event that involves a third party gaining unauthorized access to our or its systems, which could disrupt our operations, corrupt our data or result in release of our confidential information. Technological interruptions could disrupt our operations, including our ability to timely ship and track product orders, project inventory requirements, manage our supply chain and otherwise adequately service our customers or disrupt our customers’ ability use our products for treatments.

Current wording

We depend on our information technology systems for the efficient functioning of our business, including the manufacture, distribution, and maintenance of our products, as well as for accounting, data storage, compliance, purchasing, and inventory management. We also depend on the information technology systems of third parties for the analysis, data storage, and communication associated with the LungTraX Platform. We currently do not have redundant information technology systems. Our information technology systems, and those of third parties, may be subject to computer viruses, ransomware or other malware, attacks by computer hackers, failures during the process of upgrading or replacing software, databases or components thereof, power outages, damage or interruption from fires or other natural disasters, hardware failures, telecommunication failures and user errors, among other malfunctions. We, or the third parties we rely upon, could be subject to an unintentional event that involves a third party gaining unauthorized access to our or its systems, which could disrupt our operations, corrupt our data or result in release of our confidential information. Technological interruptions could disrupt our operations, including our ability to timely ship and track product orders, project inventory requirements, manage our supply chain and otherwise adequately service our customers or disrupt our customers’ ability use our products for treatments.

Previous wording

Moreover, a disruption in access to the system that controls the StratX Platform would prevent physicians using our solution from receiving the StratX Lung Report indicating whether their patients are good candidates for the Zephyr Valve. In the event we experience significant disruptions, we may be unable to repair our systems in an efficient and timely manner. Accordingly, such events may disrupt or reduce the efficiency of our entire operation and negatively affect our business, financial condition, and results of operations. Currently, we carry business interruption coverage and cyber insurance to mitigate certain potential losses but this insurance is limited in amount, and we cannot be certain that such potential losses will not exceed our policy limits. We are increasingly dependent on complex information technology to manage our infrastructure. Our information systems require an ongoing commitment of significant resources to maintain, protect and enhance our existing systems. Failure to maintain or protect our information systems and data integrity effectively could negatively affect our business, financial condition, and results of operations.

Current wording

Moreover, a disruption in access to the system that controls the LungTraX Platform would prevent physicians using our solution from receiving the StratX Lung Report indicating whether their patients are good candidates for the Zephyr Valve. In the event we experience significant disruptions, we may be unable to repair our systems in an efficient and timely manner. Accordingly, such events may disrupt or reduce the efficiency of our entire operation and negatively affect our business, financial condition, and results of operations. Currently, we carry business interruption coverage and cyber insurance to mitigate certain potential losses but this insurance is limited in amount, and we cannot be certain that such potential losses will not exceed our policy limits. We are increasingly dependent on complex information technology to manage our infrastructure. Our information systems require an ongoing commitment of significant resources to maintain, protect and enhance our existing systems. Failure to maintain or protect our information systems and data integrity effectively could negatively affect our business, financial condition, and results of operations.

Previous wording

We do not carry insurance for all categories of risk that our business may encounter. Although we have product liability and clinical study liability insurance that we believe is appropriate, this insurance is subject to deductibles and coverage limitations. Our current product liability insurance may not continue to be available to us on acceptable terms, if at all, and, if available, coverage may not be adequate to protect us against any future product liability claims. If we are unable to obtain insurance at an acceptable cost or on acceptable terms or otherwise protect against potential product liability claims, we could be exposed to significant liabilities. A product liability claim, recall or other claim with respect to uninsured liabilities or for amounts in excess of insured liabilities could negatively affect our business, financial condition and results of operations. We do not carry specific hazardous waste insurance coverage, and our property, casualty and general liability insurance policies specifically exclude coverage for damages and fines arising from hazardous waste exposure or contamination. Accordingly, in the event of contamination or injury, we could be held liable for damages or be penalized with fines in an amount exceeding our resources, and our clinical trials or regulatory approvals could be suspended. Additionally, we do not carry cyber insurance, which may expose us to certain potential losses for damages or result in penalization with fines in an amount exceeding our resources.

Current wording

We do not carry insurance for all categories of risk that our business may encounter. Although we have product liability and clinical study liability insurance that we believe is appropriate, this insurance is subject to deductibles and coverage limitations. Our current product liability insurance may not continue to be available to us on acceptable terms, if at all, and, if available, coverage may not be adequate to protect us against any future product liability claims. If we are unable to obtain insurance at an acceptable cost or on acceptable terms or otherwise protect against potential product liability claims, we could be exposed to significant liabilities. A product liability claim, recall or other claim with respect to uninsured liabilities or for amounts in excess of insured liabilities could negatively affect our business, financial condition and results of operations. We do not carry specific hazardous waste insurance coverage, and our property, casualty and general liability insurance policies specifically exclude coverage for damages and fines arising from hazardous waste exposure or contamination. Accordingly, in the event of contamination or injury, we could be held liable for damages or be penalized with fines in an amount exceeding our resources, and our clinical trials or regulatory approvals could be suspended. Currently, we carry business cyber insurance to mitigate certain potential losses but this insurance is limited in amount, and we cannot be certain that such potential losses will not exceed our policy limits, which may expose us to certain potential losses for damages or result in penalization with fines in an amount exceeding our resources.

Previous wording

Since inception, we have incurred significant net losses and expect to continue to incur net losses for the foreseeable future. Since our inception, our operations have been financed primarily through the sale of equity securities, debt financing arrangements and sales of our products. As of June 30, 2024, we had $114.5 million in cash, cash equivalents and marketable securities, and an accumulated deficit of $440.2 million. Based on our current planned operations, we expect our cash, cash equivalents and short-term marketable securities will enable us to fund our operating expenses for at least the next twelve months. We have based this estimate on assumptions that may prove to be wrong, and we could use our capital resources sooner than we currently expect.

Current wording

Since inception, we have incurred significant net losses and expect to continue to incur net losses for the foreseeable future. Since our inception, our operations have been financed primarily through the sale of equity securities, debt financing arrangements and sales of our products. As of September 30, 2024, we had $107.8 million in cash, cash equivalents and marketable securities, and an accumulated deficit of $454.4 million. Based on our current planned operations, we expect our cash, cash equivalents and short-term marketable securities will enable us to fund our operating expenses for at least the next twelve months. We have based this estimate on assumptions that may prove to be wrong, and we could use our capital resources sooner than we currently expect.

Previous wording

We expect to continue to make substantial investments in clinical trials that are designed to provide clinical evidence of the safety and efficacy of our solution. We intend to continue to make significant investments in our sales and marketing organization by increasing the number of U.S. sales territory managers and expanding our international sales and marketing programs to help promote awareness and increase adoption of our solution primarily among the pulmonologists performing interventional pulmonary procedures across approximately 500 high volume hospitals. In order to continue to grow our business, we will need to hire additional sales personnel to efficiently serve the market. We also expect to continue to make investments in research and development, regulatory affairs and clinical studies to develop future generations of our solution, broaden the addressable market and expand indications, support regulatory submissions and demonstrate the clinical efficacy of our solution. Moreover, we expect to incur additional expenses associated with operating as a public company, including legal, accounting, insurance, exchange listing and Securities and Exchange Commission (“SEC”) compliance, investor relations and other expenses. Because of these and other factors, we expect to continue to incur substantial net losses and negative cash flows from operations for the foreseeable future. Our future capital requirements will depend on many factors, including:

Current wording

We expect to continue to make substantial investments in clinical trials that are designed to provide clinical evidence of the safety and efficacy of our solution. We intend to continue to make significant investments in our sales and marketing organization by increasing the number of U.S. sales territory managers and expanding our international sales and marketing programs to help promote awareness and increase adoption of our solution primarily among the pulmonologists performing interventional pulmonary procedures across approximately 500 high volume hospitals. In order to continue to grow our business, we will need to hire additional sales personnel to efficiently serve the market. We also expect to continue to make investments in research and development, regulatory affairs and clinical studies to develop future generations of our solution, broaden the addressable market and expand indications, support regulatory submissions and demonstrate the clinical efficacy of our solution. We continue to make progress with our CONVERT II pivotal trial of the AeriSeal System, a potential product in development for the treatment of severe emphysema patients who are not qualified for Zephyr Valve treatment due to excessive collateral ventilation. Moreover, we expect to incur additional expenses associated with operating as a public company, including legal, accounting, insurance, exchange listing and Securities and Exchange Commission (“SEC”) compliance, investor relations and other expenses. Because of these and other factors, we expect to continue to incur substantial net losses and negative cash flows from operations for the foreseeable future. Our future capital requirements will depend on many factors, including:

Previous wording

Sales in markets outside of the United States accounted for approximately 32.5% and 35.8% of our revenue for the six months ended June 30, 2024 and June 30, 2023, respectively. We currently focus our international sales and marketing efforts in Australia, Austria, Belgium, China, Denmark, France, Germany, Ireland, Italy, Japan, the Netherlands, South Korea, Spain, Switzerland and the United Kingdom. International sales are subject to a number of risks, including:

Current wording

Sales in markets outside of the United States accounted for approximately 32.4% and 34.8% of our revenue for the nine months ended September 30, 2024 and September 30, 2023, respectively. We currently focus our international sales and marketing efforts in Australia, Austria, Belgium, China, Denmark, France, Germany, Ireland, Italy, Japan, the Netherlands, South Korea, Spain, Switzerland and the United Kingdom. International sales are subject to a number of risks, including:

Previous wording

If our information technology systems or data, or those third parties upon which we rely, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, interruptions to our operations such as our clinical trials, claims that we breached our data protection obligations, harm to our reputation, and a loss of customers or sales.

Current wording

If our information technology systems or data, or those third parties with whom we work, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, interruptions to our operations such as our clinical trials, claims that we breached our data protection obligations, harm to our reputation, and a loss of customers or sales.

Previous wording

In the ordinary course of business, we or the third parties upon whom we rely, collect, store, receive, generate, use, transfer, disclose, make accessible, protect, secure, dispose of or transmit (collectively, “process”) proprietary, confidential, and sensitive data (including but not limited to intellectual property, proprietary business information and personal data).

Current wording

In the ordinary course of business, we or the third parties with whom we work, collect, store, receive, generate, use, transfer, disclose, make accessible, share, protect, secure, dispose of or transmit (collectively, “process”) proprietary, confidential, and sensitive data (including but not limited to intellectual property, proprietary business information and personal data).

Previous wording

Although we have implemented policies and procedures designed to ensure compliance with applicable data privacy and information security laws and regulations and we take measures to protect sensitive information from unauthorized access or disclosure, there can be no assurance that these measures will be effective. We take steps designed to detect, mitigate, and remediate vulnerabilities in our IT systems (such as our hardware and/or software, including that of third parties upon which we rely). We may not, however, detect and remediate all such vulnerabilities including on a timely basis. Unremediated high risk or critical vulnerabilities pose material risks to our business. Further, we may experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities. Our IT and infrastructure, and other third parties, including technology partners and providers, may be vulnerable to a variety of evolving threats, including but not limited to social engineering attacks (including through phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), ransomware attacks, software bugs, server malfunction, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fire, flood, and other similar threats. In addition to traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel misconduct or error (such as theft or misuse), sophisticated nation-state and nation-state supported actors now engage and are expected to continue to engage in cyberattacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties upon whom we rely may be vulnerable to a heightened risk of these attacks, including retaliatory cyberattacks that could materially disrupt our systems, operations and supply chain.

Current wording

Although we have implemented policies and procedures designed to ensure compliance with applicable data privacy and information security laws and regulations and we take measures to protect sensitive information from unauthorized access or disclosure, there can be no assurance that these measures will be effective. We take steps designed to detect, mitigate, and remediate vulnerabilities in our IT systems (such as our hardware and/or software, including that of third parties with whom we work). We may not, however, detect and remediate all such vulnerabilities including on a timely basis. Unremediated high risk or critical vulnerabilities pose material risks to our business. Further, we may experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities. Our IT and infrastructure, and other third parties, including technology partners and providers, may be vulnerable to a variety of evolving threats, including but not limited to social engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), ransomware attacks, software bugs, server malfunction, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fire, flood, and other similar threats. In addition to traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel misconduct or error (such as theft or misuse), sophisticated nation-state and nation-state supported actors now engage and are expected to continue to engage in cyberattacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties with whom we work may be vulnerable to a heightened risk of these attacks, including retaliatory cyberattacks that could materially disrupt our systems, operations and supply chain.

Previous wording

Although the aggregate impact of security incidents on our operations and financial condition has not been material to date, we have occasionally been the target of events of this nature and expect them to continue as security threats have been rapidly evolving in sophistication and becoming more prevalent in the industry. Advances in computer capabilities, new technological discoveries or other developments may result in cyberattacks becoming more sophisticated and more difficult to detect. We and our third-party service providers may not have the resources or technical sophistication to anticipate or prevent all such cyberattacks. Moreover, techniques used to obtain unauthorized access to systems or other information technology infrastructure change frequently and may not be detected until after an incident has occurred. We are investing in protections and monitoring practices related to our data and IT to reduce these risks and continue to monitor our systems on an ongoing basis for any current or potential threats. We cannot assure you, however, that our efforts will prevent breakdowns or breaches to our or our third-party providers’ databases or systems, and such breakdowns and breaches could negatively affect our business, financial condition and results of operations and our reputation.

Current wording

Although the aggregate impact of security incidents on our operations and financial condition has not been material to date, we have occasionally been the target of events of this nature and expect them to continue as security threats have been rapidly evolving in sophistication and becoming more prevalent in the industry. Advances in computer capabilities, new technological discoveries or other developments may result in cyberattacks becoming more sophisticated and more difficult to detect. We and our third-party service providers may not have the resources or technical sophistication to anticipate or prevent all such cyberattacks. Moreover, techniques used to obtain unauthorized access to systems or other information technology infrastructure change frequently and may not be detected until after an incident has occurred. We are investing in protections and monitoring practices related to our data and IT to reduce these risks and continue to monitor our systems on an ongoing basis for any current or potential threats. However, it may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. We may expend significant resources or modify our business activities (including our clinical trial activities) to try to protect against security incidents. Certain data privacy and information security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information. We cannot assure you that our efforts will prevent breakdowns or breaches to our or our third-party providers’ databases or systems, and such breakdowns and breaches could negatively affect our business, financial condition and results of operations and our reputation.

Previous wording

If we or our third-party service providers experience, or are perceived to have experienced, material security incidents, it may result in: government enforcement actions that could include investigations, fines, penalties, consent decrees, audits and inspections; additional reporting requirements and/or oversight; temporary or permanent bans on all or some processing of personal data; or orders to destroy or not use personal data. Applicable data privacy and information security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors of security incidents. Such disclosures are costly, and the disclosures or the failure to comply with such requirements, could lead to adverse impacts. Further, individuals or other relevant stakeholders could sue us for our actual or perceived failure to comply with our security obligations, including, without limitation, in class action litigation. Security incidents could also result in indemnity obligations, negative publicity and financial loss.

Current wording

If we or our third-party service providers experience, or are perceived to have experienced, security incidents, it may result in: government enforcement actions that could include investigations, fines, penalties, consent decrees, audits and inspections; additional reporting requirements and/or oversight; temporary or permanent bans on all or some processing of personal data; or orders to destroy or not use personal data. Applicable data privacy and information security obligations may require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors of security incidents. Such disclosures and related actions can be costly, and the disclosures or the failure to comply with such applicable requirements, could lead to adverse consequences. Further, individuals or other relevant stakeholders could sue us for our actual or perceived failure to comply with our security obligations, including, without limitation, in class action litigation. Security incidents could also result in indemnity obligations, negative publicity and financial loss.

Previous wording

Security incidents and vulnerabilities may cause some of our customers and users to stop using our services and our failure, or perceived failure, to meet expectations with regard to the security, integrity, availability and confidentiality of our systems and sensitive data could damage our reputation and affect our ability to retain customers, attract new customers and grow our business. Any of these results could harm our growth prospects, our business and our reputation. Moreover, security incidents can result in the diversion of funds, and interruptions, delays, or outages in our operations and services, including due to ransomware attacks. Failures or significant downtime of our information technology or telecommunication systems or those used by our third-party service providers could cause significant interruptions to our operations and adversely impact the confidentiality, integrity and availability of sensitive, proprietary or confidential information, and prevent us from administering our business. There can be no assurance that limitations of liability in our contracts are sufficient or adequate enough to protect us from liabilities, damages, or claims related to our security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.

Current wording

Security incidents and attendant consequences may cause some of our customers and users to stop using our services and our failure, or perceived failure, to meet expectations with regard to the security, integrity, availability and confidentiality of our systems and sensitive data could damage our reputation and affect our ability to retain customers, attract new customers and grow our business. Any of these results could harm our growth prospects, our business and our reputation. Moreover, security incidents can result in the diversion of funds, and interruptions, delays, or outages in our operations and services, including due to ransomware attacks. Failures or significant downtime of our information technology or telecommunication systems or those used by our third-party service providers could cause significant interruptions to our operations and adversely impact the confidentiality, integrity and availability of sensitive, proprietary or confidential information, and prevent us from administering our business. There can be no assurance that limitations of liability in our contracts are sufficient or adequate enough to protect us from liabilities, damages, or claims related to our security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.

Previous wording

It is important to our business that we continue to enhance the Zephyr Valve, Chartis System and StratX Platform and develop and introduce new products. Developing products is expensive and time-consuming and could divert management’s attention away from our core business. The success of any new product offering or product enhancements to our solution will depend on several factors, including our ability to:

Current wording

It is important to our business that we continue to enhance the Zephyr Valve, Chartis System and LungTraX Platform and develop and introduce new products. Developing products is expensive and time-consuming and could divert management’s attention away from our core business. The success of any new product offering or product enhancements to our solution will depend on several factors, including our ability to:

Previous wording

We are in the process of enhancing policies and procedures designed to ensure compliance by us and our directors, officers, employees, representatives, consultants and agents with the FCPA, OFAC restrictions, the Bribery Act and other export control, anti-corruption, anti-money-laundering and anti-terrorism laws and regulations. We cannot assure you, however, that our policies and procedures are or will be sufficient or that directors, officers, employees, representatives, consultants and agents have not engaged and will not engage in conduct for which we may be held responsible, nor can we assure you that our business partners have not engaged and will not engage in conduct that could materially affect their ability to perform their contractual obligations to us or even result in our being held liable for such conduct. Violations of the FCPA, OFAC restrictions, the Bribery Act or other export control, anti-corruption, anti-money laundering and anti-terrorism laws or regulations may result in severe criminal or civil sanctions, and we may be subject to other liabilities, which could negatively affect our business, financial condition and results of operations.

Current wording

We have various policies and procedures designed to ensure compliance by us and our directors, officers, employees, representatives, consultants and agents with the FCPA, OFAC restrictions, the Bribery Act and other export control, anti-corruption, anti-money-laundering and anti-terrorism laws and regulations. We cannot assure you, however, that our policies and procedures are or will be sufficient or that directors, officers, employees, representatives, consultants and agents have not engaged and will not engage in conduct for which we may be held responsible, nor can we assure you that our business partners have not engaged and will not engage in conduct that could materially affect their ability to perform their contractual obligations to us or even result in our being held liable for such conduct. Violations of the FCPA, OFAC restrictions, the Bribery Act or other export control, anti-corruption, anti-money laundering and anti-terrorism laws or regulations may result in severe criminal or civil sanctions, and we may be subject to other liabilities, which could negatively affect our business, financial condition and results of operations.

Previous wording

Our products may be subject to U.S. export controls. Governmental regulation of the import or export of our products, or our failure to obtain any required import or export authorization for our products, when applicable, will harm our international sales and adversely affect our revenue. Compliance with applicable regulatory requirements regarding the export of our products may create delays in the introduction of our products in international markets or, in some cases, prevent the export of our products to some countries altogether. Furthermore, U.S. export control laws and economic sanctions prohibit the shipment of certain products and services to countries, governments and persons targeted by U.S. sanctions. If we fail to comply with export and import regulations and such economic sanctions, we may be fined or other penalties could be imposed, including a denial of certain export privileges. Moreover, any new export or import restrictions, new legislation or shifting approaches in the enforcement or scope of existing regulations, or in the countries, persons or technologies targeted by such regulations, could result in decreased use of our products by, or in our decreased ability to export our products to existing or potential customers with international operations. Any decreased use of our products or limitation on our ability to export or sell access to our products would likely negatively affect our business, financial condition and results of operations.

Current wording

Our products may be subject to U.S. export controls. Governmental regulation of the import or export of our products, or our failure to obtain any required import or export authorization for our products, when applicable, will harm our international sales and adversely affect our revenue. Compliance with applicable regulatory requirements regarding the export of our products may create delays in the introduction of our products in international markets or, in some cases, prevent the export of our products to some countries altogether. Furthermore, U.S. export control laws and economic sanctions prohibit the shipment of certain products and services to countries, governments and persons targeted by U.S. sanctions. If we fail to comply with export and import regulations and such economic sanctions, we may be fined or other penalties could be imposed, including a denial of certain export privileges.

Previous wording

We have obtained PMA approval for the Zephyr Valve. In order to obtain PMA approval for a device, the sponsor must conduct well-controlled clinical trials designed to assess the safety and efficacy of the product candidate. Similar requirements may apply outside the U.S. Conducting clinical trials is a complex and expensive process, can take many years, and outcomes are inherently uncertain. We incur substantial expense for, and devote significant time to, clinical trials but cannot be certain that the trials will ever result in commercial revenue. We may experience significant setbacks in clinical trials, even after earlier clinical trials showed promising results, and failure can occur at any time during the clinical trial process. Any of our products may malfunction or may produce undesirable adverse effects that could cause us or regulatory authorities to interrupt, delay or halt clinical trials. We, the FDA, or another regulatory authority may suspend or terminate clinical trials at any time to avoid exposing trial participants to unacceptable health risks.

Current wording

We have obtained PMA approval and CE Mark certification for the Zephyr Valve. Additionally, we have received CE certification for the AeriSeal System and we are currently conducting a global clinical trial designed to support PMA approval for the AeriSeal System. In order to obtain PMA approval for a device, the sponsor must conduct well-controlled clinical trials designed to assess the safety and efficacy of the product candidate. Similar requirements may apply outside the U.S. Conducting clinical trials is a complex and expensive process, can take many years, and outcomes are inherently uncertain. We incur substantial expense for, and devote significant time to, clinical trials but cannot be certain that the trials will ever result in commercial revenue. We may experience significant setbacks in clinical trials, even after earlier clinical trials showed promising results, and failure can occur at any time during the clinical trial process. Any of our products may malfunction or may produce undesirable adverse effects that could cause us or regulatory authorities to interrupt, delay or halt clinical trials. We, the FDA, or another regulatory authority may suspend or terminate clinical trials at any time to avoid exposing trial participants to unacceptable health risks.

Previous wording

We are subject to stringent and evolving obligations related to data privacy and information security. Our actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions; litigation; fines and penalties; a disruption of our business operations; reputational harm; loss of revenue or profits; and other adverse business impacts.

Current wording

We and the third parties with whom we work are subject to stringent and evolving obligations related to data privacy and information security. Our (or the third-parties with whom we work) actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions; litigation; fines and penalties; a disruption of our business operations; reputational harm; loss of revenue or profits; and other adverse business impacts.

Previous wording

In the ordinary course of business, we or the third parties upon whom we rely, may collect, store, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, share or otherwise process proprietary, confidential, and sensitive data (including but not limited to intellectual property, proprietary business information and personal data).

Current wording

In the ordinary course of business, we or the third parties with whom we work, may collect, store, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, share or otherwise process proprietary, confidential, and sensitive data (including but not limited to intellectual property, proprietary business information and personal data).

Previous wording

New data privacy and information security laws are being enacted in the United States and globally, and existing ones are being updated and strengthened. For example, the California Consumer Privacy Act (“CCPA”) went into effect on January 1, 2020 and requires companies that process personal data on California residents to make new disclosures to consumers about their data collection, use and sharing practices, and allow consumers to opt out of certain data sharing with third parties. The CCPA also provides for civil penalties for violations (up to $7,500 per violation), as well as a private right of action for certain data breaches that is expected to increase data breach litigation. In addition, the California Privacy Rights Act of 2020 (“CPRA”), which became effective on January 1, 2023, expands the compliance requirements and rights available to consumers under the CCPA. The CPRA also establishes a new California Privacy Protection Agency to implement and enforce the CCPA (as amended), which could increase the risk of an enforcement action. As such, the CPRA may require additional compliance investment and potential business process changes in the meantime. Other states, such as Virginia, Colorado, Utah and Connecticut, have also passed comprehensive data privacy laws, and similar laws are being considered in several other states. While these states, like the CCPA, also exempt some data processed in the context of clinical trials, these developments further complicate compliance efforts, and increase legal risk and compliance costs for us and the third parties upon whom we rely. Complying with these numerous, complex and often changing regulations is expensive and difficult, and failure to comply with any data privacy and information security laws or any security incident or breach involving the misappropriation, loss or other unauthorized use or disclosure of sensitive data, such as personal data, confidential patient or consumer information, whether by us, one of our business associates or another third-party, could negatively affect our business, financial condition and results of operations, including but not limited to: investigation costs, material fines and penalties; compensatory, special, punitive and statutory damages; litigation; consent orders regarding our privacy and security practices; requirements that we provide notices, credit monitoring services or credit restoration services or other relevant services to impacted individuals; adverse actions against our licenses to do business; and injunctive relief.

Current wording

New data privacy and information security laws are being enacted in the United States and globally, and existing ones are being updated and strengthened. For example, the California Consumer Privacy Act (“CCPA”) went into effect on January 1, 2020 and requires companies that process personal data on California residents to make new disclosures to consumers about their data collection, use and sharing practices, and allow consumers to opt out of certain data sharing with third parties. The CCPA also provides for civil penalties for violations (up to $7,500 per intentional violation), as well as a private right of action for certain data breaches that is expected to increase data breach litigation. In addition, the California Privacy Rights Act of 2020 (“CPRA”), which became effective on January 1, 2023, expands the compliance requirements and rights available to consumers under the CCPA. The CPRA also establishes a new California Privacy Protection Agency to implement and enforce the CCPA (as amended), which could increase the risk of an enforcement action. As such, the CPRA may require additional compliance investment and potential business process changes in the meantime. Other states, such as Virginia, Colorado, Utah and Connecticut, have also passed comprehensive data privacy laws, and similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. While these states, like the CCPA, also exempt some data processed in the context of clinical trials, these developments further complicate compliance efforts, and increase legal risk and compliance costs for us and the third parties with whom we work. Complying with these numerous, complex and often changing regulations is expensive and difficult, and failure to comply with any data privacy and information security laws or any security incident or breach involving the misappropriation, loss or other unauthorized use or disclosure of sensitive data, such as personal data, confidential patient or consumer information, whether by us, one of our business associates or another third-party, could negatively affect our business, financial condition and results of operations, including but not limited to: investigation costs, material fines and penalties; compensatory, special, punitive and statutory damages; litigation; consent orders regarding our privacy and security practices; requirements that we provide notices, credit monitoring services or credit restoration services or other relevant services to impacted individuals; adverse actions against our licenses to do business; and injunctive relief.

Previous wording

Outside the United States, an increasing number of laws, regulations, and industry standards govern data privacy and security. For example, the GDPR governs the processing (which can include any action, such as collection, use, storage adaptation or alteration, disclosure or transfer) of personal data relating to individuals located in Europe (including the UK). Among other things, the GDPR sets out extensive compliance requirements, including providing detailed disclosures about how personal data is collected and processed, demonstrating that an appropriate legal basis is in place to justify data processing activities; granting various rights for data subjects in regard to their personal data, such as the right to delete certain personal data, as well as enhancing pre-existing rights (e.g., data subject access requests); introducing the obligation to notify data protection regulators or supervisory authorities (and in certain cases, affected individuals) of significant data breaches; imposing limitations on retention of personal data; maintaining a record of data processing; complying with the principle of accountability and the obligation to demonstrate compliance through policies, procedures, training and audit; and expanding the definition of personal data to include coded data and requiring changes to informed consent practices, as well as more detailed notices for clinical trial subjects and investigators. The GDPR imposes substantial fines for breaches and violations (up to the greater of €20 million, £17.5 million, or, in each case, 4% of our global turnover, whichever is greater). The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies and obtain compensation for damages resulting from violations of the GDPR.

Current wording

(and in certain cases, affected individuals) of significant data breaches; imposing limitations on retention of personal data; maintaining a record of data processing; complying with the principle of accountability and the obligation to demonstrate compliance through policies, procedures, training and audit; and expanding the definition of personal data to include coded data and requiring changes to informed consent practices, as well as more detailed notices for clinical trial subjects and investigators. The GDPR imposes substantial fines for breaches and violations (up to the greater of €20 million, £17.5 million, or, in each case, 4% of our global turnover, whichever is greater). The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies and obtain compensation for damages resulting from violations of the GDPR.

Previous wording

Moreover, complying with the various data privacy and information security laws that are applicable to us could require us to take on more onerous obligations in our contracts, restrict our ability to collect, use and disclose data, or in some cases, impact our ability to operate in certain jurisdictions. In addition, these obligations may require us to change our business model. Any failure (or perceived failure) to comply could result in government enforcement actions (which could include civil or criminal penalties), private litigation and/or adverse publicity and could negatively affect our operating results and business. Claims that we have violated individuals’ privacy rights, failed to comply with data protection laws, or breached our contractual obligations, even if we are not found liable, could be expensive and time consuming to defend, could result in adverse publicity and could have a material adverse effect on our business, financial condition, and results of operations.

Current wording

Moreover, complying with the various data privacy and information security laws that are applicable to us could require us to take on more onerous obligations in our contracts, restrict our ability to collect, use and disclose data, or in some cases, impact our ability to operate in certain jurisdictions. In addition, these obligations may require us to change our business model. Any failure (or perceived failure) to comply could result in government enforcement actions (which could include civil or criminal penalties), private litigation, imprisonment of company officials, and/or adverse publicity and could negatively affect our operating results and business. Claims that we have violated individuals’ privacy rights, failed to comply with privacy laws, or breached our contractual obligations, even if we are not found liable, could be expensive and time consuming to defend, could result in adverse publicity and could have a material adverse effect on our business, financial condition, and results of operations.

Previous wording

Most healthcare providers, including hospitals from which we obtain patient health information, are subject to privacy and security regulations promulgated under HIPAA, as amended by the HITECH. We are not currently classified as a covered entity or business associate under HIPAA and thus are not subject to its requirements or penalties. However, any person may be prosecuted under HIPAA’s criminal provisions either directly or under aiding-and-abetting or conspiracy principles. Consequently, depending on the facts and circumstances, we could face substantial criminal penalties if we knowingly receive individually identifiable health information from a HIPAA-covered healthcare provider or research institution that has not satisfied HIPAA’s requirements for disclosure of individually identifiable health information. In addition, we may maintain sensitive personally identifiable information, including health information, that we receive throughout the clinical trial process, in the course of our research collaborations, and directly from individuals (or their healthcare providers) who enroll in our patient reimbursement support programs. As such, we may be subject to state laws requiring notification of affected individuals and state regulators in the event of a breach of personal data, which is a broader class of information than the health information protected by HIPAA. Our clinical trial programs outside the United States may implicate international data protection laws, including the GDPR and national legislation of European Union Member States or the UK.

Current wording

Most healthcare providers, including hospitals from which we obtain patient health information, are subject to privacy and security regulations promulgated under HIPAA, as amended by the HITECH. We are not currently classified as a covered entity or business associate under HIPAA and thus are not subject to its requirements or penalties. However, any person may be prosecuted under HIPAA’s criminal provisions either directly or under aiding-and-abetting or conspiracy principles. Consequently, depending on the facts and circumstances, we could face substantial criminal penalties if we knowingly receive individually identifiable health information from a HIPAA-covered healthcare provider or research institution that has not satisfied HIPAA’s requirements for disclosure of individually identifiable health information. In addition, we may maintain sensitive personally identifiable information, including health information, that we receive during the clinical trial process, through our research collaborations, via our LungTraX Platform, and directly from individuals (or their healthcare providers) who enroll in our patient reimbursement support programs. As such, we may be subject to state laws requiring notification of affected individuals and state regulators in the event of a breach of personal data, which is a broader class of information than the health information protected by HIPAA. Our clinical trial programs outside the United States may implicate international data protection laws, including the GDPR and national legislation of European Union Member States or the UK.

Previous wording

Moreover, patients about whom we or our collaborators obtain health information, as well as the providers who share this information with us, may have statutory or contractual rights that limit our ability to use and disclose the information. We may be required to expend significant capital and other resources to ensure ongoing compliance with applicable privacy and data security laws. Claims that we have violated individuals’ privacy rights or breached our contractual obligations, even if we are not found liable, could be expensive and time consuming to defend and could result in adverse publicity that could negatively affect our business, financial condition and results of operations. If we or third-party contractors or consultants fail to comply with applicable federal, state or local regulatory requirements, we could be subject to a range of regulatory actions that could affect our or our contractors’ ability to develop and commercialize our product candidates and could harm or prevent sales of any affected products that we are able to commercialize, or could substantially increase the costs and expenses of developing, commercializing and marketing our products. Any threatened or actual government enforcement action could also generate adverse publicity and require that we devote substantial resources that could otherwise be used in other aspects of our business.

Current wording

Moreover, patients about whom we or our collaborators obtain health information, as well as the providers who share this information with us, may have statutory or contractual rights that limit our ability to use and disclose the information. We may be required to expend significant capital and other resources to ensure ongoing compliance with applicable privacy and data security laws. Claims that we have violated individuals’ privacy rights or breached our contractual obligations, even if we are not found liable, could be expensive and time consuming to defend and could result in adverse publicity that could negatively affect our business, financial condition and results of operations. If we or third-party contractors or consultants fail to comply with applicable federal, state or local regulatory requirements, we could be subject to a range of regulatory actions that could affect our or our contractors’

Previous wording

The USPTO and various foreign governmental patent agencies require compliance with a number of procedural, documentary, fee payment and other similar provisions during the patent application process. In addition, periodic maintenance fees on issued patents often must be paid to the USPTO and foreign patent agencies over the lifetime of the patent. While an unintentional lapse can in many cases be cured by payment of a late fee or by other means in accordance with the applicable rules, there are situations in which noncompliance can result in abandonment or lapse of the patent or patent application, resulting in partial or complete loss of patent rights in the relevant jurisdiction. Non‑compliance events that could result in abandonment or lapse of a patent or patent application include, but are not limited to, failure to respond to official actions within prescribed time limits, non‑payment of fees and failure to properly legalize and submit formal documents. If we fail to maintain the patents and patent applications covering our products, we may not be able to stop a competitor from marketing products that are the same as or similar to our products, which would have a material adverse effect on our business.

Current wording

The USPTO and various foreign governmental patent agencies require compliance with a number of procedural, documentary, fee payment and other similar provisions during the patent application process. In addition, periodic maintenance fees on issued patents often must be paid to the USPTO and foreign patent agencies over the lifetime of the patent. While an unintentional lapse can in many cases be cured by payment of a late fee or by other means in accordance with the applicable rules, there are situations in which noncompliance can result in abandonment or lapse of the patent or patent application, resulting in partial or complete loss of patent rights in the relevant jurisdiction.

Previous wording

We rely on trademarks, service marks, tradenames and brand names to distinguish our products from the products of our competitors and have registered or applied to register these trademarks. We have not yet registered certain of our trademarks, including “CHARITE” in Germany, and as a result we sell certain products using names that may not be protected or may be subject to third party challenges for infringement of such third party’s trademarks. We cannot assure you that our trademark applications will be approved. During trademark registration proceedings, we may receive rejections. Although we are given an opportunity to respond to those rejections, we may be unable to overcome such rejections. In addition, in proceedings before the USPTO and comparable agencies in many foreign jurisdictions, third parties are given an opportunity to oppose pending trademark applications and to seek to cancel registered trademarks. Opposition or cancellation proceedings may be filed against our trademarks, and our trademarks may not survive such proceedings. In the event that our trademarks are successfully challenged, we could be forced to rebrand our products, which could result in loss of brand recognition and could require us to devote resources towards advertising and marketing new brands. At times, competitors may adopt trade names or trademarks similar to ours, thereby impeding our ability to build brand identity and possibly leading to market confusion. Certain of our current or future trademarks may become so well known by the public that their use becomes generic and they lose trademark protection. Over the long term, if we are unable to establish name recognition based on our trademarks and trade names, then we may not be able to compete effectively and our business, financial condition and results of operations may be adversely affected.

Current wording

We rely on trademarks, service marks, tradenames and brand names to distinguish our products from the products of our competitors and have registered or applied to register these trademarks. We have not yet registered certain of our trademarks and as a result we sell certain products using names that may not be protected or may be subject to third party challenges for infringement of such third party’s trademarks. We cannot assure you that our trademark applications will be approved. During trademark registration proceedings, we may receive rejections. Although we are given an opportunity to respond to those rejections, we may be unable to overcome such rejections. In addition, in proceedings before the USPTO and comparable agencies in many foreign jurisdictions, third parties are given an opportunity to oppose pending trademark applications and to seek to cancel registered trademarks. Opposition or cancellation proceedings may be filed against our trademarks, and our trademarks may not survive such proceedings. In the event that our trademarks are successfully challenged, we could be forced to rebrand our products, which could result in loss of brand recognition and could require us to devote resources towards advertising and marketing new brands. At times, competitors may adopt trade names or trademarks similar to ours, thereby impeding our ability to build brand identity and possibly leading to market confusion. Certain of our current or future trademarks may become so well known by the public that their use becomes generic and they lose trademark protection. Over the long term, if we are unable to establish name recognition based on our trademarks and trade names, then we may not be able to compete effectively and our business, financial condition and results of operations may be adversely affected.

Previous wording

•general economic, regulatory, and market conditions, including inflation, rising interest rates, economic recessions or economic slowdowns;

Current wording

•general economic, regulatory, and market conditions, including inflation, high interest rates, economic recessions or economic slowdowns;

Previous wording

On June 10, 2024, Glendon French, a current member of ourboard of directors and former chief executive officer, adopted a new Rule 10b5-1 trading arrangement intended to satisfy the affirmative defense conditions of Rule 10b5-1(c) under the Exchange Act for the sale of up to 300,000 shares of our common stock. The trading arrangement will expire on August 23, 2025, or earlier if all transactions under the trading arrangement are completed or if the trading arrangement is otherwise terminated according to its terms.

Current wording

On August 26, 2024, Mr. Rose adopted a new Rule 10b5-1 trading arrangement intended to satisfy the affirmative defense conditions of Rule 10b5-1(c) under the Exchange Act for the sale of up to 41,200 shares of our common stock. The trading arrangement will expire on October 31, 2025, or earlier if all transactions under the trading arrangement are completed or if the trading arrangement is otherwise terminated according to its terms.