Atara Biotherapeutics, Inc.

Previous wording

Investment in biopharmaceutical product development is highly speculative because it entails substantial upfront capital expenditures and significant risk that product candidates will fail to prove effective, gain regulatory approval or become commercially viable. We have one product, Ebvallo, which is approved in the EEA, the UK and Switzerland and have generated limited revenues from commercialization, and have incurred significant research, development and other expenses related to our ongoing operations and expect to continue to incur such expenses. As a result, we have incurred significant operating losses in every annual reporting period since our inception. For the six months ended June 30, 2025, we reported a net income of $40.4 million and expect to record net income for the full year 2025 due to significant reductions in operating expenses.

Current wording

Investment in biopharmaceutical product development is highly speculative because it entails substantial upfront capital expenditures and significant risk that product candidates will fail to prove effective, gain regulatory approval or become commercially viable. We have one product, Ebvallo, which is approved in the EEA, the UK and Switzerland and have generated limited revenues from commercialization, and have incurred significant research, development and other expenses related to our ongoing operations and expect to continue to incur such expenses. As a result, we have incurred significant operating losses in every annual reporting period since our inception. For the nine months ended September 30, 2025, we reported a net income of $36.1 million and expect to record net income for the full year 2025 due to significant reductions in operating expenses.

Previous wording

As of June 30, 2025, we had total cash and cash equivalents of $22.3 million. Our existing cash and cash equivalents as of June 30, 2025 will not be sufficient to fund our planned operations for at least the next twelve months from the date of issuance of these financial statements. These conditions raise substantial doubt about our ability to continue as a going concern for at least 12 months after the issuance of the accompanying condensed consolidated financial statements.

Current wording

As of September 30, 2025, we had total cash and cash equivalents of $13.7 million. Our existing cash, cash equivalents and short-term investments as of September 30, 2025 will not be sufficient to fund our planned operations for at least the next twelve months from the date of issuance of these financial statements. These conditions raise substantial doubt about our ability to continue as a going concern for at least 12 months after the issuance of the accompanying condensed consolidated financial statements.

Previous wording

Our development activities and/or commercialization planning with our partners could be harmed or delayed by governmental or regulatory delays due to a variety of factors. These factors include limitations on the availability of governmental and regulatory agency personnel to review regulatory filings or engage with us (caused by global health concerns or otherwise); changes to governmental regulatory requirements, policies, guidelines or priorities, reallocation, or availability of government resources; or for other reasons, that may significantly delay the FDA’s, or other regulatory agencies', ability to review and process any submissions we have filed or may file or cause other regulatory delays. If global health concerns prevent the FDA or other regulatory authorities from conducting their regular inspections, or impact reviews or other regulatory activities, it could significantly impact the ability of the FDA or other regulatory authorities to review and process our regulatory submissions in a timely fashion, which could have a material adverse effect on our business.

Current wording

Our development activities and/or commercialization planning with our partners could be harmed or delayed by governmental or regulatory delays due to a variety of factors. These factors include limitations on the availability of governmental and regulatory agency personnel to review regulatory filings or engage with us (caused by global health concerns or otherwise); changes to governmental regulatory requirements, policies, guidelines or priorities, reallocation, or availability of government resources; or for other reasons, that may significantly delay the FDA’s, or other regulatory agencies', ability to review and process any submissions we have filed or may file or cause other regulatory delays. If global health or other concerns prevent the FDA or other regulatory authorities from conducting their regular inspections, or impact reviews or other regulatory activities, it could significantly impact the ability of the FDA or other regulatory authorities to review and process our regulatory submissions in a timely fashion, which could have a material adverse effect on our business.

Previous wording

The results of preclinical studies or earlier clinical studies are not necessarily predictive of future results. Our existing product candidate may not receive regulatory approval.

Current wording

The results of preclinical studies or earlier clinical studies are not necessarily predictive of future results. Our existing product candidates may not receive regulatory approval.

Previous wording

Advertising and promotion of any product candidate that obtains approval in the U.S. will be heavily scrutinized by the FDA, the Department of Justice (DOJ), the Office of Inspector General of the Department of Health and Human Services (HHS), state attorneys general, members of the U.S. Congress and the public. Additionally, advertising and promotion of any product candidate that obtains approval outside of the U.S. will be heavily scrutinized by comparable foreign entities and stakeholders. For example, a company may not promote “off-label” uses for its drug products. An off-label use is the use of a product for an indication that is not described in the product’s FDA-approved label in the U.S. or for uses in other jurisdictions that differ from those approved by the applicable regulatory agencies. Physicians, on the other hand, may prescribe products for off-label uses. Although the FDA and other regulatory agencies do not regulate a physician’s choice of drug treatment made in the physician’s independent medical judgment, they do restrict promotional communications from companies or their sales force with respect to off-label uses of products for which marketing clearance has not been issued. However, companies may share truthful and not misleading information that is otherwise consistent with a product’s FDA approved labeling. Violations, including actual or alleged promotion of our products for unapproved or off-label uses, are subject to enforcement letters, inquiries and investigations, and civil and criminal sanctions by the FDA or comparable foreign bodies. Any actual or alleged failure to comply with labeling and promotion requirements may result in fines, warning letters, mandates to corrective information to healthcare practitioners, injunctions, or civil or criminal penalties. Further, promotion of products is currently an area of government scrutiny, and the applicable statutes, regulations and guidance and policies are complex, subject to changing interpretation, and subject to amendment.

Current wording

Advertising and promotion of any product candidate that obtains approval in the U.S. will be heavily scrutinized by the FDA, the Department of Justice (DOJ), the Office of Inspector General of the Department of Health and Human Services (HHS), state attorneys general, members of the U.S. Congress and the public. Additionally, advertising and promotion of any product candidate that obtains approval outside of the U.S. will be heavily scrutinized by comparable foreign entities and stakeholders. For example, a company may not promote “off-label” uses for its drug products. An off-label use is the use of a product for an indication that is not described in the product’s FDA-approved label in the U.S. or for uses in other jurisdictions that differ from those approved by the applicable regulatory agencies. Physicians, on the other hand, may prescribe products for off-label uses. Although the FDA and other regulatory agencies do not regulate a physician’s choice of drug treatment made in the physician’s independent medical judgment, they do restrict promotional communications from companies or their sales force with respect to off-label uses of products for which marketing clearance has not been issued. However, companies may share truthful and not misleading information that is otherwise consistent with a product’s FDA approved labeling. Violations, including actual or alleged promotion of our products for unapproved or off-label uses, are subject to enforcement letters, inquiries and investigations, and civil and criminal sanctions by the FDA or comparable foreign bodies. FDA has increased scrutiny of product claims and, in 2025, issued a significant number of enforcement actions to companies. Any actual or alleged failure to comply with labeling and promotion requirements may result in fines, warning letters, mandates to corrective information to healthcare practitioners, injunctions, or civil or criminal penalties. Further, promotion of products is currently an area of government scrutiny, and the applicable statutes, regulations and guidance and policies are complex, subject to changing interpretation, and subject to amendment.

Previous wording

Our ability to commercialize any product successfully will depend, in part, on the extent to which coverage and adequate reimbursement for these products and related treatments will be available from government health administration authorities, private health insurers and other organizations.

Current wording

Our or our partner's ability to commercialize any product successfully will depend, in part, on the extent to which coverage and adequate reimbursement for these products and related treatments will be available from government health administration authorities, private health insurers and other organizations.

Previous wording

Congress has not passed comprehensive repeal legislation, it has enacted laws that modify certain provisions of the ACA, such as removing penalties, starting January 1, 2019, for not complying with the ACA’s individual mandate to carry health insurance and eliminating the implementation of certain mandated fees. On June 17, 2021, the U.S. Supreme Court dismissed a legal challenge to the law brought by several states arguing that, without the individual mandate, the entire ACA was unconstitutional. The Supreme Court dismissed the lawsuit without ruling on the merits of the states’ constitutionality arguments. Further, the Inflation Reduction Act (IRA), signed into law in August 2022, extended the provision of enhanced subsidies for individuals purchasing health coverage through the ACA marketplace. The enhanced subsidies, which were originally passed as part of the American Rescue Plan Act are now extended through 2025. In the future, there may be additional challenges and/or amendments to the ACA. It is unclear how future litigation and the healthcare reform measures of future presidential administrations will impact the ACA and our business.

Current wording

Congress has not passed comprehensive repeal legislation, it has enacted laws that modify certain provisions of the ACA, such as removing penalties, starting January 1, 2019, for not complying with the ACA’s individual mandate to carry health insurance and eliminating the implementation of certain mandated fees. On June 17, 2021, the U.S. Supreme Court dismissed a legal challenge to the law brought by several states arguing that, without the individual mandate, the entire ACA was unconstitutional. The Supreme Court dismissed the lawsuit without ruling on the merits of the states’ constitutionality arguments. Further, the Inflation Reduction Act (IRA), signed into law in August 2022, extended the provision of enhanced subsidies for individuals purchasing health coverage through the ACA marketplace. The enhanced subsidies, which were originally passed as part of the American Rescue Plan Act were extended through 2025. In the future, there may be additional challenges and/or amendments to the ACA. It is unclear how future litigation and the healthcare reform measures of future presidential administrations will impact the ACA and our business.

Previous wording

Legislative and regulatory proposals have been made to expand post-approval requirements and restrict sales and promotional activities for pharmaceutical products. We cannot be sure whether additional legislative changes will be enacted, or whether the U.S. or foreign regulations, guidance or interpretations will be changed, or what the impact of these changes on the regulatory approvals of our product and product candidates, if any, may be. In the U.S., the EU and other potentially significant markets for our product and product candidates, government authorities and third party payors are increasingly attempting to limit or regulate the price of medical products and services, particularly for new and innovative products and therapies, which has resulted in lower average selling prices for certain products in certain markets. In the U.S., there have been several congressional inquiries and proposed and enacted federal and state legislation designed to, among other things, bring more transparency to drug pricing, review the relationship between pricing and manufacturer patient programs, and reform government program reimbursement methodologies for drugs. For example, the Consolidated Appropriations Act of 2021 included several drug price reporting and transparency measures, such as a new requirement for certain Medicare plans to develop tools to display Medicare Part D prescription drug benefit information in real time and for group and health insurance issuers to report information on pharmacy benefit and drug costs to the Secretaries of Health and Human Services, Labor, and the Treasury. Additionally, the IRA allows Medicare to: beginning in 2026, establish a “maximum fair price” for certain pharmaceutical and biological products covered under Medicare Parts B and D; beginning in 2023, penalize drug companies that raise prices for products covered under Medicare Parts B and D faster than inflation; and beginning in 2025 impose new discount obligations on pharmaceutical and biological manufacturers for products covered under Medicare Part D. Centers for Medicare and Medicaid (CMS) continues to take steps to implement the IRA, including, most notably: releasing the negotiated maximum prices, which will be effective in 2026, for the first ten drugs that were subject to the IRA’s negotiation process, releasing quarterly lists of Medicare Part B products that are subject to adjusted coinsurance rates based on the inflationary rebate provisions of the IRA, and announcing a list of fifteen additional drugs that will be subject to price negotiations during 2025. While it remains to be seen how the drug pricing provisions imposed by the IRA will affect the broader pharmaceutical industry, several pharmaceutical manufacturers and other industry stakeholders have challenged the law, including through lawsuits brought against the U.S. Department of Health and Human Services, the Secretary of the U.S. Department of Health and Human Services, CMS, and the CM…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Legislative and regulatory proposals have been made to expand post-approval requirements and restrict sales and promotional activities for pharmaceutical products. We cannot be sure whether additional legislative changes will be enacted, or whether the U.S. or foreign regulations, guidance or interpretations will be changed, or what the impact of these changes on the regulatory approvals of our product and product candidates, if any, may be. In the U.S., the EU and other potentially significant markets for our product and product candidates, government authorities and third party payors are increasingly attempting to limit or regulate the price of medical products and services, particularly for new and innovative products and therapies, which has resulted in lower average selling prices for certain products in certain markets. In the U.S., there have been several congressional inquiries and proposed and enacted federal and state legislation designed to, among other things, bring more transparency to drug pricing, review the relationship between pricing and manufacturer patient programs, and reform government program reimbursement methodologies for drugs. For example, the Consolidated Appropriations Act of 2021 included several drug price reporting and transparency measures, such as a new requirement for certain Medicare plans to develop tools to display Medicare Part D prescription drug benefit information in real time and for group and health insurance issuers to report information on pharmacy benefit and drug costs to the Secretaries of Health and Human Services, Labor, and the Treasury. Additionally, the IRA allows Medicare to: beginning in 2026, establish a “maximum fair price” for certain pharmaceutical and biological products covered under Medicare Parts B and D; penalize drug companies that raise prices for products covered under Medicare Parts B and D faster than inflation; and impose new discount obligations on pharmaceutical and biological manufacturers for products covered under Medicare Part D. Centers for Medicare and Medicaid (CMS) continues to take steps to implement the IRA, including, most notably: releasing the negotiated maximum prices, which will be effective in 2026, for the first ten drugs that were subject to the IRA’s negotiation process and releasing quarterly lists of Medicare Part B products that are subject to adjusted coinsurance rates based on the inflationary rebate provisions of the IRA. While it remains to be seen how the drug pricing provisions imposed by the IRA will affect the broader pharmaceutical industry, several pharmaceutical manufacturers and other industry stakeholders have challenged the law, including through lawsuits brought against the U.S. Department of Health and Human Services, the Secretary of the U.S. Department of Health and Human Services, CMS, and the CMS Administrator challenging the constitutionality and administrative implementation of the IRA’s drug price negotiation provisions. Addition…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Other recent administrative actions may affect our partner's upcoming government pricing responsibilities stemming from our anticipated participation in government pricing programs. For example, in September 2024, CMS published a final rule that included significant revisions to certain Medicaid Drug Rebate Program provisions, including, but not limited to: (i) new definitions for key terms under the Medicaid Drug Rebate Program, such as "covered outpatient drug" and "market date"; (ii) revised processes for identifying drug misclassifications, as well as additional penalties that can be imposed against manufacturers in connection with such misclassifications; and (iii) a new 12-quarter time limit for manufacturers to initiate disputes, hearing requests, and audits for state-invoiced rebate amounts. In addition, there are pending legal and legislative developments relating to the 340B drug pricing program, including ongoing litigation challenging federal enforcement actions against manufacturers and recently introduced and enacted state legislation. In March 2024, the US Court of Appeals for the Eighth Circuit upheld the Arkansas law prohibiting drug makers for restricting 340B drug discounts for providers using contract pharmacies. It remains to be seen how these drug pricing initiatives will affect the broader pharmaceutical industry.

Current wording

Other recent administrative actions may affect our partner's upcoming government pricing responsibilities stemming from our anticipated participation in government pricing programs. For example, in September 2024, CMS published a final rule that included significant revisions to certain Medicaid Drug Rebate Program provisions, including, but not limited to: (i) new definitions for key terms under the Medicaid Drug Rebate Program, such as "covered outpatient drug" and "market date"; (ii) revised processes for identifying drug misclassifications, as well as additional penalties that can be imposed against manufacturers in connection with such misclassifications; and (iii) a new 12-quarter time limit for manufacturers to initiate disputes, hearing requests, and audits for state-invoiced rebate amounts. In addition, there are pending legal and legislative developments relating to the 340B drug pricing program, including ongoing litigation challenging federal enforcement actions against manufacturers and recently introduced and enacted state legislation. In March 2024, the US Court of Appeals for the Eighth Circuit upheld the Arkansas law prohibiting drug makers for restricting 340B drug discounts for providers using contract pharmacies. The current administration has also considered several changes to the 340B program, including a proposal in the

Previous wording

At the state level, legislatures have increasingly passed legislation and implemented regulations designed to control pharmaceutical and biological product pricing, including price or patient reimbursement constraints, discounts, restrictions on certain product access and marketing cost disclosure and transparency measures, and, in some cases, to encourage importation from other countries and bulk purchasing. Another emerging trend at the state level is the establishment of prescription drug affordability boards, some of which will prospectively permit certain states to establish upper payment limits for drugs that the state has determined to be “high-cost”. Furthermore, the increased emphasis on managed healthcare in the U.S. and on country and regional pricing and reimbursement controls in the EU will put additional pressure on product pricing, reimbursement and usage, which may adversely affect our future product sales. These pressures can arise from rules and practices of managed care groups, other insurers, judicial decisions and governmental laws and regulations related to Medicare, Medicaid and healthcare reform, pharmaceutical reimbursement policies and pricing in general.

Current wording

At the state level, legislatures have increasingly passed legislation and implemented regulations designed to control pharmaceutical and biological product pricing, including price or patient reimbursement constraints, discounts, restrictions on certain product access marketing cost disclosure and transparency measures, and, in some cases, to encourage importation from other countries and bulk purchasing. Another emerging trend at the state level is the establishment of prescription drug affordability boards, some of which will prospectively permit certain states to establish upper payment limits for drugs that the state has determined to be “high-cost”. Prescription drug affordability boards in several states, including Colorado, Maryland,

Previous wording

As of June 30, 2025, we had 38 employees. We may encounter difficulties in managing the size of our operations to support our continuing development activities and the commercialization of our product and potential commercialization of our product candidates by our partners. As our development and commercialization plans and strategies continue to evolve, or as a result of any future acquisitions, we must continue to improve our managerial, operational, financial and other procedures and processes to manage the size our of operations. Our management, personnel and systems currently in place may not be adequate to support any future growth. Future growth would impose significant added responsibilities on members of management, including:

Current wording

As of September 30, 2025, we had 38 employees, which decreased to approximately 15 employees following the subsequent reduction in force in October 2025. We may encounter difficulties in managing the size of our operations to support our continuing development activities and the commercialization of our product and potential commercialization of our product candidates by our partners. As our development and commercialization plans and strategies continue to evolve, or as a result of any future acquisitions, we must continue to improve our managerial, operational, financial and other procedures and processes to manage the size our of operations. Our management, personnel and systems currently in place may not be adequate to support any future growth. Future growth would impose significant added responsibilities on members of management, including:

Previous wording

As a result of our public float (the market value of our common shares held by non-affiliates) as of June 30, 2023, we qualify as a “smaller reporting company,” as defined under the Exchange Act. In addition, we are a “non-accelerated filer” as defined under the Exchange Act. For as long as we continue to be a smaller reporting company or a non-accelerated filer, we may choose to take advantage of exemptions from various reporting requirements applicable to other public companies that are not smaller reporting companies or non-accelerated filers, as applicable, including, but not limited to, an exemption from the requirement that our independent registered public accounting firm attest to the effectiveness of our internal control over financial reporting under Section 404 of the Sarbanes-Oxley Act.

Current wording

We qualify as a “smaller reporting company,” as defined under the Exchange Act. In addition, we are a “non-accelerated filer” as defined under the Exchange Act. For as long as we continue to be a smaller reporting company or a non-accelerated filer, we may choose to take advantage of exemptions from various reporting requirements applicable to other public companies that are not smaller reporting companies or non-accelerated filers, as applicable, including, but not limited to, an exemption from the requirement that our independent registered public accounting firm attest to the effectiveness of our internal control over financial reporting under Section 404 of the Sarbanes-Oxley Act.

Previous wording

We are highly dependent upon our executive officers and other key employees and the loss of the services of any of our executive officers or other key employees, including scientific, technical or management personnel, could impede the achievement of our corporate objectives. In August 2022, we announced a reduction of our workforce by approximately 20% across all areas of our company, including members of management. In November 2023, we implemented a further reduction of our workforce by approximately 30%, and in January 2024, we conducted an additional reduction of our workforce by approximately 25%, including a member of management. In September 2024, Pascal Touchon, our President and Chief Executive Officer stepped down from his position and was appointed Chairperson of our board of directors, and AnhCo “Cokey” Nguyen, our Chief Scientific and Technical Officer, was appointed as our President and Chief Executive Officer. Losing members of management and other key personnel subjects us to a number of risks, including the failure to coordinate responsibilities and tasks, the necessity to create new management systems and processes, the impact on corporate culture, and the retention of historical knowledge. In addition, we may not be able to effectively transition members of our management into their new roles.

Current wording

We are highly dependent upon our executive officers and other key employees and the loss of the services of any of our executive officers or other key employees, including scientific, technical, accounting and finance or management personnel, could impede the achievement of our corporate objectives. In August 2022, we announced a reduction of our workforce by approximately 20% across all areas of our company, including members of management. In November 2023, we implemented a further reduction of our workforce by approximately 30%, and in January 2024, we conducted an additional reduction of our workforce by approximately 25%, including a member of management. In September 2024, Pascal Touchon, our President and Chief Executive Officer stepped down from his position and was appointed Chairperson of our board of directors, and AnhCo “Cokey” Nguyen, our Chief Scientific and Technical Officer, was appointed as our President and Chief Executive Officer. We implemented additional reductions in force in January, March, May and October 2025. Losing members of management and other key personnel subjects us to a number of risks, including the failure to coordinate responsibilities and tasks, the necessity to create new management systems and processes, the impact on corporate culture, and the retention of historical knowledge. In addition, we may not be able to effectively transition members of our management into their new roles.

Previous wording

In August 2022, we reduced our workforce by approximately 20% across all areas of our company, including members of management. In November 2023, we further reduced our workforce by approximately 30%. In January 2024, we announced another reduction of our workforce by approximately 25%. In January 2025, we announced another reduction of our workforce by approximately 50%. In March 2025, we further reduced our workforce by approximately 50%, retaining approximately 35 employees essential to execute on our strategic priorities. In May 2025, we further reduced our workforce by approximately 30%, retaining approximately 23 employees essential to executing our strategic priorities. The reductions in force reflect a prioritization around key research and development programs and the reduction of our expense profile. We may not realize, in full or in part, the anticipated benefits, savings and improvements in our cost structure from our restructuring efforts due to unforeseen difficulties, delays or unexpected costs. If we are unable to realize the expected operational efficiencies and cost savings from restructuring, our operating results and financial condition would be adversely affected. We also cannot be certain that we will not have to undertake additional workforce reductions or restructuring activities in the future. Furthermore, our cost savings plan may be disruptive to our operations, which could affect our ability to generate product revenue. In addition, our workforce reductions could yield unanticipated consequences, such as attrition beyond planned staff reductions, or disruptions in our day-to-day operations. Our workforce reductions could also harm our ability to attract and retain qualified management, scientific, clinical, and manufacturing personnel who are critical to our business. Any failure to attract or retain qualified personnel could prevent us from successfully developing and commercializing our product candidates in the future, including tab-cel, if approved.

Current wording

In August 2022, we reduced our workforce by approximately 20% across all areas of our company, including members of management. In November 2023, we further reduced our workforce by approximately 30%. In January 2024, we announced another reduction of our workforce by approximately 25%. In January 2025, we announced another reduction of our workforce by approximately 50%. In March 2025, we further reduced our workforce by approximately 50%, retaining approximately 35 employees essential to execute on our strategic priorities. In May 2025, we further reduced our workforce by approximately 30%, retaining approximately 23 employees essential to executing our strategic priorities. In October 2025, we announced a further reduction in workforce of approximately 29% of total workforce, retaining approximately 15 employees essential to executing on our strategic priorities. The reductions in force reflect a prioritization around key research and development programs and the reduction of our expense profile. We may not realize, in full or in part, the anticipated benefits, savings and improvements in our cost structure from our restructuring efforts due to unforeseen difficulties, delays or unexpected costs. If we are unable to realize the expected operational efficiencies and cost savings from restructuring, our operating results and financial condition would be adversely affected. We also cannot be certain that we will not have to undertake additional workforce reductions or restructuring activities in the future. Furthermore, our cost savings plan may be disruptive to our operations, which could affect our ability to generate product revenue. In addition, our workforce reductions could yield unanticipated consequences, such as attrition beyond planned staff reductions, or disruptions in our day-to-day operations. Our workforce reductions could also harm our ability to attract and retain qualified management, scientific, clinical, and manufacturing personnel who are critical to our business. Any failure to attract or retain qualified personnel could prevent us from successfully developing and commercializing our product candidates in the future, including tab-cel, if approved.

Previous wording

We are or may become subject to numerous domestic and foreign laws and regulations regarding privacy, data protection, and data security, the scope of which is changing, subject to differing applications and interpretations and may be inconsistent among countries, or conflict with other rules. We are also subject to the terms of our contractual obligations to customers and third parties related to privacy, data protection, and data security. The actual or perceived failure by us, our customers, our vendors, or other relevant third parties to address or comply with these laws, regulations, and obligations could increase our compliance and operational costs, expose us to regulatory scrutiny, actions, fines and penalties, cause regulators to reject, limit or disrupt our clinical trial activities, result in reputational harm, lead to a loss of customers, reduce the use of our products, result in litigation and liability, and could otherwise cause a material adverse effect on our business, financial condition, and results of operations.

Current wording

We are or may become subject to numerous domestic and foreign laws and regulations regarding privacy, data protection, data security, data residency or transfers, the scope of which is changing, subject to differing applications and interpretations and may be inconsistent among countries, or conflict with other rules. We are also subject to the terms of our contractual obligations to customers and third parties related to privacy, data protection, data security, and data transfers. The actual or perceived failure by us, our customers, our vendors, or other relevant third parties to address or comply with these laws, regulations, and obligations could increase our compliance and operational costs, expose us to regulatory scrutiny, actions, fines and penalties, cause regulators to reject, limit or disrupt our clinical trial activities, result in reputational harm, lead to a loss of customers, reduce the use of our products, result in litigation and liability, and could otherwise cause a material adverse effect on our business, financial condition, and results of operations.

Previous wording

For example, the EU General Data Protection Regulation (EU) 2016/679 (EU GDPR) imposes strict requirements on in-scope organizations regarding the processing of personal information (i.e., data which identifies an individual or from which an individual is identifiable) of individuals (or data subjects). The EU GDPR governs the collection, use, disclosure, transfer and other processing of personal information and has direct effect in all EU Member States and extraterritorial effect where organizations outside of the European Economic Area (EEA) process personal information of individuals in the EEA in relation to the offering of goods or services to those individuals or the monitoring of their behavior. The UK has implemented the EU GDPR into its national law by virtue of section 3 of the European Union (Withdrawal) Act as the UK GDPR (together, the UK GDPR and the EU GDPR, the GDPR). The UK GDPR sits alongside the UK Data Protection Act 2018 (as amended) and is for the time being broadly aligned with the EU GDPR including, as it relates to extra-territorial application. As such, the GDPR applies to us to the extent we are established in an EU Member State or the UK, we are processing personal information in the context of an establishment in an EU Member State or the UK or we are processing personal information in relation to the offering of goods or services to individuals in the EEA or the UK or monitoring their behavior.

Current wording

For example, several laws and regulations such as the EU General Data Protection Regulation (EU) 2016/679 (EU GDPR) impose strict requirements on in-scope organizations regarding the processing of personal information (i.e., data which identifies an individual or from which an individual is identifiable) of individuals (or data subjects). The EU GDPR governs the collection, use, disclosure, transfer and other processing of personal information and has direct effect in all EU Member States and extraterritorial effect where organizations outside of the European Economic Area (EEA) process personal information of individuals in the EEA in relation to the offering of goods or services to those individuals or the monitoring of their behavior. The UK has implemented the EU GDPR into its national law by virtue of section 3 of the European Union (Withdrawal) Act as the UK GDPR (together, the UK GDPR and the EU GDPR, the GDPR). The UK GDPR sits alongside the UK Data Protection Act 2018 (as amended) and is for the time being broadly aligned with the EU GDPR including, as it relates to extra-territorial application. As such, the GDPR applies to us to the extent we are established in an EU Member State or the UK, we are processing personal information in the context of an establishment in an EU Member State or the UK or we are processing personal information in relation to the offering of goods or services to individuals in the EEA or the UK or monitoring their behavior.

Previous wording

The GDPR imposes onerous and comprehensive privacy, data protection, and data security obligations onto controllers, including, as applicable: (i) contractual privacy, data protection, and data security commitments, including the requirement to implement appropriate technical and organizational measures to safeguard personal information processed; (ii) establishing means for individuals to exercise their data protection rights (e.g., the right to erasure of personal information); (iii) limitations on retention and the amount of personal information processed; (iv) additional requirements pertaining to sensitive information (such as health data); (v) data breach notification requirements to: (x) supervisory authorities without undue delay (and no later than 72 hours where feasible) after becoming aware of the breach, unless the breach is unlikely to result in a risk to the data subjects’ rights and freedoms; and/or (y) concerned individuals where the breach is likely to result in a high risk to their rights and freedoms; (vi) requirements to process personal information lawfully including specific requirements for obtaining valid consent from data subjects where consent is the lawful basis for processing; (vii) obligations to consider data protection as any new products or services are developed and designed; and (viii) accountability and transparency requirements, which require controllers to demonstrate and record compliance with the GDPR and to provide more detailed information to data subjects(such as clinical trial subjects and investigators) regarding processing. The GDPR also provides that EU Member States and the UK (as applicable) may introduce further laws and regulations limiting the processing of genetic, biometric, or health data, which could limit our ability to collect, use and share personal information subject to the GDPR, cause our compliance costs to increase, require us to change our practices, adversely impact our business, and harm our financial condition.

Current wording

The GDPR imposes onerous and comprehensive privacy, data protection, and data security obligations onto controllers, including, as applicable: (i) contractual privacy, data protection, and data security commitments, including the requirement to implement appropriate technical and organizational measures to safeguard personal information processed; (ii) establishing means for individuals to exercise their data protection rights (e.g., the right to erasure of personal information); (iii) limitations on retention and the amount of personal information processed; (iv) additional requirements pertaining to sensitive information (such as health data); (v) data breach notification requirements to: (x) supervisory authorities without undue delay (and no later than 72 hours where feasible) after becoming aware of the breach, unless the breach is unlikely to result in a risk to the data subjects’ rights and freedoms; and/or (y) concerned individuals where the breach is likely to result in a high risk to their rights and freedoms without undue delay; (vi) requirements to process personal information lawfully including specific requirements for obtaining valid consent from data subjects where consent is the lawful basis for processing; (vii) obligations to consider data protection as any new products or services are developed and designed; and (viii) accountability and transparency requirements, which require controllers to demonstrate and record compliance with the GDPR and to provide more detailed information to data subjects(such as clinical trial subjects and investigators) regarding processing of their personal data. The GDPR also provides that EU Member States and the UK (as applicable) may introduce further laws and regulations limiting the processing of genetic, biometric, or health data, which could limit our ability to collect, use and share personal information subject to the GDPR, cause our compliance costs to increase, require us to change our practices, adversely impact our business, and harm our financial condition.

Previous wording

In addition, the EU GDPR also prohibits the transfer of personal information from the EEA to countries that the European Commission does not recognize as having an “adequate” level of data protection unless the parties to the transfer have implemented specific safeguards to protect the transferred personal information (e.g., EU Standard Contractual Clauses or EU SCCs). Data protection laws in the UK and Switzerland impose similar restrictions. There is also a requirement in certain cases for companies to carry out a transfer impact assessment (TIA) which, among other things, assess laws governing access to personal information in the recipient country and considers whether supplementary measures that provide privacy protections additional to those under the EU SCCs will need to be implemented to ensure an “essentially equivalent” level of data protection to that afforded in the EU.

Current wording

In addition, the EU GDPR also prohibits the transfer of personal information from the EEA to countries that the European Commission does not recognize as having an “adequate” level of data protection unless the parties to the transfer have implemented specific safeguards to protect the transferred personal information (e.g., EU Standard Contractual Clauses or EU SCCs). Data protection, data residency or transfer laws or regulations in the UK, Switzerland, United States and other jurisdictions impose similar or related data residency or transfer restrictions. There is also a requirement in certain cases for companies to carry out data flow analysis, risk assessments, vendor diligence or transfer impact assessments (TIA). These obligations can, among other things, require assessments of laws governing access to personal information in the recipient country and considers whether supplementary measures that provide privacy protections additional to those under the EU SCCs will need to be implemented to ensure an “essentially equivalent” level of data protection to that afforded in the EU.

Previous wording

Regulation of privacy, data protection and data security has also become more stringent in the United States, with several new laws following the CCPA and being enacted at the state level, including several comprehensive privacy laws. While these new laws and proposals generally include exemptions for HIPAA-covered data and clinical trial data, they add layers of complexity to compliance in the U.S. market, and could increase our compliance costs and adversely affect our business. Multiple other states and the federal government are considering enacting similar legislation, demonstrating a strong trend towards more stringent state privacy, data protection and data security legislation in the U.S., as well as enhanced scrutiny on international data flows, which could increase our potential liability and adversely affect our business. Other states have passed or amended existing state privacy laws to impose enhanced privacy and cybersecurity obligations for consumer health data, such as, the Washington My Health My Data Act and Nevada’s Consumer Health Data Privacy Law. For instance, Washington State's “My Health My Data Act” regulates “consumer health data” which is defined as “personal information that is linked or reasonably linkable to a consumer and that identifies a consumer’s past, present, or future physical or mental health.” Additional states may enact laws regulating consumer health data which may impact our operations.

Current wording

Regulation of privacy, data protection and data security has also become more stringent in the United States, with several new laws following the CCPA and being enacted at the state level, including several comprehensive privacy laws. While these new laws and proposals generally include exemptions for HIPAA-covered data and clinical trial data, they add layers of complexity to compliance in the U.S. market, and could increase our compliance costs and adversely affect our business. Multiple other states and the federal government are considering enacting similar legislation, demonstrating a strong trend towards more stringent state privacy, data protection and data security legislation in the U.S., as well as enhanced scrutiny on international data flows, which could increase our potential liability and adversely affect our business. Other states have passed or amended existing state privacy laws to impose enhanced privacy and cybersecurity obligations for consumer health data, such as, the Washington My Health My Data Act and Nevada’s Consumer Health Data Privacy Law. For instance, Washington State's “My Health My Data Act” regulates “consumer health data” which is defined as “personal information that is linked or reasonably linkable to a consumer and that identifies a consumer’s past, present, or future physical or mental health.” Other states, such as Connecticut, Nevada, and Maryland have also enacted privacy legislation with particular provisions for consumer health data, and additional states may adopt health-specific privacy requirements that could impact our business activities depending on how they are interpreted.

Previous wording

In addition, federal agency priorities, leadership, policies, rulemaking, communications, spending, and staffing may be significantly impacted by election cycles. For example, the current U.S. presidential administration has committed to significantly reduce government spending through cuts to federal healthcare programs and reductions in the workforces of key government agencies, such as HHS, FDA, and CMS. Efforts by the current administration to limit federal agency budgets or personnel may result in reductions to agency budgets, employees, and operations, which may lead to slower response times, less guidance and longer review periods, potentially affecting our ability to progress development of our product candidates or obtain regulatory approval for our product candidates. Any resulting changes in regulation may result in unexpected delays, increased costs, or other negative impacts on our business that are difficult to predict.

Current wording

In addition, federal agency activities, priorities, leadership, policies, rulemaking, communications, spending, and staffing may be significantly impacted by election cycles and legislative developments. For example, the current U.S. presidential administration has committed to significantly reduce government spending through cuts to federal healthcare programs and reductions in the workforces of key government agencies, such as HHS, FDA, and CMS. Further efforts by the current administration to reduce federal spending may result in reductions to agency budgets, employees, and operations, which may lead to slower response times, less guidance and longer review periods, potentially affecting our ability to progress development of our product candidates or obtain regulatory approval for our product candidates. The administration and agencies have also made abrupt announcements about new or changed regulatory policies, such as policies related to use of AI to review product applications. And, the recent federal government shutdown may prevent the FDA or other regulatory authorities from conducting their regular inspections, reviews or other regulatory activities, and may significantly impact the ability of the FDA to timely review and process our regulatory submissions. These developments may lead to greater uncertainty regarding FDA policies, slower response times, longer review periods, unexpected delays, increased costs, or other negative impacts on our business that are difficult to predict. These changes may potentially affect our or our partner's ability to progress development of our product candidates or obtain regulatory approval for our product candidates.