ATOSSA THERAPEUTICS, INC.

Previous wording

Our business is subject to a number of risks and uncertainties, including risks and uncertainties that may prevent us from achieving our business objectives or may adversely affect our business, clinical and commercialization activities, the manufacturing of our product candidates, intellectual property, third party relationships, competitive environment, product and environmental liabilities, and our common stock. Purchasing shares of common stock is an investment in our securities and involves a high degree of risk and uncertainty. You should carefully consider the following information about these risks and uncertainties, together with the other information contained in this Annual Report on Form 10-K for the year ended December 31, 2024, before purchasing our securities. If any of the following risks and uncertainties actually occur, our business, financial condition and results of operations may suffer. In that case, the market price of our common stock could decline, and you may lose part or all of your investment in our Company. These risks and uncertainties are discussed more fully below and include, but are not limited to, risks related to:

Current wording

Our business is subject to a number of risks and uncertainties, including risks and uncertainties that may prevent us from achieving our business objectives or may adversely affect our business, clinical and commercialization activities, the manufacturing of our product candidates, intellectual property, third party relationships, competitive environment, product and environmental liabilities, our ability to continue as a going concern and our common stock. Purchasing shares of common stock is an investment in our securities and involves a high degree of risk and uncertainty. You should carefully consider the following information about these risks and uncertainties, together with the other information contained in this Annual Report on Form 10-K for the year ended December 31, 2025, before purchasing our securities. If any of the following risks and uncertainties actually occur, our business, financial condition and results of operations may suffer. In that case, the market price of our common stock could decline, and you may lose part or all of your investment in our Company. These risks and uncertainties are discussed more fully below and include, but are not limited to, risks related to:

Previous wording

We have a history of operating losses, and we expect to continue to incur losses in the future.

Current wording

We have a history of operating losses and expect to continue to incur losses in the future.

Previous wording

Our shares of common stock are listed on the Nasdaq Capital Market, but we cannot guarantee that we will be able to regain compliance with the continued listing standards or satisfy the continued listing standards going forward.

Current wording

Our shares of common stock are listed on the Nasdaq Capital Market, but we cannot guarantee that we will be able to maintain compliance with the continued listing standards or satisfy the continued listing standards going forward.

Previous wording

In evaluating our business, you should carefully consider the following discussion of material risks, events and uncertainties that make an investment in us speculative or risky in addition to the other information included in this Annual Report. A manifestation of any of the following risks and uncertainties could, in circumstances we may or may not be able to accurately predict, materially and adversely affect our business and operations, growth, reputation, prospects, operating and financial results, financial condition, cash flows, liquidity and stock price. Some of the factors, events and contingencies discussed below may have occurred in the past, but the disclosures below are not representations as to whether or not the factors, events or contingencies have occurred in the past, and instead reflect our beliefs and opinions as to the factors, events, or contingencies that could materially and adversely affect us in the future. The risks and uncertainties described below are not the only ones we face. Our operations could also be affected by factors, events or uncertainties that are not presently known to us or that we currently do not consider to present significant risks to our business. Therefore, you should not consider the following risks to be a complete statement of all the potential risks or uncertainties that we face.

Current wording

In evaluating our business, you should carefully consider the following discussion of material risks, events and uncertainties that make an investment in us speculative or risky in addition to the other information included in this Annual Report. A manifestation of any of the following risks and uncertainties could, in circumstances we may or may not be able to accurately predict, materially and adversely affect our business and operations, growth, reputation, prospects, operating and financial results, financial condition, cash flows, liquidity and stock price. Some of the factors, events and contingencies discussed below may have occurred in the past, but the disclosures below are not representations as to whether or not the factors, events or contingencies have occurred in the past, and instead reflect our beliefs and opinions as to the factors, events, or contingencies that could materially and adversely affect us in the future. References to past events are provided by way of example only and are not intended to be a complete listing or a representation as to whether or not such factors have occurred in the past. The risks and uncertainties described below are not the only ones we face. Our operations could also be affected by factors, events or uncertainties that are not presently known to us or that we currently do not consider to present significant risks to our business. Therefore, you should not consider the following risks to be a complete statement of all the potential risks or uncertainties that we face.

Previous wording

We have a history of operating losses, and, as such, an investor cannot assess our profitability or performance based on past results.

Current wording

We have a history of operating losses and expect to continue to incur losses in the future, and, as such, an investor cannot assess our profitability or performance based on past results.

Previous wording

We have a limited operating history and have incurred net losses each year. Our net loss for the year ended December 31, 2024 was approximately $25.5 million. We will continue to incur further losses in connection with research and development costs for development of our programs, including ongoing and additional clinical studies.

Current wording

Since December 2015, our business has primarily focused on the development of novel therapeutics for the treatment of breast cancer and other breast conditions. We have a limited operating history and have incurred net losses each year. Our net losses for the years ended December 31, 2025 and 2024 were $34.8 million and $25.5 million, respectively. We will continue to incur further losses in connection with costs for development of our programs, including ongoing and additional clinical studies.

Previous wording

Since December 2015, our business has primarily focused on the development of novel therapeutics for the treatment of breast cancer and other breast conditions. Because of our limited operating history, particularly in the area of pharmaceutical development, our revenue and income potential is uncertain and cannot be based on prior results. Any evaluation of our business and prospects must be considered in light of these factors and the risks and uncertainties often encountered by companies in the development stage. Some of these risks and uncertainties include our ability to:

Current wording

Because of our limited operating history, particularly in the area of pharmaceutical development, our revenue and income potential is uncertain and cannot be based on prior results. Any evaluation of our business and prospects must be considered in light of these factors and the risks and uncertainties often encountered by companies in the development stage. Some of these risks and uncertainties include our ability to:

Previous wording

We have a history of operating losses and we have not established sources of ongoing revenue to cover operating costs and allow us to continue as a going concern.

Current wording

We have not established sources of ongoing revenue to cover operating costs and allow us to continue as a going concern.

Previous wording

Although we believe we have sufficient capital resources to fund our operations for at least the next 12 months based on our current business plan, our business plan may change and may require greater expenditures of capital than currently anticipated, in particular, due to expenditures relating to strategic transactions. We have not yet established an ongoing source of revenue sufficient to cover operating costs and allow us to continue as a going concern. Our ability to continue as a going concern is dependent on obtaining adequate capital to fund operating losses until we become profitable. If we are unable to obtain adequate capital on reasonable terms, if at all, including due to macroeconomic factors, such as high interest rates, the inflationary environment, recessionary fears, foreign exchange rate volatility, instability in financial institutions, changes in monetary policy, changes in trade policies including tariffs and other trade restrictions or the threat of such actions, and rising geopolitical instability we may be unable to develop and commercialize our product offerings or increase our geographic reach and we could be forced to cease operations.

Current wording

For the year ended December 31, 2025, we incurred a net loss of $34.8 million, and we had an accumulated deficit of $246.6 million. As of the date of filing this Annual Report, we expect that our existing resources should be sufficient to fund our planned operations for at least the next 12 months, however, additional capital resources will be needed to fund operations longer-term. We have not yet established an ongoing source of revenue sufficient to cover our operating costs and allow us to continue as a going concern. Our ability to continue as a going concern is dependent on obtaining adequate capital to fund operating losses until we become profitable. We plan to obtain additional capital resources by selling our equity securities as well as short-term borrowing from banks, stockholders or other related parties, if needed. However, we cannot assure you that we will be successful in accomplishing any of these plans and, if we are unable to obtain adequate capital on reasonable terms, if at all, we may be unable to develop and commercialize our product offerings or increase our geographic reach, and we could be forced to cease operations or substantially curtail our activities. We do not anticipate any revenue until our pharmaceutical programs are developed, including receipt of all necessary regulatory approvals, and we successfully commercialize these programs. These conditions raise substantial doubt as to our ability to continue as a going concern.

Previous wording

For the years ended December 31, 2024 and 2023, we incurred net losses of approximately $25.5 million and $30.1 million, respectively, and we had an accumulated deficit of approximately $211.8 million since inception. As of December 31, 2024 and 2023, we had cash and cash equivalents of approximately $71.1 million and $88.5 million, respectively. Because we have no current sources of revenue, we expect that we will need to raise capital again in the future to continue to fund our operations. When we elect to raise additional funds or when additional funds are required, we may raise such funds through public or private equity offerings, debt financings, corporate collaboration and licensing arrangements or other financing alternatives. These financing arrangements may not be available on acceptable terms, if at all. If we are unable to raise additional capital in sufficient amounts or on terms acceptable to us, we may be prevented from developing our pharmaceutical candidates, pursuing acquisitions, and investing in other companies, including as a sponsor or investor in special purpose acquisition companies, licensing, development and commercialization efforts, and our ability to continue our operations, generate revenues, and achieve or sustain profitability may be substantially harmed.

Current wording

For the years ended December 31, 2025 and 2024, we incurred a net loss of $34.8 million and $25.5 million, respectively, and we had an accumulated deficit of $246.6 million since inception. As of December 31, 2025 and 2024, we had cash and cash equivalents of approximately $41.3 million and $71.1 million, respectively. Because we have no current sources of revenue, substantial doubt exists about our ability to continue as a going concern, and we expect that we will need to raise capital again in the future to continue to fund our operations. When we elect to raise additional funds or when additional funds are required, we may raise such funds through public or private equity offerings, debt financings, corporate collaboration and licensing arrangements or other financing alternatives. These financing arrangements may not be available on acceptable terms, if at all. If we are unable to raise additional capital in sufficient amounts or on terms acceptable to us, we may be prevented from developing our pharmaceutical candidates, pursuing acquisitions, and investing in other companies, including as a sponsor or investor in special purpose acquisition companies, licensing, development and commercialization efforts, and our ability to continue our operations, generate revenues, and achieve or sustain profitability may be substantially harmed.

Previous wording

For example, our ability to raise capital in the public capital markets, including through "at the market" offerings pursuant to our Open Market Sale Agreement SM (the Sale Agreement) with Jefferies LLC (Jefferies), may be limited by, among other things, SEC rules and regulations impacting the eligibility of smaller companies to use Form S-3 for primary offerings of securities. Although alternative public and private transaction structures may be available, these may require additional time and cost, may impose operational restrictions on us, and may not be available on attractive terms.

Current wording

For example, our ability to raise capital in the public capital markets, including through “at the market” offerings pursuant to our Sales Agreement with the Sales Agent, may be limited by, among other things, SEC rules and regulations impacting the eligibility of smaller companies to use Form S-3 for primary offerings of securities. Although alternative public and private transaction structures may be available, these may require additional time and cost, may impose operational restrictions on us, and may not be available on attractive terms.

Previous wording

If we raise additional funds by selling or issuing equity securities or equity-linked securities, including through our Sale Agreement, our stockholders will experience dilution and it may have an adverse effect on the price of our common stock. Debt financing, if available, would result in increased fixed payment obligations and may involve agreements that include covenants limiting or restricting our ability to take specific actions, such as incurring additional debt, making capital expenditures or declaring dividends. Any debt financing or additional equity, including securities convertible into or exercisable for equity securities, that we raise may contain terms, such as liquidation, conversion and other preferences, that are not favorable to us or our stockholders. If we raise additional funds through collaboration and licensing arrangements with third parties, it may be necessary for us to relinquish valuable rights to our technologies, future revenue streams or product candidates or to grant licenses on terms that may not be favorable to us. Should the financing we require to sustain our working capital needs be unavailable or prohibitively expensive when we require it, our business, operating results, financial condition and prospects could be materially and adversely affected, and we may be unable to continue our operations.

Current wording

If we raise additional funds by selling or issuing equity securities or equity-linked securities, including through our Sales Agreement, our stockholders will experience dilution and it may have an adverse effect on the price of our common stock. Debt financing, if available, would result in increased fixed payment obligations and may involve agreements that include covenants limiting or restricting our ability to take specific actions, such as incurring additional debt, making capital expenditures or declaring dividends. Any debt financing or additional equity, including securities convertible into or exercisable for equity securities, that we raise may contain terms, such as liquidation, conversion and other preferences, that are not favorable to us or our stockholders. If we raise additional funds through collaboration and licensing arrangements with third parties, it may be necessary for us to relinquish valuable rights to our technologies, future revenue streams or product candidates or to grant licenses on terms that may not be favorable to us. Should the financing we require to sustain our working capital needs be unavailable or prohibitively expensive when we require it, our business, operating results, financial condition and prospects could be materially and adversely affected, and we may be unable to continue our operations.

Previous wording

We intend to use our capital resources to execute on our business plan, which may include acquiring or in-licensing programs and may also include the internal development of additional programs that may or may not be related to oncology. We may also use our capital resources to invest directly or indirectly in business opportunities in healthcare or other industries, including through purchases of equity in other companies and as a sponsor or as an equity investor in special purpose acquisition companies, and we may not be able to realize the expected business or financial benefits of these investments. For example, in the fourth quarter of 2024, Dynamic Cell Therapies, Inc. (DCT), a U.S. private company previously focused on Chimeric Antigen Receptor (CAR) T-cell therapies, laid off all employees and ceased operations, and we incurred a $1.7 million and $3.0 million impairment charge for the years ended December 31, 2024 and 2023, respectively.

Current wording

We intend to use our capital resources to execute on our business plan, which may include acquiring or in-licensing programs and may also include the internal development of additional programs that may or may not be related to oncology. We may also use our capital resources to invest directly or indirectly in business opportunities in healthcare or other industries, including through purchases of equity in other companies and as a sponsor or as an equity investor in special purpose acquisition companies, and we may not be able to realize the expected business or financial benefits of these investments. For example, for the year ended December 31, 2024, we wrote down our Investment in equity securities by $1.7 million due to the impairment of our investment in Dynamic Cell Therapies, Inc. (DCT), a U.S. private company previously focused on Chimeric Antigen Receptor (CAR) T-cell therapies, which laid off all employees and ceased operations.

Previous wording

Our failure to address these risks or other problems encountered in connection with our past or future acquisitions and other transactions have in the past and could in the future cause us to fail to realize the anticipated benefits of such acquisitions and transactions, and result in higher than expected costs, the recording of asset impairment or restructuring charges and other actions which could negatively impact our business, financial condition, results of operations and our ability to execute on our strategic plan. For example, we incurred a $1.7 million and $3.0 million impairment charge for the years ended December 31, 2024 and 2023, respectively, in connection with our investment in DCT.

Current wording

Our failure to address these risks or other problems encountered in connection with our past or future acquisitions and other transactions have in the past and could in the future cause us to fail to realize the anticipated benefits of such acquisitions and transactions, and result in higher than expected costs, the recording of asset impairment or restructuring charges and other actions which could negatively impact our business, financial condition, results of operations and our ability to execute on our strategic plan. For example, we incurred a $1.7 million impairment charge for the year ended December 31, 2024 in connection with our investment in DCT.

Previous wording

In addition, from time to time we expect to report interim, top-line or "preliminary" data for clinical trials, including for example the results reported in 2024 for our EVANGELINE study, a Phase 2 randomized study of (Z)-endoxifen as a neoadjuvant treatment for pre-menopausal women with ER+ / human epidermal growth factor receptor 2 negative (HER2-) breast cancer. Such data is based on a preliminary analysis of then-available efficacy and safety data, and such findings and conclusions are subject to change following a more comprehensive review of the data related to the particular study or trial. Interim, top-line or preliminary data are based on important assumptions, estimations, calculations and information then available to us to the extent we have had, at the time of such reporting, an opportunity to fully and carefully evaluate such information in light of all surrounding facts, circumstances, recommendations and analyses. As a result, interim, top-line or "preliminary" results may differ from future/final results, or different conclusions or considerations may qualify such results once existing data have been more fully evaluated. In addition, third parties, including regulatory agencies, may not accept or agree with our assumptions, estimations, calculations or analyses or may interpret or weigh the importance of data differently, which could impact the value of the particular program, the approvability or commercialization of the particular compound and our business generally.

Current wording

In addition, from time to time we expect to report interim, top-line or "preliminary" data for clinical trials, including for example the results reported in 2024 for our EVANGELINE study, a Phase 2 randomized study of (Z)-endoxifen as a neoadjuvant treatment for premenopausal women with estrogen receptor positive (ER+) / human epidermal growth factor receptor 2 negative (HER2-) breast cancer, and in 2025, for our Phase 2 Endocrine Optimization Pilot sub‑study within the I‑SPY 2 TRIAL evaluating low‑dose oral (Z)‑endoxifen as a neoadjuvant treatment in women with stage II/III ER+/HER2‑negative breast cancer. Such data are based on a preliminary analysis of then-available efficacy and safety data, and such findings and conclusions are subject to change following a more comprehensive review of the data related to the particular study or trial. Interim, top-line or preliminary data are based on important assumptions, estimations, calculations and information then available to us to the extent we have had, at the time of such reporting, an opportunity to fully and carefully evaluate such information in light of all surrounding facts, circumstances, recommendations and analyses. As a result, interim, top-line or "preliminary" results may differ from future/final results, or different conclusions or considerations may qualify such results once existing data have been more fully evaluated. In addition, third parties, including regulatory agencies, may not accept or agree with our assumptions, estimations, calculations or analyses or may interpret or weigh the importance of data differently, which could impact the value of the particular program, the ability to obtain approvals, or commercialization of the particular compound and our business generally.

Previous wording

Our business is dependent on the performance by third parties of their responsibilities under contractual relationships. In particular, we heavily rely on third parties for the manufacture and testing of our products. We do not have an internal analytical laboratory or manufacturing facilities to allow the testing or production of products in compliance with Good Manufacturing Practices (cGMP). As a result, we rely on third parties to supply us in a timely manner with manufactured product candidates. We may not be able to adequately manage and oversee the manufacturers we choose; they may not perform as agreed or they may terminate their agreements with us. In particular, we depend on third party manufacturers to conduct their operations in compliance with applicable requirements under current Good Laboratory Practices (GLP), cGMP, GCP or similar standards imposed by the U.S. and/or applicable foreign regulatory authorities, including the FDA and EMA. Any of these regulatory authorities may take action against a contract manufacturer who violates cGMP. Failure of our manufacturers to comply with FDA, EMA or other applicable regulations may cause us to curtail or stop the manufacture of such products until we obtain regulatory compliance.

Current wording

Our business is dependent on the performance by third parties of their responsibilities under contractual relationships. In particular, we heavily rely on third parties for the manufacture and testing of our products. We do not have an internal analytical laboratory or manufacturing facilities to allow the testing or production of products in compliance with Good Manufacturing Practices (cGMP). As a result, we rely on third parties to supply us in a timely manner with manufactured product candidates. We may not be able to adequately manage and oversee the manufacturers we choose; they may not perform as agreed or they may terminate their agreements with us. In particular, we depend on third party manufacturers to conduct their operations in compliance with applicable requirements under current Good Laboratory Practices (GLP), cGMP, Good Clinical Practices (GCP) or similar standards imposed by the U.S. and/or applicable foreign regulatory authorities, including the FDA and EMA. Any of these regulatory authorities may take action against a contract manufacturer who violates cGMP. Failure of our manufacturers to comply with FDA, EMA or other applicable regulations may cause us to curtail or stop the manufacture of such products until we obtain regulatory compliance.

Previous wording

In addition, we depend on medical institutions and CROs (together with their respective agents) to conduct clinical trials and associated activities in compliance with Good Clinical Practices (GCP) and data privacy standards such as defined under the Health Insurance Portability and Accountability Act (HIPAA), General Data Protection Regulation (GDPR) and UK GDPR, and in accordance with our timelines, expectations and requirements. We are substantially dependent on the organizations conducting our clinical trials. To the extent any such third parties are delayed in achieving or fail to meet our clinical trial enrollment expectations, fail to conduct our trials in accordance with GCP, patient and data privacy standards such as HIPAA or study protocol or otherwise take actions outside of our control or without our consent, our business may be harmed. Furthermore, we conduct clinical trials in foreign countries, subjecting us to additional risks and challenges, including, patient and data privacy standards, such as GDPR and UK GDPR and in particular, as a result of the engagement of foreign medical institutions and foreign CROs, who may be less experienced with regard to regulatory matters applicable to us and may have different standards of medical care.

Current wording

In addition, we depend on medical institutions and CROs (together with their respective agents) to conduct clinical trials and associated activities in compliance with GCP and data privacy standards such as defined under the Health Insurance Portability and Accountability Act (HIPAA), General Data Protection Regulation (GDPR) and UK GDPR, and in accordance with our timelines, expectations and requirements. We are substantially dependent on the organizations conducting our clinical trials. To the extent any such third parties are delayed in achieving or fail to meet our clinical trial enrollment expectations, fail to conduct our trials in accordance with GCP, patient and data privacy standards such as HIPAA or study protocol or otherwise take actions outside of our control or without our consent, our business may be harmed. Furthermore, we conduct clinical trials in foreign countries, subjecting us to additional risks and challenges, including, patient and data privacy standards, such as GDPR and UK GDPR and in particular, as a result of the engagement of foreign medical institutions and foreign CROs, who may be less experienced with regard to regulatory matters applicable to us and may have different standards of medical care.

Previous wording

In addition, our employees and personnel or our vendors or partners may use AI, including generative AI, technologies to perform their work or in their operations, and the disclosure and use of personal information in AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating AI, controlling for data bias and antidiscrimination. Any use of this technology could result in additional compliance costs, regulatory investigations and actions, and consumer lawsuits.

Current wording

In addition, our employees and personnel or our vendors or partners may use AI, including generative AI, technologies to perform their work or in their operations, and the disclosure and use of personal information in AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating AI, controlling for data bias and anti-discrimination. Any use of this technology could result in additional compliance costs, regulatory investigations and actions, and consumer lawsuits.

Previous wording

supply chain disruptions, or lack of availability or increased costs of materials for our product candidates;

Current wording

supply chain disruptions, or lack of availability or increased costs of materials for our product candidates, including as a result of changes in trade policies, including tariffs or other trade restrictions or the threat of such actions;

Previous wording

failure to obtain on a timely basis, or at all, approval from the applicable institutional review board or ethics committee to open a clinical study;

Current wording

failure to obtain on a timely basis, or at all, approval from the applicable Regulatory Agencies, institutional review board or ethics committee to open a clinical study;

Previous wording

We or our collaborators may integrate AI, including generative AI, and machine learning in our drug discovery efforts and efforts to develop our product candidates. As a new and rapidly evolving technology, the use of AI is subject to numerous risks and uncertainties, including operational, technical, legal, compliance, privacy, data security, ethical, competitive and reputational risks. Machine learning and predictive analytics may produce flawed, biased, incomplete, overbroad or inaccurate results, which could negatively impact the development of our or our collaborators’ product candidates and expose us to competitive and reputational harm. Developing, testing and deploying resource-intensive AI systems, or supporting our collaborator’s development of such systems, including our sponsorship of the Phase 2 SMART study that seeks to validate an AI-driven breast cancer risk assessment model, requires significant investment and may increase our costs, and there is no guarantee that our investment in such systems will lead to discovery of new product candidates or eventual regulatory approval or commercialization of any product candidates or accelerate or reduce costs associated with the drug discovery, development or approval timeline. Our inability to successfully deploy AI in the discovery or development of our or our collaborators’ product candidates, or the public’s lack of acceptance of such products, could adversely affect our business, reputation and financial results.

Current wording

We or our collaborators may integrate AI, including generative AI, and machine learning tools in connection with drug discovery efforts and the development of our product candidates. As a rapidly evolving technology, the use of AI is subject to numerous risks and uncertainties, including operational, technical, legal, compliance, privacy, data security, ethical, competitive and reputational risks. Machine learning and predictive analytics may produce flawed, biased, incomplete, overbroad or inaccurate results, which could negatively impact the development of our or our collaborators’ product candidates and expose us to competitive and reputational harm. Developing, testing and deploying resource-intensive AI systems, or supporting our collaborator’s development of such systems, including our sponsorship of the Phase 2 SMART study seeking to validate an AI-driven breast cancer risk assessment model, may require significant investment and increase our costs, and there is no guarantee that any such investment will lead to the discovery of new product candidates, eventual regulatory approval or commercialization of any product candidates, or acceleration of, or reduction in, costs associated with the drug discovery, development or approval timeline. Our inability, or our collaborators' inability, to successfully use AI-enabled tools in the discovery or development of product candidates, or lack of public acceptance of such products, could adversely affect our business, reputation and financial results.

Previous wording

Based on our evaluation of the ATO's taxpayer alert published in the fourth quarter of 2023, we believe that it is no longer reasonably assured that our full tax position would be sustained under an audit. Accordingly, we recorded a change in estimate that represents our estimate of the amount (inclusive of potential penalties) that no longer meets the reasonably assured threshold. We recorded an estimated accrued current liability of $1.5 million and $1.8 million in our Consolidated Balance Sheets as of December 31, 2024 and 2023, respectively. We may in the future be required to record additional changes in estimates, which could further increase our expenses and adversely affect our business and results of operations.

Current wording

Based on our evaluation of the ATO's taxpayer alert published in the fourth quarter of 2023, we believe that it is no longer reasonably assured that our full tax position would be sustained under an audit. Accordingly, we recorded a change in estimate that represents our estimate of the amount (inclusive of potential penalties) that no longer meets the reasonably assured threshold. We recorded an estimated accrued current liability of $1.1 million and $1.5 million in our Consolidated Balance Sheets as of December 31, 2025 and December 31, 2024, respectively. We may in the future be required to record additional changes in estimates, which could further increase our expenses and adversely affect our business and results of operations.

Previous wording

Our commercial success will depend, in part, on our ability to obtain additional patents and licenses and to protect our existing patent position, both in the U.S. and in other countries, for therapeutics and related technologies, processes, methods, compositions, and other inventions that we believe are patentable, all of which provide limited protection and may not adequately protect our rights or permit us to gain or keep any competitive advantage. As of February 3, 2025, we own and are pursuing 119 pending provisional and non-provisional patent applications (28 U.S. patent applications and 91 international patent applications, including two allowed U.S. applications and three allowed international applications) and 13 issued patents (five U.S. patents and eight international patents). We continue to evaluate the full range of our technologies and file new patent applications consistent with our evolving business goals.

Current wording

Our commercial success will depend, in part, on our ability to obtain additional patents and licenses and to protect our existing patent position, both in the U.S. and in other countries, for therapeutics and related technologies, processes, methods, compositions, and other inventions that we believe are patentable, all of which provide limited protection and may not adequately protect our rights or permit us to gain or keep any competitive advantage. As of February 2, 2026, we owned and were pursuing 141 pending provisional and non-provisional patent applications (30 U.S. patent applications and 111 international patent applications, including one allowed U.S. application and two allowed international applications) and 24 issued patents (8 U.S. patents and 16 international patents). We continue to evaluate the full range of our technologies and file new patent applications consistent with our evolving business goals.

Previous wording

For example, on August 18, 2023, Intas Pharmaceuticals LTD. filed a Petition for Post Grant Review (PGR) with the Patent Trial and Appeal Board (PTAB) of the U.S. Patent and Trademark Office, the (PGR Petition), seeking to invalidate all claims related to one of our issued patents (U.S. Patent No. 11,572,334) titled "Methods for Making and Using Endoxifen," (the Patent). We actively contested the PGR Petition and believed that the Patent was properly granted and was valid and enforceable.

Current wording

If third parties successfully challenge the validity of one or more of our patent applications, we may lose certain patent rights, even if previously granted by a patent office. For example, on August 18, 2023, Intas Pharmaceuticals Ltd. (Intas) filed a Petition for Post Grant Review with the Patent Trial and Appeal Board (PTAB) of the U.S. Patent and Trademark Office (USPTO), seeking to invalidate all claims related to one of our issued patents (U.S. Patent No. 11,572,334) titled “Methods for Making and Using Endoxifen”, and on January 29, 2025, the PTAB issued a final written decision finding all claims of U.S. Patent No. 11,572,334 were unpatentable. In addition, on April 3, 2025, Intas filed two separate petitions with the PTAB seeking to invalidate two additional patents. For more information regarding our legal proceedings, including these additional petitions, refer to Note 13 “Commitments and Contingencies” to the Consolidated Financial Statements.

Previous wording

United States Patent and Trademark Office (USPTO) and various foreign governmental patent agencies require compliance with a number of procedural, documentary, fee payment and other similar provisions during the patent process. Periodic maintenance fees, renewal fees, annuity fees, and various other governmental fees on any issued patents and/or applications are due to be paid to the USPTO and foreign patent agencies in several stages over the lifetime of the patents and/or applications. We have systems in place to remind us to pay these fees, and we employ outside firms and rely on our outside counsel to pay these fees. While an inadvertent lapse may sometimes be cured by payment of a late fee or by other means in accordance with the applicable rules, there are situations in which noncompliance can result in abandonment or lapse of the patent or patent application, resulting in partial or complete loss of patent rights in the relevant jurisdiction. In such an event, our competitors might be able to enter the market earlier than should otherwise have been the case, which would have a material adverse effect on our business.

Current wording

The USPTO and various foreign governmental patent agencies require compliance with a number of procedural, documentary, fee payment and other similar provisions during the patent process. Periodic maintenance fees, renewal fees, annuity fees, and various other governmental fees on any issued patents and/or applications are due to be paid to the USPTO and foreign patent agencies in several stages over the lifetime of the patents and/or applications. We have systems in place to remind us to pay these fees, and we employ outside firms and rely on our outside counsel to pay these fees. While an inadvertent lapse may sometimes be cured by payment of a late fee or by other means in accordance with the applicable rules, there are situations in which noncompliance can result in abandonment or lapse of the patent or patent application, resulting in partial or complete loss of patent rights in the relevant jurisdiction. In such an event, our competitors might be able to enter the market earlier than should otherwise have been the case, which would have a material adverse effect on our business.

Previous wording

As is the case with other biotechnology and pharmaceutical companies, our success is heavily dependent on our intellectual property, particularly on obtaining and enforcing patents. Obtaining and enforcing patents in the biotechnology and pharmaceutical industries involve both technological and legal complexity, and is therefore costly, time-consuming and inherently uncertain. For the past several years, the U.S. has conducted proceedings involving post-issuance patent review procedures, such asinter partes review (IPR), and post-grant review and covered business methods. These proceedings are conducted before the PTAB, of the USPTO. Each proceeding has different eligibility criteria and different patentability challenges that can be raised. In this regard, the IPR process permits any person (except a party who has been litigating the patent for more than a year) to challenge the validity of a U.S. patent on the grounds that it was anticipated or made obvious by prior art consisting of patents or printed publications. As a result, non-practicing entities associated with hedge funds, pharmaceutical companies who may be our competitors and others have challenged certain valuable pharmaceutical U.S. patents based on prior art through the IPR process. A decision in such a proceeding adverse to our interests could result in the loss of valuable patent rights, which would have a material adverse effect on our business, financial condition, results of operations and growth prospects. For example, there is a PGR Petition relating to one of our issued patents. See Note 13 to the Consolidated Financial Statements. Any potential future changes to the U.S. patent system could increase the uncertainties and costs surrounding the prosecution of our patent applications and the enforcement or defense of our issued patents, all of which could have a material adverse effect on our business, financial condition, results of operations and growth prospects. Further, recent U.S. Supreme Court rulings have narrowed the scope of patent protection available in certain circumstances and weakened the rights of patent owners in certain situations. In particular, on March 20, 2012, the U.S. Supreme Court issued the Mayo Collaborative Services v. Prometheus Laboratories, Inc. decision, holding that several claims drawn to measuring drug metabolite levels from patient samples were not patentable subject matter. The full impact of the Mayo Collaborative Services v. Prometheus Laboratories, Inc. decision on diagnostic and certain method claims is uncertain. In addition to increasing uncertainty with regard to our ability to obtain patents in the future, this combination of events has created uncertainty with respect to the value of patents once obtained. Depending on decisions by the U.S. Congress, the federal courts, and the USPTO, the laws and regulations governing patents could change in unpredictable ways that could weaken our ability to obtain new patents or to enforce our …

Excerpt shortened here; the source contains the full paragraph.

Current wording

As is the case with other biotechnology and pharmaceutical companies, our success is heavily dependent on our intellectual property, particularly on obtaining and enforcing patents. Obtaining and enforcing patents in the biotechnology and pharmaceutical industries involve both technological and legal complexity, and is therefore costly, time-consuming and inherently uncertain. For the past several years, the U.S. has conducted proceedings involving post-issuance patent review procedures, such asinter partes review (IPR), and post-grant review (PGR) and covered business methods. These proceedings are conducted before the PTAB, of the USPTO. Each proceeding has different eligibility criteria and different patentability challenges that can be raised. In this regard, the IPR process permits any person (except a party who has been litigating the patent for more than a year) to challenge the validity of a U.S. patent on the grounds that it was anticipated or made obvious by prior art consisting of patents or printed publications. As a result, non-practicing entities associated with hedge funds, pharmaceutical companies who may be our competitors and others have challenged certain valuable pharmaceutical U.S. patents based on prior art through the IPR process. A decision in such a proceeding adverse to our interests could result in the loss of valuable patent rights, which would have a material adverse effect on our business, financial condition, results of operations and growth prospects. For example, we are currently contesting the 391 PGR Petition and the 151 IPR Petition. Refer to Note 13 “Commitments and Contingencies” to the Consolidated Financial Statements. Any potential future changes to the U.S. patent system could increase the uncertainties and costs surrounding the prosecution of our patent applications and the enforcement or defense of our issued patents, all of which could have a material adverse effect on our business, financial condition, results of operations and growth prospects. Further, recent U.S. Supreme Court rulings have narrowed the scope of patent protection available in certain circumstances and weakened the rights of patent owners in certain situations. In particular, on March 20, 2012, the U.S. Supreme Court issued the Mayo Collaborative Services v. Prometheus Laboratories, Inc. decision, holding that several claims drawn to measuring drug metabolite levels from patient samples were not patentable subject matter. The full impact of the Mayo Collaborative Services v. Prometheus Laboratories, Inc. decision on diagnostic and certain method claims is uncertain. In addition to increasing uncertainty with regard to our ability to obtain patents in the future, this combination of events has created uncertainty with respect to the value of patents once obtained. Depending on decisions by the U.S. Congress, the federal courts, and the USPTO, the laws and regulations governing patents could change in unpredictable ways that could weak…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Filing, prosecuting and defending patents on our products in all countries throughout the world would be prohibitively expensive. In addition, the laws of some foreign countries do not protect intellectual property rights in the same manner and to the same extent as laws in the U.S. Consequently, we may not be able to prevent third parties from practicing our inventions in all countries outside the U.S. For example, the Indian Pharmaceutical Alliance filed the Opposition against our pending Indian Patent Application. Competitors may use our technologies in jurisdictions where we have not obtained patent protection to develop their own products and further, may export otherwise infringing products to territories where we have patent protection, but enforcement of such patent protection is not as strong as that in the U.S. These products may compete with our products and services, and our patents or other intellectual property rights may not be effective or sufficient to prevent them from competing with our products.

Current wording

Filing, prosecuting and defending patents on our products in all countries throughout the world would be prohibitively expensive. In addition, the laws of some foreign countries do not protect intellectual property rights in the same manner and to the same extent as laws in the U.S. Consequently, we may not be able to prevent third parties from practicing our inventions in all countries outside the U.S. Competitors may use our technologies in jurisdictions where we have not obtained patent protection to develop their own products and further, may export otherwise infringing products to territories where we have patent protection, but enforcement of such patent protection is not as strong as that in the U.S. These products may compete with our products and services, and our patents or other intellectual property rights may not be effective or sufficient to prevent them from competing with our products.

Previous wording

Our commercial success depends in part on our avoiding infringement of the patents and proprietary rights of third parties, including the intellectual property rights of competitors. There is a substantial amount of litigation, both within and outside the U.S., involving patents and other intellectual property rights in the medical device and pharmaceutical fields, as well as administrative proceedings for challenging patents, including inter partes review, post-grant review, derivation, and reexamination proceedings before the USPTO or oppositions and other comparable proceedings in various foreign jurisdictions, for example, the PGR Petition and the Indian Pharmaceutical Alliance Pre-Grant Opposition. These procedures bring uncertainty to the possibility of challenges to our patents in the future, including those patents perceived by our competitors as blocking entry into the market for their products, and the outcome of such challenges. Any such proceedings could result in revocation or amendment to our patents in such a way that they no longer cover our drug product candidates. The outcome following legal assertions of invalidity and unenforceability is unpredictable. With respect to the validity question, for example, we cannot be certain that there is no invalidating prior art and that prior art that was cited during prosecution, but not relied on by the patent examiner, will not be revisited. Numerous U.S. and foreign issued patents and pending patent applications, which are owned by third parties, exist in the fields in which we are developing our products. As the medical device, biotechnology, and pharmaceutical industries expand and more patents are issued, the risk increases that our activities related to our products may give rise to claims of infringement of the patent rights of others.

Current wording

Our commercial success depends in part on our avoiding infringement of the patents and proprietary rights of third parties, including the intellectual property rights of competitors. There is a substantial amount of litigation, both within and outside the U.S., involving patents and other intellectual property rights in the medical device and pharmaceutical fields, as well as administrative proceedings for challenging patents, including IPR, PGR, derivation, and reexamination proceedings before the USPTO or oppositions and other comparable proceedings in various foreign jurisdictions. For example, we are currently contesting the 391 PGR Petition and the 151 IPR Petition. These procedures bring uncertainty to the possibility of challenges to our patents in the future, including those patents perceived by our competitors as blocking entry into the market for their products, and the outcome of such challenges. Any such proceedings could result in revocation or amendment to our patents in such a way that they no longer cover our drug product candidates. The outcome following legal assertions of invalidity and unenforceability is unpredictable. With respect to the validity question, for example, we cannot be certain that there is no invalidating prior art and that prior art that was cited during prosecution, but not relied on by the patent examiner, will not be revisited. Numerous U.S. and foreign issued patents and pending patent applications, which are owned by third parties, exist in the fields in which we are developing our products. As the medical device, biotechnology, and pharmaceutical industries expand and more patents are issued, the risk increases that our activities related to our products may give rise to claims of infringement of the patent rights of others.

Previous wording

Our inadvertent or unintentional failure to comply with the complex government regulations concerning patients' privacy, data subjects, and of medical records could subject us to fines and adversely affect our reputation.

Current wording

Our inadvertent or unintentional failure to comply with the complex government regulations concerning patients' privacy, other data subjects, and of medical records could subject us to fines and adversely affect our reputation.

Previous wording

Federal privacy regulations, among other things, restrict our ability to use or disclose protected health information in the form of patient-identifiable laboratory data, without written patient authorization, for purposes other than payment, treatment, or healthcare operations as defined under HIPAA, except for disclosures for various public policy purposes and other permitted purposes outlined in the privacy regulations. Applicable privacy regulations provide for significant fines and other penalties for wrongful use or disclosure of protected health information, including potential civil and criminal fines and penalties.

Current wording

Federal privacy regulations, among other things, restrict our ability to use or disclose protected health information, including patient-identifiable laboratory data, without written patient authorization, for purposes other than payment, treatment, or healthcare operations as defined under HIPAA, except as otherwise permitted for various public policy purposes and other authorized uses under privacy regulations. Applicable privacy regulations provide for significant fines and other penalties for the wrongful use or disclosure of protected health information, including potential civil and criminal fines and penalties.

Previous wording

We intend to implement policies and practices that we believe will make us compliant with applicable privacy regulations. However, the documentation and process requirements of applicable privacy regulations are complex and subject to interpretation. Failure to comply with applicable privacy regulations could subject us to sanctions or penalties, loss of business, and negative publicity.

Current wording

We seek to implement policies and practices designed to support compliance with applicable privacy regulations. However, the documentation and process requirements of applicable privacy regulations are complex, evolving, and subject to interpretation. Failure to comply with applicable privacy regulations could subject us to sanctions or penalties, loss of business, and negative publicity. State privacy laws may also restrict our ability to use or process personal information (including information not covered by HIPAA), and require us to adhere to additional obligations and honor additional data rights.

Previous wording

The HIPAA privacy regulations establish a “floor” of minimum protection for patients as to their medical information and do not supersede state laws that are more stringent. State health information privacy laws, such as California’s Confidentiality of Medical Information Act and Washington’s My Health My Data Act, govern the privacy and security of health-related information and may apply even when HIPAA does not and impose additional requirements. Therefore, we are required to comply with both HIPAA privacy regulations and state privacy laws, which vary from state to state, impose a range of obligations, and are often more restrictive than HIPAA. The failure to comply with applicable privacy laws could subject us to regulatory actions, including significant fines or penalties, and to private actions by patients, as well as to adverse publicity and possible loss of business. In addition, federal and state laws and judicial decisions provide individuals with various rights for violating the privacy of their medical information by healthcare providers such as us.

Current wording

The HIPAA Privacy Rule establishes a “floor” of minimum protection for patients' medical information and does not supersede state privacy laws that are more stringent. State health information privacy laws, such as California’s Confidentiality of Medical Information Act and Washington’s My Health My Data Act, govern the privacy and security of health-related information and may apply even when HIPAA does not and impose additional or different requirements. Therefore, we may be required to comply with both HIPAA and state privacy laws, which vary from state to state, impose a range of obligations, and in some cases are more restrictive than HIPAA. The failure to comply with applicable privacy laws could subject us to regulatory actions, including significant fines or penalties, private actions by patients, adverse publicity and loss of business. In addition, federal and state laws and judicial decisions provide individuals with various rights for violating the privacy of their medical information by healthcare providers such as us.

Previous wording

In addition to HIPAA, failing to take appropriate steps to keep consumers’ personal information secure may result in the Federal Trade Commission (FTC) bringing a claim that a company has engaged in unfair or deceptive acts or practices in or affecting commerce, in violation of Section 5(a) of the Federal Trade Commission Act (FTCA). The FTC requires companies to have reasonable and appropriate security measures, based on factors such as data sensitivity and volume, complexity of the business and available resources. Health information is considered sensitive data that merits stronger safeguards. There are also state consumer protection laws, which may be modeled on the FTCA, that can provide state-law causes of action for allegedly unfair or deceptive acts or practices, among other things.

Current wording

In addition to HIPAA, failing to take appropriate steps to protect consumers’ personal information may result in the Federal Trade Commission (FTC) bringing a claim that a company has engaged in unfair or deceptive acts or practices in or affecting commerce, in violation of Section 5(a) of the Federal Trade Commission Act (FTC Act). The FTC expects companies to have reasonable and appropriate data security measures based on factors such as data sensitivity and volume, the complexity of the business, and available resources. Health information is considered sensitive data that merits stronger safeguards. There are also state consumer protection laws, which may be modeled on the FTC Act, that can also provide state-law causes of action for allegedly unfair or deceptive acts or practices, among other things.

Previous wording

While we may not be presently subject to any comprehensive state privacy laws (e.g., the California Consumer Privacy Act as amended by the California Privacy Rights Act) as a covered entity due to applicability and exemption considerations, the legal landscape is rapidly changing. If we were to become subject to these laws, we would be required to comply with the demanding obligations they impose with respect to personal information. Furthermore, if our service providers or partners are subject to such laws, we may have contractual obligations relating to these requirements.

Current wording

While we may not currently be subject to any comprehensive state privacy laws (e.g., the CCPA) due to applicability or exemption considerations, the legal landscape is rapidly changing. If we were to become subject to these laws, we would be required to comply with the demanding obligations they impose with respect to personal information. Furthermore, if our service providers, partners or collaborators are subject to such laws, we may have contractual obligations relating to these requirements.

Previous wording

The collection and processing of personal data, including personal health data related to individuals in the E.U. regardless of citizenship or residence is governed by the provisions of the General Data Protection Regulation 2016/679 (GDPR) which provides for significant penalties for noncompliance. GDPR supersedes the Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995. The GDPR regulates (i) the processing of personal data carried out in the context of the activities of a company established in the E.U.; and (ii) the processing of personal data carried out by a company not established in the E.U. where such processing relates to (a) the offering of goods or services to data subjects who are in the E.U. or (b) the monitoring of the behavior of data subjects who are in the E.U. The GDPR imposes a number of requirements, including requirements related to the legal basis of the processing (such as consent of the individuals to whom the personal data relates), the information provided to the individuals prior to processing their personal data, the personal data breaches which may have to be notified to the national data protection authorities and data subjects, the measures to be taken when engaging processors, and the security and confidentiality of the personal data. E.U. Member States may also impose additional requirements in relation to health, genetic and biometric data through their national implementing legislation.

Current wording

The collection and processing of personal data, including personal health data related to individuals in the EEA regardless of citizenship or residence, is governed by the provisions of the General Data Protection Regulation 2016/679 (GDPR) which provides for significant monetary fines for noncompliance. The GDPR regulates (i) the processing of personal data carried out in the context of the activities of a company established in the EEA; and (ii) the processing of personal data carried out by a company not established in the EEA where such processing relates to (a) the offering of goods or services to data subjects who are in the EEA or (b) the monitoring of the behavior of data subjects who are in the E.U. The GDPR imposes a number of requirements, including requirements related to the legal basis of the processing (such as consent of the individuals to whom the personal data relates), the information provided to the individuals prior to processing their personal data, the personal data breaches which may have to be notified to the national data protection authorities and data subjects, the measures to be taken when engaging processors, and the security and confidentiality of the personal data. E.U. Member States and EEA countries may also impose additional requirements in relation to health, genetic and biometric data through their national implementing legislation.

Previous wording

Further, from January 1, 2021, in addition to the GDPR, companies have to comply with the UK GDPR, which, together with the amended UK Data Protection Act 2018, retains the GDPR in UK national law. The UK GDPR mirrors the fines under the GDPR, i.e., fines up to the greater of £17.5 million or 4% of global turnover. The European Commission has adopted an adequacy decision in favor of the UK, enabling personal data transfers from E.U. member states to the UK without additional safeguards. However, the UK adequacy decision will automatically expire in June 2025 unless the European Commission re-assesses and renews/ extends that decision and remains under review (and may be modified or revoked) by the Commission during this period. In addition, transfers of personal data from the UK to other countries, including the EEA, are subject to specific transfer rules under the UK regime. Personal data may freely flow from the UK to the EEA, since the EEA is deemed to have an adequate data protection level for purposes of the UK regime. These UK international transfer rules broadly mirror the E.U. GDPR rules. With regard to the transfer of personal data from the UK to the U.S., from October 12, 2023, businesses in the UK can start to transfer personal data to U.S. organizations certified to the "UK Extension to the EU-US Data Privacy Framework" (UK Extension) under the UK GDPR, without the need for further safeguards. On March 21, 2022, the international data transfer agreement (IDTA) and the international data transfer addendum to the

Current wording

Further, from January 1, 2021, in addition to the GDPR, companies have to comply with the UK GDPR, which, together with the amended UK Data Protection Act 2018, retains the GDPR in UK national law. The UK GDPR mirrors the fines under the GDPR, i.e., fines up to the greater of £17.5 million or 4% of global turnover. Furthermore, the passage of the Data (Use and Access) Act 2025 (DUAA), which received Royal Assent in June 2025, introduced new obligations. These include mandatory internal complaint mechanisms, and aligning the maximum fines of the Privacy and Electronic Communications Regulations (PECR) with UK GDPR levels. Notably for our operations, the DUAA provides a more expansive statutory definition of scientific research that explicitly includes commercial and privately funded activities, and it permits the use of "broad consent" for future research purposes where specific goals cannot be fully identified at the outset.These changes may lead to additional costs and increase our overall risk exposure. The European Commission has adopted an adequacy decision in favor of the UK, enabling personal data transfers from E.U. member states to the UK without additional safeguards. The European Commission renewed the UK adequacy decision on December 19, 2025 for a period of six years until December 27, 2031, with the possibility to be renewed after this period. In addition, transfers of personal data from the UK to other countries, including the EEA, are subject to specific transfer rules under the UK regime. Personal data may freely flow from the UK to the EEA, since the EEA is deemed to have an adequate data protection level for purposes of the UK regime. These UK international transfer rules broadly mirror the E.U. GDPR rules. With regard to the transfer of personal data from the UK to the U.S., from October 12, 2023, businesses in the UK can start to transfer personal data to U.S. organizations certified to the "UK Extension to the EU-US Data Privacy Framework" (UK Extension) under the UK GDPR, without the need for further safeguards. On March 21, 2022, the international data transfer agreement (IDTA) and the international data transfer addendum to the European Commission's standard contractual clauses (SCCs) for international data transfers (Addendum), and a document setting out transitional provisions, came into force and replaced the prior EU SCCs for purposes of the UK regime.

Previous wording

We rely on information technology systems to keep financial records, maintain corporate records, communicate with staff and external parties and operate other critical functions. Our information technology systems are potentially vulnerable to disruption due to breakdown, malicious intrusion and computer viruses or other disruptive events, including, but not limited to, natural disasters, terrorist attacks, utility outages, theft, viruses, phishing, malware, design defects, human error and complications encountered as existing systems are maintained, repaired, replace or upgraded. If we were to experience a prolonged system disruption in our information technology systems or those of certain of our vendors, it could negatively impact our ability to serve our customers, which could adversely impact our business. Although we maintain offsite back-ups of our data, if operations at our facilities were disrupted, it may cause a material disruption in our business if we are not capable of restoring function on an acceptable time frame. In addition, our information technology systems are potentially vulnerable to data security breaches — whether by employees or others — which may expose data (including sensitive data) to unauthorized persons. Such data security breaches could lead to the loss of trade secrets or other intellectual property or could lead to the public exposure of personal data (including sensitive personal data) of our employees, customers and others, any of which could have a material adverse effect on our business, reputation, financial condition and results of operations. Sensitive data could also be leaked, disclosed, or revealed as a result of or in connection with our employee’s, personnel’s, vendors’ or partners’ use of AI technologies. In addition, because we collect, store and transmit confidential information in digital form, we, and third parties who we work with, are or may become subject to numerous domestic and foreign laws, regulations, and standards relating to privacy, data protection, and data security, the scope of which is changing, subject to differing applications and interpretations, and may be inconsistent among countries, or conflict with other rules. Any data breaches disclosure or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, including state data protection regulations (including data breach notification statutes and the California Consumer Privacy Act), the E.U. GDPR and the UK GDPR, and other regulations, the violation of which could result in significant penalties. In addition, these breaches and other inappropriate access can be difficult to detect, and any delay in identifying them may lead to increased harm of the type described above.

Current wording

We rely on information technology systems to keep financial records, maintain corporate records, communicate with staff and external parties and operate other critical functions. Our information technology systems are potentially vulnerable to disruption due to breakdown, malicious intrusion and computer viruses or other disruptive events, including, but not limited to, natural disasters, terrorist attacks, utility outages, theft, viruses, phishing, malware, design defects, human error and complications encountered as existing systems are maintained, repaired, replaced or upgraded. If we were to experience a prolonged disruption in our information technology systems or those of our vendors or other third parties upon whom we rely, it could negatively impact our ability to operate our business and serve our customers, which could adversely impact our business. Although we maintain offsite back-ups of our data, if our operations were disrupted, it may cause a material disruption to our business if we are unable to restore systems, data and functions in an acceptable time frame. In addition, our information technology systems are potentially vulnerable to data security breaches — whether by employees or others — which may expose data (including sensitive data) to unauthorized persons. Such data security breaches could lead to the loss of trade secrets or other intellectual property, or to the public exposure of personal data (including sensitive personal data) of our employees, customers and others, any of which could have a material adverse effect on our business, reputation, financial condition and results of operations. Sensitive data could also be compromised, disclosed, or revealed in connection with the use or misuse of AI or other automated tools by our employees, personnel, vendors or partners. In addition, because we collect, store and transmit confidential information in digital form, we, and third parties with whom we work, are or may become subject to numerous domestic and foreign laws, regulations and standards relating to privacy, data protection and data security. The scope of these requirements is evolving, subject to differing applications and interpretations, and may be inconsistent among jurisdictions or conflict with one another. Any data breaches, security incidents or other loss of information could result in legal claims or proceedings, regulatory investigations, liability under laws that protect personal information, including state data privacy and breach notification laws, the E.U. GDPR and the UK GDPR, which could result in significant penalties. In addition, these breaches and other unauthorized access can be difficult to detect, and as threat actors increasingly leverage AI and other advanced technologies, cyber attacks and security incidents may become more frequent, sophisticated and harder to identify, and it may take considerable time for us to investigate and evaluate the full impact of cyber attacks, particularly f…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Additionally, we are or may become subject to contractual obligations related to privacy, data protection, and data security. Our obligations may also change or expand as our business grows. The actual or perceived failure by us or third parties related to us to comply with such laws, regulations and obligations could increase our compliance and operational costs, expose us to regulatory scrutiny, actions, fines and penalties, result in reputational harm, lead to a loss of customers, result in litigation and liability, and otherwise cause a material adverse effect on our business, financial condition, and results of operations.

Current wording

Additionally, we are or may become subject to contractual obligations related to data privacy, protection and security, and such obligations may change or expand as our business grows. The actual or perceived failure by us, or by third parties related to us, to comply with such laws, regulations and obligations could increase our compliance and operational costs, expose us to regulatory scrutiny, actions, fines and penalties, result in reputational harm, lead to a loss of business, result in litigation and liability, and otherwise cause a material adverse effect on our business, financial condition, and results of operations.

Previous wording

Although we utilize various procedures and controls to help mitigate our exposure to these risks, cyber attacks and other cyber events are evolving, unpredictable and increasing in sophistication, including through the use of increasingly sophisticated and evolving AI technologies. Moreover, the information technology systems of our third-party partners, including suppliers, manufacturers, service providers and others on which we rely, may be subject to similar risks. We have cybersecurity insurance coverage in the event we become subject to certain cyber attacks, however, we cannot ensure that it will be sufficient to cover any particular losses we may experience. Any cyber incident could have a material adverse effect on our business, financial condition and results of operations.

Current wording

Although we utilize various procedures and controls designed to help mitigate these risks, cyber attacks and other cyber events are evolving, unpredictable and increasing in sophistication, including through the use of advanced and evolving technologies, such as AI. Moreover, the information technology systems of our third-party partners, including suppliers, manufacturers, service providers and others on which we rely, may be subject to similar risks. While we maintain cybersecurity insurance coverage for certain security incidents, we cannot ensure that it will be sufficient in type or amount to cover any particular losses we may experience. Any significant security incident could have a material adverse effect on our business, financial condition and results of operations.

Previous wording

We are subject to extensive federal and state laws and regulations relating to the submission of claims for payment for services, including those that relate to coverage of services under Medicare, Medicaid, and other governmental healthcare programs, the amounts that may be billed for services, and to whom claims for services may be submitted, such as billing Medicare as the secondary, rather than the primary, payor. The failure to comply with applicable laws and regulations, for example, enrollment in the Medicare Provider Enrollment, Chain and Ownership System, could result in our inability to receive payment for our services or attempts by third party payors, such as Medicare and Medicaid, to recover payments from us that we have already received. Submission of claims in violation of certain statutory or regulatory requirements can result in penalties and exclusion from participation in Medicare and Medicaid. Government authorities may also assert that violations of laws and regulations related to submission of claims violate the federal False Claims Act or other laws related to fraud and abuse, including submission of claims for services that were not medically necessary. The Company will be generally dependent on independent physicians to determine when its services are medically necessary for a particular patient. Nevertheless, we could be adversely affected if it were determined that the services we provided were not medically necessary and not reimbursable, particularly if it were asserted that we contributed to the physician’s referrals of unnecessary services. It is also possible that the government could attempt to hold us liable under fraud and abuse laws for improper claims submitted by us if it were found that we knowingly participated in the arrangement that resulted in submission of the improper claims.

Current wording

We are subject to extensive federal and state laws and regulations relating to the submission of claims for payment for services, including those that relate to coverage of services under Medicare, Medicaid, and other governmental healthcare programs, the amounts that may be billed for services, and to whom claims for services may be submitted, such as billing Medicare as the secondary, rather than the primary, payor. The failure to comply with applicable laws and regulations, for example, enrollment in the Medicare Provider Enrollment, Chain and Ownership System, could result in our inability to receive payment for our services or attempts by third party payors, such as Medicare and Medicaid, to recover payments from us that we have already received. Submission of claims in violation of certain statutory or regulatory requirements can result in penalties, damages and exclusion from participation in Medicare and Medicaid. Government authorities and private whistleblowers may also assert that violations of laws and regulations related to submission of claims violate the federal False Claims Act or other laws related to fraud and abuse, including submission of claims for services that were not medically necessary. The Company will be generally dependent on independent physicians to determine when its services are medically necessary for a particular patient. Nevertheless, we could be adversely affected if it were determined that the services we provided were not medically necessary and not reimbursable, particularly if it were asserted that we contributed to the physician’s referrals of unnecessary services. It is also possible that the government could attempt to hold us liable under fraud and abuse laws for improper claims submitted by us if it were found that we knowingly participated in the arrangement that resulted in submission of the improper claims.