Skip to main content

BioCardia, Inc.

For the period ended Dec 31, 2024. Filed Mar 26, 2025.

View on SEC.gov

About this filing

A company's yearly report to the SEC, with audited financial statements. It is the fullest account a company gives of its business, its finances and the risks it sees.

FY2024 · Filed Mar 26, 2025

BCDA$0.85-4.5%Stored close · as of Nov 6, 2026

What changed in Risk Factors?

Read the current filing

Previous report: 10-K

Period ended 2023-12-31; filed 2024-03-27.

0001437749-24-009587

Item 1A. Risk Factors

Current report: 10-K

Period ended 2024-12-31; filed 2025-03-26.

0001437749-25-009397

Item 1A. RISK FACTORS

The baseline is this issuer’s latest earlier reporting period of the same form that was filed before the current report. A previous 10-Q is a different quarter, not a year-over-year comparison. Amendments are excluded.

Compared 203 previous paragraphs and 204 current paragraphs.

182 unchanged; 14 reworded; 8 added; 7 removed; 0 previous and 0 current paragraphs rearranged.

Tables are not compared: 164 previous and 149 current tables excluded. Dates, whitespace, punctuation and numbering changes are ignored; changes to financial figures remain significant.

A changed paragraph is not evidence that risk increased or decreased. An unchanged paragraph does not establish that risk stayed the same.

Added paragraphs (8)

Current report

Restrictive laws and regulations govern the collection, use, transfer, and other processing of personal information.

Current report

In conducting and/or enrolling patients in current or future clinical trials, we are subject to restrictions relating to privacy, data protection, and cybersecurity and may be subject to additional restrictions associated with clinical operations in the future. For example, the collection, use, storage, disclosure, transfer, or other processing of personal data regarding individuals in the European Union, including personal health data, is subject to the General Data Protection Regulation (“GDPR”), which is wide-ranging in scope and imposes numerous requirements on companies that process personal data. The GDPR permits data protection authorities to impose large penalties for violations, including potential fines of up to €20 million or 4% of annual global revenues, whichever is greater, for the most serious of violations. The GDPR also confers a private right of action on data subjects and consumer associations. Certain aspects of cross-border data transfers under the GDPR are uncertain as the result of legal proceedings in the European Union`, including a July 2020 decision by the Court of Justice for the European Union (“CJEU”) that invalidated the EU-U.S. Privacy Shield and called into question the efficacy and legality of using standard contractual clauses (“SCCs”). To address certain concerns of the CJEU, the European Commission issued revised SCCs in June 2021. The European Union also has enacted numerous new laws and regulations addressing cybersecurity. Other jurisdictions also increasingly maintain laws and regulations addressing privacy, data protection, and cybersecurity. We may incur liabilities, expenses, costs, and other operational losses under the GDPR and local laws of applicable EU member states, the UK, and other regions in connection with any measures we take to comply with them.

Current report

In the United States, in addition to HIPAA, HITECH, and state laws addressing health-related information, numerous federal and state laws and regulations govern the collection, use, disclosure, and other processing of information relating to individuals. In California, the California Consumer Privacy Act (“CCPA”) requires covered companies to provide disclosures to consumers about such companies’ data collection, use and sharing practices, provide such consumers ways to opt-out of certain sales or transfers of personal information, and provide consumers with additional causes of action in data breach situations. The CCPA went into effect on January 1, 2020, and was modified significantly by the California Privacy Rights Act (“CPRA”), which became effective January 1, 2023. The CCPA has prompted numerous proposals for federal and state privacy legislation. Numerous U.S. states have proposed, and in certain cases enacted, laws addressing privacy and cybersecurity. Many of these laws are comprehensive privacy statutes imposing obligations similar to the CCPA. Certain U.S. states also have enacted laws and regulations addressing specific subject matter, such as Washington’s My Health, My Data Act, which, among other things, provides for a private right of action.

Current report

Compliance with U.S. and international laws and regulations relating to privacy, data protection, and cybersecurity could require us to take on more onerous obligations in our contracts, restrict our ability to collect, use and disclose data, or in some cases, impact our ability to operate in certain jurisdictions, and may increase our costs of doing business and require us to change our policies and practices. Any actual or alleged failure to comply with U.S. or international laws and regulations relating to privacy, data protection, or cybersecurity could result in governmental investigations, proceedings, and enforcement actions (which could include civil or criminal penalties), private litigation or adverse publicity, harm to our reputation, and could negatively affect our operating results and business. Moreover, clinical trial subjects about whom we or our potential collaborators obtain information, as well as the providers who share this information with us, may contractually limit our ability to use and disclose the information or impose other obligations or restrictions in connection with our use, retention, and other processing of information, and we may otherwise face contractual restrictions applicable to these activities. Claims that we have violated individuals’ privacy rights, failed to comply with data protection laws, or breached our contractual obligations, even if we are not found liable, could be expensive and time-consuming to defend and could result in adverse publicity that could harm our business.

Current report

Despite the implementation of security measures in an effort to protect systems that store our information, given their size and complexity and the increasing amounts of information maintained on our internal information technology systems and external processing and storage systems (e.g., cloud), and those of our third-party CROs, other contractors (including sites performing our current or future clinical trials) and consultants and other third-party service providers, these systems are potentially vulnerable to breakdown or other damage or interruption. Our systems and the systems of third parties who support our operations are vulnerable to service interruptions, system malfunction, natural disasters, terrorism, war (such as the ongoing conflicts in the Middle East and between Ukraine and Russia) and telecommunication and electrical failures, as well as security breaches and incidents arising from or caused by inadvertent or intentional actions by our employees, contractors, consultants, business partners, and/or other third parties, or from cyber-attacks by malicious third parties (including the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering and other means to affect service reliability and threaten the confidentiality, integrity and availability of information), which may compromise our system infrastructure or lead to unauthorized access to or disruption of our or third-party systems used in our business and the unauthorized access to, misuse, disclosure, loss, destruction, alteration or dissemination of, or damage to, our data, including trade secrets or other confidential information, intellectual property, proprietary business information, and personal information. For example, companies have experienced an increase in phishing and social engineering attacks from third parties in recent years. Some of our employees work in a hybrid model in our offices and from home, and we may need to adjust our working model from time to time. As a result, we have increased cyber security and data security risks, due to increased use of home wi-fi networks and virtual private networks, as well as increased disbursement of physical machines. While we implement controls to reduce the risk of a resulting cyber security or data security incident or breach, we may experience data security incidents, and there is no guarantee that the measures we have implemented will be adequate to safeguard all systems and data, especially with an increased number of employees working from home or in a hybrid model where it is more difficult for us to monitor our employees.

Current report

Any disruption, security incident, or security breach resulting in any loss, destruction, unavailability, alteration or dissemination of, or damage to, our data (including confidential information) or other data we or any of our CROs, other contractors or consultants or potential future collaborators or other third-party service providers maintain or otherwise process, or our applications, or for it to be believed or reported that any of these occurred, could result in us incurring liability and reputational damage and the development and commercialization of our product candidates could be delayed. For example, if a security incident were to cause interruptions in our operations, it could result in a material disruption of our programs and the development of our product candidates could be delayed. In addition, the loss or unavailability of clinical trial data for our product candidates could result in delays in our marketing approval efforts and significantly increase our costs to recover or reproduce the data. Furthermore, disruptions of our internal information technology systems or those of third parties used in our business, or security breaches or incidents impacting us or any of our CROs, other contractors or consultants or potential future collaborators or other third-party service providers, could result in the loss, misappropriation, and/or unauthorized access, use, or disclosure of, or the inability to access, data (including trade secrets or other confidential information, intellectual property, proprietary business information, and personal information), which could result in financial, legal, business, and reputational harm to us. Unauthorized access, use, or disclosure of personal information, including personal information regarding our clinical trial subjects or employees, could harm our reputation directly, compel us to notify individuals or regulators under data breach notification laws, cause us to incur costs related to investigation of the incident (including legal expenses, forensic examination costs, and remediation costs), subject us to mandatory corrective action, and otherwise subject us to liability under laws and regulations that protect the privacy and security of personal information, which could result in significant legal and financial exposure and reputational damages that could potentially have an adverse effect on our business.

Current report

We may incur significant costs in our efforts to detect, prevent, and respond to security incidents. We also rely on third parties to manufacture our product candidates, and similar events relating to their systems could also have a material adverse effect on our business. There have been and may continue to be significant supply chain attacks and operational technology attacks globally, and we cannot guarantee that our systems or those of third-party service providers or other third parties that support us or our operations have not been breached or that they do not contain exploitable defects or bugs that could result in a security incident or breach of, or other disruption to, our systems and the systems of third parties that support us and our operations. To the extent that any disruption or security incident were to result in a loss, destruction or alteration of, or damage to, our data, or inappropriate disclosure of confidential or proprietary information, we could be exposed to litigation and governmental investigations, the further development and commercialization of our product candidates could be delayed, and we could be subject to significant fines or penalties for any noncompliance with certain state, federal and/or international laws relating to privacy, data protection, and information security. Litigation and governmental investigations could force us to spend money in defense or settlement, divert management’s time and attention, increase our costs of doing business, and/or adversely affect our reputation. We could be required to fundamentally change our business activities and practices in response to such litigation or investigations, which could have an adverse effect on our business. Any actual or perceived inability to adequately protect data in our possession, custody or control could have a material adverse effect upon our reputation, business, operations, or financial condition.

Current report

Our insurance policies may not be adequate to compensate us for the potential losses arising from any such disruption in or, failure or security breach of, or incident impacting, our systems or third-party systems where information important to our business operations or commercial development is stored. In addition, such insurance may not be available to us in the future on economically reasonable terms, or at all. Further, our insurance may not cover all claims made against us and could have high deductibles in any event, and defending a suit, regardless of its merit, could be costly and divert management attention.
Removed paragraphs (7)

Previous report

A failure to adequately protect private health information could result in severe harm to our reputation and subject us to significant liabilities, each of which could have a material adverse effect on our business.

Previous report

Any cybersecurity breaches or our actual or perceived failure to comply with such legal obligations by us, or by our third-party service providers or partners, could harm our business.

Previous report

We collect, store, process and use our customers’ personally identifiable information and other data, and we rely on third parties that are not directly under our control to do so as well. While we take measures intended to protect the security, integrity and confidentiality of the personal information and other sensitive information we collect, store or transmit, we cannot guarantee that inadvertent or unauthorized use or disclosure will not occur, or that third parties will not, gain unauthorized access to this information. There have been a number of recent reported incidents where third parties have used software to access the personal data of their partners’ customers for marketing and other purposes.

Previous report

If we or our third-party service providers were to experience a breach, disruption or failure of systems compromising our customers’ data, or if one of our third-party service providers or partners were to access our customers’ personal data without our authorization, our brand and reputation could be adversely affected, use of our products could decrease and we could be exposed to a risk of loss, litigation and regulatory proceedings. In addition, a breach could require expending significant additional resources related to the security of information systems and disrupt our operations.

Previous report

The use of data by our business and our business associates is highly regulated in all our operating countries. Privacy and information-security laws and regulations change, and compliance with them may result in cost increases due to, among other things, systems changes and the development of new processes. If we or those with whom we share information fail to comply with laws and regulations, such as the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA), our reputation could be damaged, possibly resulting in lost business, and we could be subjected to additional legal risk or financial losses as a result of non-compliance. Complying with such laws may also require us to modify our data processing practices and policies and incur substantial expenditures. See Item 1C “Cybersecurity” of this Annual Report on Form 10-K for additional information about our cybersecurity processes.

Previous report

If we do not regain compliance with or continue to satisfy the Nasdaq continued listing requirements, our securities could be delisted from the Nasdaq.

Previous report

The listing of our securities on the Nasdaq Capital Market (Nasdaq) is contingent on our compliance with the Nasdaq’s conditions for continued listing. We are currently not in compliance with Nasdaq listing requirements, specifically those that require us to maintain a minimum market value of listed securities of at least $35.0 million (MVLS Requirements) and a minimum $1.00 per share closing bid price for our common stock (Minimum Bid Price Requirement). On March 6, 2024 and March 12, 2024, we received delisting determination letters from the Nasdaq advising us that we did not regain compliance with the MVLS Requirement and the Minimum Bid Price Requirement, respectively, by the initial compliance dates afforded by the Nasdaq. As a result, trading of our securities on the Nasdaq was subject to suspension at the opening of business on March 15, 2024 and a Form 25-NSE would have been filed with the SEC to remove our securities from listing and registration on the Nasdaq unless we requested an appeal of these determinations to a Nasdaq Hearings Panel (Panel). On March 12, 2024, we submitted a hearing request to the Panel to appeal the delisting determinations. Our request for a hearing has stayed the suspension of our securities and the filing of a Form 25-NSE pending the Panel’s decision. At the hearing, we intend to present a plan to regain compliance with the MVLS Requirement and the Minimum Bid Price Requirement.
Reworded paragraphs (14)

Previous wording

We are a clinical-stage regenerative medicine company and we have not yet generated a profit. We have incurred net losses during each of our fiscal years since our inception. Our net loss for the year ended December 31, 2023 was $11.6 million and our accumulated deficit totaled $152.2 million as of December 31, 2023. We do not know whether or when we will become profitable, if ever. We currently expect operating losses and negative cash flows to continue for at least the next several years.

Current wording

We are a clinical-stage regenerative medicine company and we have not yet generated a profit. We have incurred net losses during each of our fiscal years since our inception. Our net loss for the year ended December 31, 2024 was $7.9 million and our accumulated deficit totaled $160.1 million as of December 31, 2024. We do not know whether or when we will become profitable, if ever. We currently expect operating losses and negative cash flows to continue for at least the next several years.

Previous wording

To date, our only approved or cleared products are our Morph universal deflectable guide catheters and Morph AccessPro sheaths, in the United States and Europe; our AVANCE™ steerable introducer and our Morph DNA deflectable guides in the United States only; and our Helix biotherapeutic delivery system in Europe. Our limited commercialization experience and number of approved products makes it difficult to evaluate our current business and predict our future prospects. Our short commercialization experience and limited number of approved products also makes it difficult for us to forecast our future financial performance and growth and such forecasts are limited and subject to a number of uncertainties, including our ability to successfully complete our Phase III pivotal trials in heart failure and chronic myocardial ischemia and obtain FDA approval for, and then successfully commercialize, the CardiAMP Cell Therapy System.

Current wording

To date, our only approved or cleared products are our Morph universal deflectable guide catheters, our AVANCE™ steerable introducer, and our Morph DNA deflectable guides in the United States. Our limited commercialization experience and number of approved products makes it difficult to evaluate our current business and predict our future prospects. Our short commercialization experience and limited number of approved products also makes it difficult for us to forecast our future financial performance and growth and such forecasts are limited and subject to a number of uncertainties, including our ability to successfully complete our Phase III pivotal trials in heart failure and chronic myocardial ischemia and obtain FDA approval for, and then successfully commercialize, the CardiAMP Cell Therapy System.

Previous wording

Our audited consolidated financial statements as of and for the year ended December 31, 2023 have been prepared on the basis that we will continue as a going concern, which contemplates the realization of assets and satisfaction of liabilities in the normal course of business. We have incurred significant losses since our inception and we expect that we will continue to incur losses as we aim to successfully execute our business plan and will be dependent on additional public or private financings, collaborations or licensing arrangements with strategic partners, or additional credit lines or other debt financing sources to fund continuing operations. Based on our cash balances, recurring losses since inception and our existing capital resources to fund our planned operations for a twelve-month period, there is substantial doubt about our ability to continue as a going concern. As noted below, we may need to obtain additional funding from equity or debt financings, which may be highly dilutive to our existing stockholders and may require us to agree to burdensome covenants, grant security interests in our assets, enter into collaboration and licensing arrangements that require us to relinquish commercial rights, or grant licenses on terms that are not favorable. No assurance can be given at this time as to whether we will be able to achieve our fundraising objectives, regardless of the terms. If adequate funds are not available, the Company may be required to reduce operating expenses, delay or reduce the scope of its product development programs, obtain funds through arrangements with others that may require the Company to relinquish rights to certain of its technologies or products that the Company would otherwise seek to develop or commercialize itself, or cease operations.

Current wording

Our audited consolidated financial statements as of and for the year ended December 31, 2024 have been prepared on the basis that we will continue as a going concern, which contemplates the realization of assets and satisfaction of liabilities in the normal course of business. We have incurred significant losses since our inception and we expect that we will continue to incur losses as we aim to successfully execute our business plan and will be dependent on additional public or private financings, collaborations or licensing arrangements with strategic partners, or additional credit lines or other debt financing sources to fund continuing operations. Absent additional funding, management believes our cash and cash equivalents of approximately $2.4 million as of December 31, 2024 are not sufficient to fund our planned expenditures and meet our obligations beyond May 2025. As noted below, we may need to obtain additional funding from equity or debt financings, which may be highly dilutive to our existing stockholders and may require us to agree to burdensome covenants, grant security interests in our assets, enter into collaboration and licensing arrangements that require us to relinquish commercial rights, or grant licenses on terms that are not favorable. For example, in September 2024, we completed the Registered Offering, pursuant to which we issued 2,400,000 shares of common stock, including the shares issued upon the exercise of pre-funded warrants, and common warrants to purchase 2,400,000 shares of common stock. No assurance can be given at this time as to whether we will be able to achieve our fundraising objectives, regardless of the terms. If adequate funds are not available, the Company may be required to reduce operating expenses, delay or reduce the scope of its product development programs, obtain funds through arrangements with others that may require the Company to relinquish rights to certain of its technologies or products that the Company would otherwise seek to develop or commercialize itself, or cease operations.

Previous wording

Specifically, the HCW ATM Offering is limited by the terms and conditions in the HCW Sales Agreement. Under the terms of the HCW Sales Agreement, the obligations of HCW are only to use reasonable efforts to sell shares of our common stock, but there is no actual obligation to sell or guarantee that we will be able to place any shares. We are also limited in the amount we may sell under the HCW Sales Agreement to the amount that is covered by an effective registration statement with the Securities and Exchange Commission (SEC), the current amount of which is approximately $2.2 million. Therefore, we currently do not, and may not in the future, have access to the full amount otherwise available to us under the HCW ATM Offering or any similar contractual arrangement we may enter into in the future. In addition, any amounts we sell under the HCW ATM Offering will not satisfy all of our funding needs or may not fund them on a timely basis, even if we are able and choose to sell and issue all of our common stock otherwise issuable pursuant to the HCW Sales Agreement.

Current wording

Specifically, the HCW ATM Offering is limited by the terms and conditions in the HCW Sales Agreement. Under the terms of the HCW Sales Agreement, the obligations of HCW are only to use reasonable efforts to sell shares of our common stock, but there is no actual obligation to sell or guarantee that we will be able to place any shares. We are also limited in the amount we may sell under the HCW Sales Agreement to the amount that is covered by an effective registration statement with the Securities and Exchange Commission (SEC), the current amount of which is approximately $1.1 million. The amounts we sell under the HCW ATM Offering will not satisfy all of our funding needs and our receipt of any funds thereunder may not be received on a timely basis, even if we are able and choose to sell and issue all of our common stock otherwise issuable pursuant to the HCW Sales Agreement.

Previous wording

We have incurred substantial losses during our history and do not expect to become profitable in the near future and we may never achieve profitability. To the extent that we continue to generate taxable losses, unused losses will carry forward to offset future taxable income, if any, until such unused losses expire. Losses generated after 2017 do not have an expiration date. Under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended, if a corporation undergoes an “ownership change,” generally defined as a greater than 50% change (by value) in its equity ownership over a three-year period, the corporation’s ability to use its pre-change net operating loss carryforwards, or NOLs, and other pre-change tax attributes (such as research tax credits) to offset its post-change income or taxes may be limited. None of our pre-Merger tax attributes remain available after the Merger as a result of limitations under Section 382 of the Code. Further, our prior equity offerings and other changes in our stock ownership may have resulted in ownership changes. We have not performed an analysis to assess whether an ownership change has occurred. If we have experienced an ownership change at any time since our formation, utilization of our net operating loss carryforwards would be subject to an annual limitation under Section 382 and 383 of the Code. In addition, we may experience ownership changes in the future as a result of subsequent shifts in our stock ownership, some of which are outside of our control. As a result, if we earn net taxable income, our ability to use our pre-change net operating loss carryforwards to offset U.S. federal taxable income and tax credits may be subject to limitations, which could potentially result in increased future tax liability to us. In addition, at the state level, there may be periods during which the use of NOLs is suspended or otherwise limited, which could accelerate or permanently increase state taxes owed. Use of these NOLs will depend on future income in relationship to expiration dates of these carryforwards.

Current wording

We have incurred substantial losses during our history and do not expect to become profitable in the near future and we may never achieve profitability. To the extent that we continue to generate taxable losses, unused losses will carry forward to offset future taxable income, if any, until such unused losses expire. Federal income tax net operating losses, or NOLs, generated after 2017 do not have an expiration date. Under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended, or the Code, if a corporation undergoes an “ownership change,” generally defined as a greater than 50% change (by value) in its equity ownership over a three-year period, the corporation’s ability to use its pre-change NOLs, and other pre-change tax attributes (such as research tax credits) to offset its post-change federal taxable income or taxes may be limited. None of our pre-Merger tax attributes remain available after the Merger as a result of limitations under Sections 382 and 383 of the Code. Further, our prior equity offerings and other changes in our stock ownership may have resulted in ownership changes. We have not performed an analysis to assess whether an ownership change has occurred. If we have experienced an ownership change at any time since our formation, utilization of our tax attributes would be subject to an annual limitation under Section 382 and 383 of the Code. In addition, we may experience ownership changes in the future as a result of subsequent shifts in our stock ownership, some of which are outside of our control. As a result, if we earn net taxable income, our ability to use our pre-change NOLs and other pre-change tax attributes to offset U.S. federal taxable income and tax liabilities may be subject to limitations, which could potentially result in increased future tax liability to us. In addition, at the state level, there may be periods during which the use of NOLs or other tax attributes is suspended or otherwise limited, which could accelerate or permanently increase state taxes owed. Use of NOLs and other tax attributes will depend on future income in relationship to expiration dates of these carryforwards.

Previous wording

If we or our suppliers fail to comply with the FDA’s QSRs, our manufacturing operations could be delayed or shut down and product sales could suffer.

Current wording

If we or our suppliers fail to comply with the FDA’s QSRs, or QMSR when it goes into effect, our manufacturing operations could be delayed or shut down and product sales could suffer.

Previous wording

Our manufacturing processes and those of our third-party suppliers are required to comply with the FDA’s QSRs, which covers the procedures and documentation of the design, testing, production, control, quality assurance, labeling, packaging, storage and shipping. We are also subject to similar state requirements and licenses. In addition, we must engage in extensive record keeping and reporting and must make available our manufacturing facilities and records for periodic unannounced inspections by governmental agencies, including the FDA, state authorities and comparable agencies in other countries. If we fail a Quality System inspection, our operations could be disrupted and our manufacturing interrupted. Further, the FDA recently issued a final rule replacing the QSR with QMSR, which goes into effect in February 2026. Failure to take adequate corrective action in response to an adverse Quality System inspection or failure to comply with applicable regulatory requirements could result in, among other things, a shut-down of our manufacturing operations, significant fines, suspension of marketing clearances and approvals, seizures or recalls, operating restrictions and criminal prosecutions, any of which would cause our business to suffer. Furthermore, our key component suppliers may not currently be or may not continue to be in compliance with applicable regulatory requirements, which may result in manufacturing delays and cause our revenues to decline.

Current wording

Our manufacturing processes and those of our third-party suppliers are required to comply with the FDA’s QSRs, which covers the procedures and documentation of the design, testing, production, control, quality assurance, labeling, packaging, storage and shipping. We are also subject to similar state requirements and licenses. In addition, we must engage in extensive record keeping and reporting and must make available our manufacturing facilities and records for periodic unannounced inspections by governmental agencies, including the FDA, state authorities and comparable agencies in other countries. If we fail a Quality System inspection, our operations could be disrupted and our manufacturing interrupted. Further, the FDA issued a final rule replacing the QSR with QMSR, which goes into effect in February 2026. Failure to take adequate corrective action in response to an adverse Quality System inspection or failure to comply with applicable regulatory requirements could result in, among other things, a shut-down of our manufacturing operations, significant fines, suspension of marketing clearances and approvals, seizures or recalls, operating restrictions and criminal prosecutions, any of which would cause our business to suffer. Furthermore, our key component suppliers may not currently be or may not continue to be in compliance with applicable regulatory requirements, which may result in manufacturing delays and cause our revenues to decline.

Previous wording

We have registered with the FDA as a medical device manufacturer and have obtained a manufacturing license from the California Department of Health Services, or CDHS. The FDA has broad post-market and regulatory enforcement powers. We are subject to unannounced inspections by the FDA and the Food and Drug Branch of CDHS to determine our compliance with the QSR and other regulations, and these inspections may include the manufacturing facilities of our suppliers. If the FDA or CDHS inspect our facility and discover compliance problems, we may have to shut down our facility and cease manufacturing until we can take the appropriate remedial steps to correct the audit findings. Taking corrective action may be expensive, time consuming and a distraction for management and if we experience a shutdown or delay at our manufacturing facility, we may be unable to produce our products, which may have an adverse impact on our business.

Current wording

We have registered with the FDA as a medical device manufacturer and have obtained a manufacturing license from the California Department of Health Services, or CDHS. The FDA has broad post-market and regulatory enforcement powers. We are subject to unannounced inspections by the FDA and the Food and Drug Branch of CDHS to determine our compliance with the QSR, or QMSR, and other regulations, and these inspections may include the manufacturing facilities of our suppliers. If the FDA or CDHS inspect our facility and discover compliance problems, we may have to shut down our facility and cease manufacturing until we can take the appropriate remedial steps to correct the audit findings. Taking corrective action may be expensive, time consuming and a distraction for management and if we experience a shutdown or delay at our manufacturing facility, we may be unable to produce our products, which may have an adverse impact on our business.

Previous wording

Even though we do not and will not control referrals of healthcare services or bill directly to Medicare, Medicaid or other third-party payors, certain federal and state healthcare laws and regulations pertaining to fraud and abuse will be applicable to our business. Healthcare fraud and abuse regulations are complex and can be subject to varying interpretations as to whether or not a statute has been violated. The laws that may affect our ability to operate include:

Current wording

Even though we do not and will not control referrals of healthcare services or bill directly to Medicare, Medicaid or other third-party payors, certain federal and state healthcare laws and regulations pertaining to fraud and abuse will be applicable to our business. In addition, we may be subject to patient privacy laws and regulations of the federal government and the states in which we conduct our business. Healthcare fraud and abuse regulations are complex and can be subject to varying interpretations as to whether or not a statute has been violated. These laws and regulations that may affect our ability to operate include:

Previous wording

Throughout the clinical trial process, we may obtain the private health information of our trial subjects. There are a number of state, federal and international laws protecting the privacy and security of health information and personal data. As part of the American Recovery and Reinvestment Act of 2009, or ARRA, Congress amended the privacy and security provisions of HIPAA. HIPAA imposes limitations on the use and disclosure of an individual’s healthcare information by healthcare providers conducting certain electronic transactions, healthcare clearinghouses, and health insurance plans, collectively referred to as covered entities. The HIPAA amendments also impose compliance obligations and corresponding penalties for non-compliance on certain individuals and entities that provide services to or perform certain functions on behalf of healthcare providers and other covered entities involving the use or disclosure of individually identifiable health information, collectively referred to as business associates. ARRA also made significant increases in the penalties for improper use or disclosure of an individual’s health information under HIPAA and extended enforcement authority to state attorneys general. The amendments also create notification requirements to federal regulators, and in some cases local and national media, for individuals whose health information has been inappropriately accessed or disclosed. Notification is not required under HIPAA if the health information that is improperly used or disclosed is deemed secured in accordance with certain encryption or other standards developed by the U.S. Department of Health and Human Services, or HHS. Most states have laws requiring notification of affected individuals and state regulators in the event of a breach of personal information, which is a broader class of information than the health information protected by HIPAA. Many state laws impose significant data security requirements, such as encryption or mandatory contractual terms to ensure ongoing protection of personal information. Activities outside of the United States implicate local and national data protection standards, impose additional compliance requirements and generate additional risks of enforcement for noncompliance. The European Union’s Data Protection Directive, Canada’s Personal Information Protection and Electronic Documents Act and other data protection, privacy and similar national, state/provincial and local laws may also restrict the access, use and disclosure of patient health information abroad. We may be required to expend significant capital and other resources to ensure ongoing compliance with applicable privacy and data security laws, to protect against security breaches and hackers or to alleviate problems caused by such breaches.

Current wording

In the United States,HIPAA imposes limitations on the use and disclosure of an individual’s healthcare information by healthcare providers conducting certain electronic transactions, healthcare clearinghouses, and health insurance plans, collectively referred to as covered entities. Amendments to HIPAA by the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”) also impose compliance obligations and corresponding penalties for non-compliance on certain individuals and entities that provide services to or perform certain functions on behalf of healthcare providers and other covered entities involving the use or disclosure of individually identifiable health information, collectively referred to as business associates. HITECH also made significant increases in the penalties for improper use or disclosure of an individual’s health information under HIPAA and extended enforcement authority to state attorneys general. HIPAA also provides for notification requirements to federal regulators, and in some cases local and national media, for individuals whose health information has been inappropriately accessed or disclosed.

Previous wording

Despite the implementation of security measures, our internal computer systems and those of our current and any future CROs and other contractors, consultants and potential collaborators are vulnerable to damage from computer viruses, unauthorized access, natural disasters, terrorism, war and telecommunication and electrical failures. For example, our systems have been impacted by computer viruses in the past, and while we have not experienced any material system failure, accident or security breach that has resulted in lasting impacts to date, if such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our development programs and our business operations. For example, the loss of clinical trial data from completed or future clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. Likewise, we rely on third parties for manufacturing our therapeutic candidates and conducting clinical trials, and similar events relating to their computer systems could also have a material adverse effect on our business. To the extent that any disruption or security breach were to result in a loss of, or damage to, our data or applications, or inappropriate disclosure of confidential or proprietary information, we could incur liability and the further development and commercialization of our therapeutic candidates could be delayed.

Current wording

Despite the implementation of security measures, our internal computer systems and those of our current and any future CROs and other contractors, consultants and potential collaborators are vulnerable to damage, interruption and other disruption from computer viruses and other malicious code, unauthorized access, natural disasters, terrorism, war and telecommunication and electrical failures. For example, our systems have been impacted by computer viruses in the past, and while we have not experienced any material system failure that has resulted in lasting impacts to date, if such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our development programs and our business operations. Likewise, we rely on third parties for manufacturing our therapeutic candidates and conducting clinical trials, and similar events relating to their computer systems could also have a material adverse effect on our business. To the extent that any disruption or security breach were to result in a loss of, or damage to, our data or applications, or inappropriate disclosure of confidential or proprietary information, we could incur liability and the further development and commercialization of our therapeutic candidates could be delayed.

Previous wording

If the Panel does not grant our request for continued listing, or otherwise provide a further extension for us to regain compliance with the MVLS Requirement and the Minimum Bid Price Requirement, our securities will be subject to delisting by the Nasdaq. In the event our securities are no longer listed for trading on Nasdaq, our trading volume and share price may decrease and we may experience further difficulties in raising capital, which could materially affect our operations and financial results. Further, delisting from the Nasdaq could also have other negative effects, including potential loss of confidence by partners, lenders, suppliers and employees and could also trigger various defaults under our financing arrangements and other outstanding agreements.

Current wording

The listing of our common stock on the Nasdaq is contingent on our compliance with the Nasdaq’s conditions for continued listing. We were previously not in compliance with the Nasdaq listing requirements, specifically the requirement to maintain a minimum market value of listed securities of at least $35.0 million (MVLS Requirements), and the Nasdaq listing requirement to maintain a minimum $1.00 per share closing bid price for our common stock (Minimum Bid Price Requirement). Although we have regained compliance with the Minimum Bid Price Requirement and the MVLS requirement, we are not currently in compliance with the Nasdaq’s continued listing requirement that we have a minimum stockholders’ equity of $2.5 million and, as such, could be subject to potential delisting by the Nasdaq. In the event our securities are no longer listed for trading on Nasdaq, our trading volume and security price may decrease and we may experience further difficulties in raising capital, which could materially affect our operations and financial results. Further, delisting from the Nasdaq could also have other negative effects, including potential loss of confidence by partners, lenders, suppliers and employees and could also trigger various defaults under our financing arrangements and other outstanding agreements.

Previous wording

As of March 27, 2024, our executive officers, directors, 5% stockholders and their affiliates beneficially owned approximately 20.1% of our voting stock. Therefore, these stockholders will have the ability to influence us through this ownership position. These stockholders may be able to determine all matters requiring stockholder approval. For example, these stockholders, acting together, may be able to control elections of directors, amendments of our organizational documents, or approval of any merger, sale of assets, or other major corporate transaction. This may prevent or discourage unsolicited acquisition proposals or offers for our common stock that you may believe are in your best interest as one of our stockholders.

Current wording

As of March 26, 2025, our executive officers, directors, 5% stockholders and their affiliates beneficially owned approximately 17.0% of our voting stock. Therefore, these stockholders will have the ability to influence us through this ownership position. These stockholders may be able to determine all matters requiring stockholder approval. For example, these stockholders, acting together, may be able to control elections of directors, amendments of our organizational documents, or approval of any merger, sale of assets, or other major corporate transaction. This may prevent or discourage unsolicited acquisition proposals or offers for our common stock that you may believe are in your best interest as one of our stockholders.

Previous wording

Furthermore, we filed a prospectus supplement related to the offer and sale of up to $2.75 million of our common stock under the HCW Sales Agreement. Any such HCW Sales Agreement sales would be made by HCW on a reasonable efforts basis. Any sales under the HCW Sales Agreement must be in compliance with the terms of such agreement and applicable law and the purchase price for such sales will fluctuate based on the price of our common stock. Depending on market liquidity at the time, sales of such shares may cause the trading price of our common stock to fall and any such issuances would be dilutive to our existing stockholders.

Current wording

Furthermore, we have filed a prospectus supplement related to the offer and sale of our common stock under the HCW Sales Agreement. As of March 26, 2025, we had up to $1.1 million of our common stock available for offer and sale under the prospectus supplement. Any such HCW Sales Agreement sales would be made by HCW on a reasonable efforts basis. Any sales under the HCW Sales Agreement must be in compliance with the terms of such agreement and applicable law and the purchase price for such sales will fluctuate based on the price of our common stock. Depending on market liquidity at the time, sales of such shares may cause the trading price of our common stock to fall and any such issuances would be dilutive to our existing stockholders.