Travere Therapeutics Inc

Previous wording

In October 2022, our licensor, Mission Pharmacal Company, was granted a patent covering the treatment of cystinuria by administering Thiola EC with food (US Patent No. 11,458,104, “the ‘104 patent”) and listed this patent in the FDA’s Approved Drug Products with Therapeutic Equivalence Evaluations (the "Orange Book"). Following Mission’s listing of the '104 patent in the Orange Book, and as of December 31, 2023, Mission has received three paragraph IV notice letters from three generic manufacturers notifying Mission that each has filed an ANDA seeking approval of a proposed generic version of Thiola EC (tiopronin) 100mg and 300mg oral tablets before expiration of the '104 patent and asserting that the '104 patent is not infringed and/or is invalid, with each such ANDA having been filed prior to the granting and listing of the ‘104 patent. The ANDAs filed by Par Pharmaceutical Inc. (Par) and Amneal EU, Limited (Amneal) for generic versions of Thiola EC (100mg and 300mg) were approved by the FDA in February and August 2023, respectively. Under our agreement with Mission, we have the right to enforce the '104 patent. We and Mission have entered into agreements with each of Par and Amneal in order to settle patent invalidity and infringement disputes related to the '104 patent and providing for a license entry date of April 1, 2026 for their generic versions of Thiola EC (100mg and 300mg), or earlier under certain circumstances.

Current wording

In October 2022, our licensor, Mission Pharmacal Company, was granted a patent covering the treatment of cystinuria by administering Thiola EC with food (US Patent No. 11,458,104, “the ‘104 patent”) and listed this patent in the FDA’s Approved Drug Products with Therapeutic Equivalence Evaluations (the "Orange Book"). Following Mission’s listing of the '104 patent in the Orange Book, and as of December 31, 2023, Mission has received three paragraph IV notice letters from three generic manufacturers notifying Mission that each has filed an ANDA seeking approval of a proposed generic version of Thiola EC (tiopronin) 100mg and 300mg oral tablets before expiration of the '104 patent and asserting that the '104 patent is not infringed and/or is invalid, with each such ANDA having been filed prior to the granting and listing of the ‘104 patent. Under our agreement with Mission, we have the right to enforce the '104 patent. We and Mission entered into agreements with each of the two Paragraph IV filers that had received approval by the FDA in order to settle patent invalidity and infringement disputes related to the '104 patent and providing for a license entry date of April 1, 2026 for their generic versions of Thiola EC (100mg and 300mg), or earlier under certain circumstances. In May 2024 a generic manufacturer announced the launch of a generic version of Thiola EC (100mg and 300mg), and in July 2024 a second manufacturer announced the launch of a second generic version of Thiola EC (100mg and 300mg). Both generic versions are available, and Thiola EC is thus subject to generic competition.

Previous wording

There is no guarantee that the ‘104 patent will withstand any challenge at the Patent and Trademark Office or in litigation, if initiated. Patent litigation is expensive and time consuming, requires significant resources, may absorb significant time of our management and has an unpredictable outcome. If we determine not to pursue patent litigation or the patent is not upheld in litigation or administrative review or if a generic competitor is found not to infringe this patent, the resulting generic competition will likely negatively affect our business, financial condition and results of operations. Following the FDA’s approval in January 2024 of an ANDAfor a generic version of Thiola EC (100mg and 300mg), Thiola EC is subject to immediate generic competition.

Current wording

There is no guarantee that the ‘104 patent will withstand any challenge at the Patent and Trademark Office or in litigation, if initiated. Patent litigation is expensive and time consuming, requires significant resources, may absorb significant time of our management and has an unpredictable outcome. If we determine not to pursue patent litigation or the patent is not upheld in litigation or administrative review or if a generic competitor is found not to infringe this patent, the resulting generic competition will likely negatively affect our business, financial condition and results of operations. Thiola EC is subject to generic competition.

Previous wording

The outcome of an HTA will often influence the pricing and reimbursement status granted to these medicinal products by the competent authorities of individual EU Member States. The extent to which pricing and reimbursement decisions are influenced by the HTA of the specific medicinal product currently varies between EU Member States. In December 2021, Regulation No 2021/2282 on HTA amending Directive 2011/24/EU, was adopted in the EU. This Regulation, which entered into force in January 2022 and will apply as of January 2025, is intended to boost cooperation among EU Member States in assessing health technologies, including new medicinal products, and providing the basis for cooperation at EU level for joint clinical assessments in these areas. The Regulation foresees a three-year transitional period and will permit EU Member States to use common HTA tools, methodologies, and procedures across the EU, working together in four main areas, including joint clinical assessment of the innovative health technologies with the most potential impact for patients, joint scientific consultations whereby developers can seek advice from HTA authorities, identification of emerging health technologies to identify promising technologies early, and continuing voluntary cooperation in other areas. Individual EU Member States will continue to be responsible for assessing non-clinical (e.g., economic, social, ethical) aspects of health technologies, and making decisions on pricing and reimbursement. If we or our partners are unable to maintain favorable pricing and reimbursement status in EU Member States for product candidates that we or our partners may successfully develop and for which we or our partners may obtain regulatory approval, any anticipated revenue from and growth prospects for those products in the EU could be negatively affected.

Current wording

Moreover, to obtain reimbursement or pricing approval in some countries, we may be required to conduct a clinical trial that compares the cost effectiveness of our product candidate to other available therapies. This Health Technology Assessment (“HTA”) of medicinal products is becoming an increasingly common part of the pricing and reimbursement procedures in some EU Member States, including those representing the larger markets. The HTA process is the procedure to assess therapeutic, economic and societal impact of a given medicinal product in the national healthcare systems of the individual country. The outcome of an HTA will often influence the pricing and reimbursement status granted to these medicinal products by the competent authorities of individual EU Member States. The extent to which pricing and reimbursement decisions are influenced by the HTA of the specific medicinal product currently varies between EU Member States. In December 2021, Regulation No 2021/2282 on HTA amending Directive 2011/24/EU, was adopted in the EU. This Regulation, which entered into force in January 2022 and will apply as of January 2025, is intended to boost cooperation among EU Member States in assessing health technologies, including new medicinal products, and providing the basis for cooperation at EU level for joint clinical assessments in these areas. The Regulation foresees a three-year transitional period and will permit EU Member States to use common HTA tools, methodologies, and procedures across the EU, working together in four main areas, including joint clinical assessment of the innovative health technologies with the most potential impact for patients, joint scientific consultations whereby developers can seek advice from HTA authorities, identification of emerging health technologies to identify promising technologies early, and continuing voluntary cooperation in other areas. Individual EU Member States will continue to be responsible for assessing non-clinical (e.g., economic, social, ethical) aspects of health technologies, and making decisions on pricing and reimbursement. If we or our partners are unable to maintain favorable pricing and reimbursement status in EU Member States for product candidates that we or our partners may successfully develop and for which we or our partners may obtain regulatory approval, any anticipated revenue from and growth prospects for those products in the EU could be negatively affected.

Previous wording

In addition, certain governmental authorities may conduct reviews of reimbursement previously provided and assert for various reasons that amounts need to be repaid. For example, in October 2021 our distributor/exploitant in France for our previously marketed product Kolbam (which has since been divested) informed us that they had received a notice that the price previously paid for Kolbam during its period on the market in France had been recalculated by the agency responsible for pharmaceutical pricing in France. Such notice was confirmed by a decision in October 2023, asserting percentages of our turnover owed for repayment. In April 2024, we filed an appeal with the Competent Administrative Court regarding this matter. Based on the ongoing review process, we expect that we will need to repay the amounts being asserted during the appeal process, which we currently estimate to be approximately $5 million. While we cannot predict the amount that we may ultimately need to repay, following ongoing review and future potential appeal proceedings, from 2015 through 2020, the period during which we had sales of Kolbam in France, our aggregate revenues from sales of Kolbam in France attributable to all purchasers/payers were approximately $8 million. If reimbursement of our products is unavailable or limited in scope or amount, or if pricing is set at unsatisfactory levels or subject to re-assessment and recoupment procedures, our prospects for generating revenue outside of the United States, if any, could be adversely affected and our business may suffer.

Current wording

In addition, certain governmental authorities may conduct reviews of reimbursement previously provided and assert for various reasons that amounts need to be repaid. For example, in October 2021 our distributor/exploitant in France for our previously marketed product Kolbam (which has since been divested) informed us that they had received a notice that the price previously paid for Kolbam during its period on the market in France had been recalculated by the agency responsible for pharmaceutical pricing in France. Such notice was confirmed by a decision in October 2023, asserting percentages of our turnover owed for repayment. In April 2024, we filed an appeal with the Competent Administrative Court regarding this matter. Based on the ongoing review process, we expect that we will need to repay the amounts being asserted during the appeal process, which we currently estimate to be approximately $6 million. While we cannot predict the amount that we may ultimately need to repay, following ongoing review and future potential appeal proceedings, from 2015 through 2020, the period during which we had sales of Kolbam in France, our aggregate revenues from sales of Kolbam in France attributable to all purchasers/payers were approximately $8 million. If reimbursement of our products is unavailable or limited in scope or amount, or if pricing is set at unsatisfactory levels or subject to re-assessment and recoupment procedures, our prospects for generating revenue outside of the United States, if any, could be adversely affected and our business may suffer.

Previous wording

For example, in our pivotal Phase 3 DUPLEX Study of sparsentan in FSGS, although we achieved the pre-specified interim FSGS partial remission of proteinuria endpoint after 36 weeks of treatment, the study did not achieve the primary efficacy eGFR slope endpoint over 108 weeks of treatment. While we intend to continue to engage with the FDA to explore a potential path forward for a supplemental New Drug Application (sNDA) in the U.S. and work with our collaborator CSL Vifor to engage with the European Medicines Agency ("EMA") to also explore a potential regulatory path forward in FSGS in the EU based on the DUPLEX data, there is no guarantee that we will be able to establish a pathway to a potential submission of sparsentan for FSGS based on the results from the DUPLEX Study, that the FDA and/or EMA will support an application for sparsentan in FSGS, or that sparsentan will be approved for FSGS.

Current wording

For example, in our pivotal Phase 3 DUPLEX Study of sparsentan in FSGS, although we achieved the pre-specified interim FSGS partial remission of proteinuria endpoint after 36 weeks of treatment, the study did not achieve the primary efficacy eGFR slope endpoint over 108 weeks of treatment. While we plan to continue to engage with the FDA to explore a potential path forward for a supplemental New Drug Application (sNDA) in the U.S. and work with our collaborator CSL Vifor to engage with the European Medicines Agency ("EMA") to also explore a potential regulatory path forward in FSGS in the EU based on the DUPLEX data, there is no guarantee that we will be able to establish a pathway to a potential submission of sparsentan for FSGS based on the results from the DUPLEX Study, that the FDA and/or EMA will support an application for sparsentan in FSGS, or that sparsentan will be approved for FSGS.

Previous wording

Several of our competitors have substantially greater financial, research and development, distribution, manufacturing and marketing experience and resources than we do and represent substantial long-term competition for us. Other companies may succeed in developing and marketing products that are more effective and/or less costly than any products that may be developed and marketed by us, or that are commercially accepted before any of our products. Factors affecting competition in the pharmaceutical and therapeutic industries vary, depending on the extent to which a competitor is able to achieve a competitive advantage based on its proprietary technology and ability to market and sell therapeutics. The industry in which we compete is characterized by extensive research and development efforts and rapid technological progress. Although we believe that our orphan drug status and proprietary position with respect to sparsentan may give us a competitive advantage, new developments are expected to continue and there can be no assurance that discoveries by others will not render our products and product candidates noncompetitive. Furthermore, competitors could enter the market with generic versions of our products. For example, a generic option for the 100mg version of the original formulation of Thiola (tiopronin tablets) was approved by the FDA in May 2021 and a second 100mg version of the original formulation of Thiola (tiopronin tablets) was approved by the FDA in June 2022. Also, as of February 1, 2024, three generic options for the 100mg and 300mg versions of Thiola EC have been approved by the FDA.

Current wording

Several of our competitors have substantially greater financial, research and development, distribution, manufacturing and marketing experience and resources than we do and represent substantial long-term competition for us. Other companies may succeed in developing and marketing products that are more effective and/or less costly than any products that may be developed and marketed by us, or that are commercially accepted before any of our products. Factors affecting competition in the pharmaceutical and therapeutic industries vary, depending on the extent to which a competitor is able to achieve a competitive advantage based on its proprietary technology and ability to market and sell therapeutics. The industry in which we compete is characterized by extensive research and development efforts and rapid technological progress. Although we believe that our orphan drug status and proprietary position with respect to sparsentan may give us a competitive advantage, new developments are expected to continue and there can be no assurance that discoveries by others will not render our products and product candidates noncompetitive. Furthermore, competitors could enter the market with generic versions of our products. For example, a generic option for the 100mg version of the original formulation of Thiola (tiopronin tablets) was approved by the FDA in May 2021 and a second 100mg version of the original formulation of Thiola (tiopronin tablets) was approved by the FDA in June 2022. Also, as of June 30, 2024, three generic options for the 100mg and 300mg versions of Thiola EC have been approved by the FDA and two have become available.

Previous wording

On July 16, 2023, we entered into a definitive asset purchase agreement (the “Purchase Agreement”) with Mirum Pharmaceuticals, Inc. (“Mirum”), pursuant to which we agreed to sell to Mirum, subject to the terms of the Purchase Agreement, our bile acid product portfolio including Chenodal and Cholbam (also known as Kolbam) (the “Products”). The closing of the transaction occurred on August 31, 2023. A portion of the consideration for the sale is in the form of milestone payments that will only be payable upon the achievement of certain milestones based on specified amounts of annual net sales of the Products (the “Milestone Events”). There is a risk that any or all of the Milestone Events might not be achieved and that any or all of the consideration tied to the achievement of the Milestone Events might not be received.

Current wording

From time to time, we engage in corporate transactions and licensing transactions that include potential milestone payments and/or royalties. For example, on July 16, 2023, we entered into a definitive asset purchase agreement (the “Purchase Agreement”) with Mirum Pharmaceuticals, Inc. (“Mirum”), pursuant to which we agreed to sell to Mirum, subject to the terms of the Purchase Agreement, our bile acid product portfolio including Chenodal and Cholbam (also known as Kolbam) (the “Products”). The closing of the transaction occurred on August 31, 2023. A portion of the consideration for the sale is in the form of milestone payments that will only be payable upon the achievement of certain milestones based on specified amounts of annual net sales of the Products We are also party to license agreements with CSL Vifor and Renalys Pharma, Inc. pursuant to which we are entitled to receive certain payments contingent on the future achievement of specified milestones, and royalty payments based on potential future sales in specified licensed territories. There is a risk that any or all of the milestone events under these various agreements might not be achieved, that our licensees may not achieve sales that would entitle us to royalty payments, and that any or all of the consideration tied to the achievement of the milestone events and/or royalties might not be received.

Previous wording

The federal health care program Anti-Kickback Statute prohibits, among other things, knowingly and willfully offering, paying, soliciting, or receiving remuneration to induce or in return for purchasing, leasing, ordering or arranging for the purchase, lease or order of any health care item or service reimbursable under Medicare, Medicaid or other federally financed healthcare programs. This statute has been interpreted broadly to apply to arrangements that pharmaceutical companies have with prescribers, purchasers and formulary managers, among others. Further, the PPACA, among other things, amends the intent requirement of the federal Anti-Kickback Statute so that a person or entity no longer needs to have actual knowledge of this statute or specific intent to violate it. In addition, the PPACA provides that the government may assert that a claim including items or services resulting from a violation of the federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the civil False Claims Act. Although there are a number of statutory exceptions and regulatory safe harbors under the federal Anti-Kickback Statute protecting certain common manufacturer business arrangements and activities from prosecution, the exceptions and safe harbors are drawn narrowly and an arrangement must meet all of the conditions specified in order to be fully protected from scrutiny under the federal Anti-Kickback Statute. We seek to comply with the exceptions and safe harbors whenever possible, but our practices, such as our patient assistance programs and prompt pay discounts with certain customers, may not in all cases meet all of the criteria for protection from Anti-Kickback liability and may be subject to scrutiny.

Current wording

The federal health care program Anti-Kickback Statute prohibits, among other things, knowingly and willfully offering, paying, soliciting, or receiving remuneration to induce or in return for purchasing, leasing, ordering or arranging for the purchase, lease or order of any health care item or service reimbursable under Medicare, Medicaid or other federally financed healthcare programs. This statute has been interpreted broadly to apply to arrangements that pharmaceutical companies have with prescribers, purchasers and formulary managers, among others. Further, the PPACA, among other things, amends the intent requirement of the federal Anti-Kickback Statute so that a person or entity no longer needs to have actual knowledge of this statute or specific intent to violate it. In addition, the PPACA provides that the government may assert that a claim including items or services resulting from a violation of the federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the civil False Claims Act. Although there are a number of statutory exceptions and regulatory safe harbors under the federal Anti-Kickback Statute protecting certain common manufacturer business arrangements and activities from prosecution, the exceptions and safe harbors are drawn narrowly and an arrangement must meet all of the conditions specified in order to be fully protected from scrutiny under the federal Anti-Kickback Statute. We seek to comply with the exceptions and safe harbors whenever possible, but our practices, such as our patient assistance programs and discounts with certain customers, may not in all cases meet all of the criteria for protection from Anti-Kickback liability and may be subject to scrutiny.

Previous wording

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act) and other similar laws (e.g., wiretapping laws). For example, HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and their respective implementing regulations, imposes specific requirements relating to the privacy, security and transmission of individually identifiable health information. Among other things, HITECH, through its implementing regulations, makes certain of HIPAA’s privacy and security standards directly applicable to business associates, defined as a person or organization, other than a member of a covered entity’s workforce, that creates, receives, maintains or transmits protected health information for or on behalf of a covered entity for a function or activity regulated by HIPAA as well as their covered subcontractors.

Current wording

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer health data laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act) and other similar laws (e.g., wiretapping laws). For example, HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and their respective implementing regulations, imposes specific requirements relating to the privacy, security and transmission of individually identifiable health information. Among other things, HITECH, through its implementing regulations, makes certain of HIPAA’s privacy and security standards directly applicable to business associates, defined as a person or organization, other than a member of a covered entity’s workforce, that creates, receives, maintains or transmits protected health information for or on behalf of a covered entity for a function or activity regulated by HIPAA as well as their covered subcontractors.

Previous wording

Additionally, in the past few years, numerous U.S. states—including but not limited to California, Colorado, Connecticut, Texas, Utah and Virginia—have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CPRA”), (collectively “CCPA”), applies to personal data of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices, and afford California residents certain privacy rights related to their personal data, such as those noted below. The CCPA allows for fines for noncompliance (up to $7,500 per intentional violation) and allows private litigants affected by certain data breaches to recover significant statutory damages. The CCPA and other U.S. comprehensive privacy laws exempt some data processed in the context of clinical trials, but these developments increase compliance costs and potential liability with respect to other personal data we maintain about residents in these states. Similar laws are being considered in several other states, as well as at the state and local levels, and we expect more jurisdictions to pass similar laws in the future.

Current wording

Additionally, in the past few years, numerous U.S. states—including but not limited to California, Colorado, Connecticut, Texas, Utah and Virginia—have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CPRA”), (collectively “CCPA”), applies to personal data of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices, and afford California residents certain privacy rights related to their personal data, such as those noted herein. The CCPA allows for fines for noncompliance (up to $7,500 per intentional violation) and allows private litigants affected by certain data breaches to recover significant statutory damages. The CCPA and other U.S. comprehensive privacy laws exempt some data processed in the context of clinical trials, but these laws increase compliance costs and potential liability with respect to other personal data we maintain about residents in these states. Similar laws are being considered in several other states, as well as at the local level, and we expect more jurisdictions to pass similar laws in the future.

Previous wording

In addition, numerous U.S. states—including but not limited to Connecticut, Nevada and Washington—have enacted new laws governing the privacy of consumer health data, including reproductive, sexual orientation, and gender identity privacy rights. For example, Washington’s My Health My Data Act (“MHMD”) broadly defines consumer health data, places restrictions on processing consumer health data (including imposing stringent requirements for consents), provides consumers certain rights with respect to their health data, and creates a private right of action to allow individuals to sue for violations of the law. Other states are considering and may adopt similar laws. California also recently passed a law protecting privacy of abortion-related records and other reproductive healthcare services.

Current wording

In addition, numerous U.S. states—including but not limited to Connecticut, Nevada and Washington—have enacted new laws governing the privacy of consumer health data. For example, Washington’s My Health My Data Act (“MHMD”) broadly defines consumer health data, places restrictions on processing consumer health data (including imposing stringent requirements for consents), provides consumers certain rights with respect to their health data, and creates a private right of action to allow individuals to sue for violations of the law. Other states are considering and may adopt similar laws.

Previous wording

In the ordinary course of business, we may transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area ("EEA") and the United Kingdom ("UK") have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it generally believes are inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border transfer laws, which could make it more difficult to transfer information across jurisdictions or prevent us from conducting business in certain countries. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EU Standard Contractual Clauses ("EU SCCs"), the UK’s International Data Transfer Agreement / International Data Transfer Addendum to the EU SCCs, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the applicable frameworks), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on the Data Privacy Framework to lawfully transfer personal data to the United States.

Current wording

In the ordinary course of business, we may transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area ("EEA") and the United Kingdom ("UK") have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it generally believes are inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border transfer laws, which could make it more difficult to transfer information across jurisdictions or prevent us from conducting business in certain countries. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with these laws, such as the EU Standard Contractual Clauses ("EU SCCs"), the UK’s International Data Transfer Agreement / International Data Transfer Addendum to the EU SCCs, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the applicable frameworks), these mechanisms may be subject to legal challenges, and there is no assurance that we can satisfy or rely on the Data Privacy Framework to lawfully transfer personal data to the United States.

Previous wording

If we are unable to implement a valid compliance mechanism for cross-border personal data transfers, or if the requirements for a legally-compliant transfer are too onerous, we may face significant adverse consequences, including increased exposure to regulatory actions, substantial fines and injunctions against processing or transferring personal data from Europe. Inability to import personal data from Europe to the United States may significantly and negatively impact our business operations, including by limiting our ability to conduct clinical trial activities in Europe and elsewhere; limiting our ability to collaborate with third parties with whom we work (such as CROs, service providers, contractors and other companies) that are subject to such cross-border data transfer or localization laws; the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense; or requiring us to increase our personal data processing capabilities and infrastructure in foreign jurisdictions at significant expense. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activities groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations. The Unites States is also increasingly scrutinizing certain data transfers and may also impose certain data localization requirements.

Current wording

If we are unable to implement a valid compliance mechanism for cross-border personal data transfers, or if the requirements for a legally-compliant transfer are too onerous, we may face significant adverse consequences, including increased exposure to regulatory actions, substantial fines and injunctions against processing or transferring personal data from Europe. Inability to import personal data from Europe to the United States may significantly and negatively impact our business operations, including by limiting our ability to conduct clinical trial activities in Europe and elsewhere; limiting our ability to collaborate with third parties with whom we work (such as CROs, service providers, contractors and other companies) that are subject to such cross-border data transfer or localization laws; the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense; or requiring us to increase our personal data processing capabilities and infrastructure in foreign jurisdictions at significant expense. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activities groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations. Regulators in the United States are also increasingly scrutinizing certain personal data transfers and may impose data localization requirements, for example, the Biden Administration’s executive order Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern.

Previous wording

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps designed to detect, mitigate and remediate vulnerabilities in our information security systems (such as our hardware and/or software, including that of third parties with whom we work), but we may not be able to detect, mitigate, and remediate all such vulnerabilities including on a timely basis. Further, we may experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities. Vulnerabilities could be exploited and result in a security incident.

Current wording

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps designed to detect, mitigate and remediate vulnerabilities in our information security systems (such as our hardware and/or software, including that of third parties with whom we work), but we may not be able to detect, mitigate, and remediate all such vulnerabilities including on a timely basis. It may also be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Further, we may experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities. Vulnerabilities could be exploited and result in a security incident. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems.

Previous wording

Applicable data security and public company disclosure obligations may require us to notify relevant stakeholders of certain security incidents, including affected individuals, customers, regulators and investors. Such disclosures are costly, and the disclosures or the failure to comply with such requirements, could lead to adverse consequences. If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences. These consequences may include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss and other similar harms. For example, the loss of clinical trial data from completed or ongoing clinical trials for any of our product candidates could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data.

Current wording

Applicable data security and public company disclosure obligations may require us, or we may voluntarily choose, to notify relevant stakeholders of certain security incidents, including affected individuals, customers, regulators and investors, or to take other actions, such as providing credit monitoring and identity theft protection services. Such disclosures and related actions can be costly, and the disclosures or the failure to comply with such applicable requirements, could lead to adverse consequences. If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences. These consequences may include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss and other similar harms. For example, the loss of clinical trial data from completed or ongoing clinical trials for any of our product candidates could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data.

Previous wording

position. Sensitive information of us or our customers could also be leaked, disclosed, or revealed as a result of or in connection with our employee’s, personnel’s, or third parties with whom we work use of generative AI technologies.

Current wording

In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Sensitive information of us or our customers could also be leaked, disclosed, or revealed as a result of or in connection with our employee’s, personnel’s, or third parties with whom we work use of generative AI technologies.

Previous wording

Under current law, our federal net operating losses ("NOLs") generated in tax years beginning after December 31, 2017, may be carried forward indefinitely, but the deductibility of such federal NOLs is limited to 80% of taxable income. As of December 31, 2023, we had federal NOLs of $154.3 million. It is uncertain if and to what extent various states will conform to federal tax laws. In addition, under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended, and corresponding provisions of state law, if a corporation undergoes an “ownership change,” which is generally defined as a greater than 50% change, by value, in its equity ownership over a three-year period, the corporation’s ability to use its pre-change NOL carryforwards and other pre-change U.S. tax attributes (such as research tax credits) to offset its post-change income or taxes may be limited. We completed a study to analyze whether any ownership changes occurred through March 31, 2023, and determined no ownership changes occurred. We are in the process of updating our analysis of owner shifts to determine whether an ownership change occurred since March 31, 2023. It is possible that we have experienced an ownership change in the past. In addition, we may experience ownership changes in the future as a result of subsequent shifts in our stock ownership, some of which may be outside of our control.

Current wording

Under current law, our federal net operating losses ("NOLs") generated in tax years beginning after December 31, 2017, may be carried forward indefinitely, but the deductibility of such federal NOL carryforwards in a taxable year is limited to 80% of taxable income in such year. As of December 31, 2023, we had federal NOL carryforwards of $154.3 million. In addition, under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended, and corresponding provisions of state law, if a corporation undergoes an “ownership change,” which is generally defined as a greater than 50% change, by value, in its equity ownership over a three-year period, the corporation’s ability to use its pre-change NOL carryforwards and other pre-change U.S. tax attributes (such as research tax credits) to offset its post-change income or taxes may be limited. We completed a study to analyze whether any ownership changes occurred through December 31, 2023, and determined an ownership change occurred in May of 2023. In addition, we may experience ownership changes in the future as a result of subsequent shifts in our stock ownership, some of which may be outside of our control.

Previous wording

As a result, our federal NOL carryforwards may be subject to a percentage limitation if used to offset income in tax years following an ownership change. In addition, it is possible that we have in the past undergone, and in the future may undergo, additional ownership changes that could limit our ability to use all of our pre-change NOL carryforwards and other pre-change tax attributes (such as research tax credits) to offset our post-change income or taxes. Similar provisions of state tax law may also apply to limit our use of accumulated state tax attributes. In addition, at the state level, there may be periods during which the use of NOL carryforwards is suspended or otherwise limited, which could accelerate or permanently increase state taxes owed. As a result, we may be unable to use all or a material portion of our NOL carryforwards and other tax attributes, which would harm our future operating results by effectively increasing our future tax obligations.

Current wording

As a result, our federal NOL carryforwards may be subject to a percentage limitation if used to offset income in tax years following an ownership change. In addition, it is possible that we have in the past undergone, and in the future may undergo, additional ownership changes that could limit our ability to use all of our pre-change NOL carryforwards and other pre-change tax attributes (such as research tax credits) to offset our post-change income or taxes. Similar provisions of state tax law may also apply to limit our use of accumulated state tax attributes. In addition, at the state level, there may be periods during which the use of NOL carryforwards is suspended or otherwise limited, which could accelerate or permanently increase state taxes owed. For example, California imposed limits on the usability of California state net operating losses to offset taxable income in tax years beginning after 2023 and before 2027.As a result, we may be unable to use all or a material portion of our NOL carryforwards and other tax attributes, which would harm our future operating results by effectively increasing our future tax obligations.