GENELUX Corp

Previous wording

We are a clinical stage biopharmaceutical company, and our operations to date have been focused substantially on organizing and staffing our company, business planning, raising capital, creating, assessing, and developing our technology, establishing our intellectual property portfolio, identifying potential product candidates, undertaking preclinical studies, commencing clinical trials and manufacturing. Additionally, as an organization, we have not yet demonstrated an ability to successfully complete clinical development, obtain regulatory approvals, manufacture a commercial-scale product, or conduct sales and marketing activities necessary for successful commercialization. We have never generated any revenue from commercially approved product sales and have incurred significant operating losses. Our net losses were $7.9 million and $10.4 million for the three months ended March 31, 2024 and 2023, respectively. As of March 31, 2024, we had an accumulated deficit of $229.4 million. We expect to continue to incur significant and increasing operating losses for the foreseeable future. Our prior losses, combined with expected future losses, have had and will continue to have an adverse effect on our stockholders’ deficit and working capital.

Current wording

We are a clinical stage biopharmaceutical company, and our operations to date have been focused substantially on organizing and staffing our company, business planning, raising capital, creating, assessing, and developing our technology, establishing our intellectual property portfolio, identifying potential product candidates, undertaking preclinical studies, commencing clinical trials and manufacturing. Additionally, as an organization, we have not yet demonstrated an ability to successfully complete clinical development, obtain regulatory approvals, manufacture a commercial-scale product, or conduct sales and marketing activities necessary for successful commercialization. We have never generated any revenue from commercially approved product sales and have incurred significant operating losses. Our net losses were $14.4 million and $16.2 million for the six months ended June 30, 2024 and 2023, respectively. As of June 30, 2024, we had an accumulated deficit of $236.1 million. We expect to continue to incur significant and increasing operating losses for the foreseeable future. Our prior losses, combined with expected future losses, have had and will continue to have an adverse effect on our stockholders’ deficit and working capital.

Previous wording

Two investors from our private placements (the “Private Placements”) were contractually obligated to fund $30.0 million on or before November 15, 2023, of which we have received $6.0 million to date. In November 2023, we agreed to extend the funding deadline for $2.0 million of the remaining aggregate investment amounts to March 31, 2024. The investor who was obligated to fund $22.0 million of the remaining committed investment amounts has not made such payments and has indicated that he does not intend to comply with his investment commitments. We are currently evaluating our potential remedies with respect to this investor’s non-compliance with his contractual obligations to us. Besides the Private Placements and the obligations by Newsoara BioPharma Co. Ltd. (“Newsoara”) to provide clinical trial funding under our license agreement with Newsoara (the “Newsoara License Agreement”), we do not have any committed external source of funds or other support for our development efforts. Until we can generate sufficient product revenue to finance our cash requirements, which we may never do, we expect to finance our future cash needs through a combination of public or private equity offerings and debt financings, or other capital sources such as potential collaborations, strategic alliances, licensing arrangements and other arrangements. Based on our research and development plans, we expect that our existing cash balance will enable us to fund our planned operating expenses and capital expenditure requirements for at least the next 12 months from the date of filing of this Quarterly Report. We have based this estimate on assumptions that may prove to be wrong, and we could exhaust our available capital resources sooner than we expect. In addition, because the design and outcome of our anticipated and any future clinical trials is highly uncertain, we cannot reasonably estimate the actual amounts necessary to successfully complete the development and commercialization of Olvi-Vec or any future product candidates. Our existing cash balance may not be sufficient to complete development of Olvi-Vec or any other product candidate. Additionally, although we have commitments from investors to fund the remaining aggregate investment amounts in connection with our Private Placements, we may not receive some or all of the committed proceeds, due to ongoing liquidity constraints or other factors. The failure to receive all or some of the committed proceeds would exhaust our available capital resources sooner than expected and will require us to obtain further funding to achieve our business objectives.

Current wording

Besides the Private Placements and the obligations by Newsoara BioPharma Co. Ltd. (“Newsoara”) to provide clinical trial funding under our license agreement with Newsoara (the “Newsoara License Agreement”), we do not have any committed external source of funds or other support for our development efforts. Until we can generate sufficient product revenue to finance our cash requirements, which we may never do, we expect to finance our future cash needs through a combination of public or private equity offerings and debt financings, or other capital sources such as potential collaborations, strategic alliances, licensing arrangements and other arrangements. Based on our research and development plans, we expect that our existing cash balance will enable us to fund our planned operating expenses and capital expenditure requirements for at least the next 12 months from the date of filing of this Quarterly Report. We have based this estimate on assumptions that may prove to be wrong, and we could exhaust our available capital resources sooner than we expect. In addition, because the design and outcome of our anticipated and any future clinical trials is highly uncertain, we cannot reasonably estimate the actual amounts necessary to successfully complete the development and commercialization of Olvi-Vec or any future product candidates. Our existing cash balance may not be sufficient to complete development of Olvi-Vec or any other product candidate. Additionally, although we have commitments from investors to fund the remaining aggregate investment amounts in connection with our Private Placements, we may not receive some or all of the committed proceeds, due to ongoing liquidity constraints or other factors. The failure to receive all or some of the committed proceeds would exhaust our available capital resources sooner than expected and will require us to obtain further funding to achieve our business objectives.

Previous wording

We began regulatory study startup of a Phase 2, open-label, randomized, and controlled clinical trial designed to evaluate the efficacy and safety of intravenously delivered Olvi-Vec oncolytic vaccinia virus (“VACV”) for patients with recurrent non-small cell lung cancer (“NSCLC”) in the United States in the first half of 2023. Newsoara is generally obligated under the Newsoara License Agreement to fund this trial. In November 2023, we agreed with Newsoara that we would directly engage a contract research organization (“CRO”) on mutually agreeable terms to conduct certain startup activities for the NSCLC trial in the United States only, with Newsoara reimbursing us for the costs and expenses of such agreed-upon startup activities. Newsoara is permitted to defer such reimbursement payments until the completion of its next round of financing, which Newsoara expects to occur in 2024. We plan to conduct this Phase 2 trial under our current open investigational new drug application (“IND”) and to initiate the trial in the United States in the first half of 2024. Subject to regulatory authorization in China, the Company expects Newsoara eventually to add sites in China and for the parties to conduct this study as a multi-regional clinical trial.

Current wording

Newsoara is generally obligated under the Newsoara License Agreement to fund a Phase 2, open-label, randomized, and controlled clinical trial designed to evaluate the efficacy and safety of intravenously delivered Olvi-Vec oncolytic vaccinia virus (“VACV”) for patients with recurrent non-small cell lung cancer (“NSCLC”). In November 2023, we agreed with Newsoara that we would directly engage a contract research organization (“CRO”) on mutually agreeable terms to conduct certain startup activities for the NSCLC trial in the United States only, with Newsoara reimbursing us for the costs and expenses of such agreed-upon startup activities. Newsoara is permitted to defer such reimbursement payments until the completion of its next round of financing, which Newsoara expects to occur in 2024. We expect to report interim results from the NSCLC trial in mid-2025. Subject to regulatory authorization in China, the Company expects Newsoara eventually to add sites in China and for the parties to conduct this study as a multi-regional clinical trial.

Previous wording

We have invested a significant portion of our efforts and financial resources in our oncolytic VACV platform and, in particular, in the development of our lead product candidate, Olvi-Vec. We have completed enrollment for only one Phase 2 clinical trial, an open-label single-arm study, of Olvi-Vec in patients with PRROC in September 2019. Our Phase 3 registration trial of Olvi-Vec in PRROC initiated enrollment in the third quarter of 2022. Our co-sponsored Phase 1/2 clinical trial in SCLC continues to enroll patients in China. We also intend to initiate a Phase 2 clinical trial in patients with NSCLC in the first half of 2024 Olvi-Vec, as well as our other product candidates, are susceptible to the risks of failure inherent at any stage of product development, including the occurrence of unexpected or unacceptable adverse events or the failure to demonstrate efficacy in clinical trials. We will need to successfully complete such trials before submitting a marketing application to the FDA.

Current wording

We have invested a significant portion of our efforts and financial resources in our oncolytic VACV platform and, in particular, in the development of our lead product candidate, Olvi-Vec. We have completed enrollment for only one Phase 2 clinical trial, an open-label single-arm study, of Olvi-Vec in patients with PRROC in September 2019. Our Phase 3 registration trial of Olvi-Vec in PRROC initiated enrollment in the third quarter of 2022. Our co-sponsored Phase 1/2 clinical trial in SCLC continues to enroll patients in China. Our Phase 2, open-label, randomized, and controlled clinical trial designed to evaluate the efficacy and safety of intravenously delivered Olvi-Vec oncolytic VACV for patients with recurrent NSCLC is expected to report interim results in mid-2025. Olvi-Vec, as well as our other product candidates, are susceptible to the risks of failure inherent at any stage of product development, including the occurrence of unexpected or unacceptable adverse events or the failure to demonstrate efficacy in clinical trials. We will need to successfully complete such trials before submitting a marketing application to the FDA.

Previous wording

Following FDA authorization, we began regulatory study startup of a Phase 2, open-label, randomized, and controlled clinical trial designed to evaluate the efficacy and safety of intravenously delivered Olvi-Vec oncolytic VACV for patients with recurrent NSCLC in the United States in the first half of 2023. Newsoara is generally obligated under the Newsoara License Agreement to fund this trial. In November 2023, we agreed with Newsoara that we would directly engage a CRO on mutually agreeable terms to conduct certain startup activities for the NSCLC trial in the United States only, with Newsoara reimbursing us for the costs and expenses of such agreed-upon startup activities. Newsoara is permitted to defer such reimbursement payments until the completion of its next round of financing, which Newsoara expects to occur in 2024.

Current wording

Newsoara is generally obligated under the Newsoara License Agreement to fund a Phase 2, open-label, randomized, and controlled clinical trial designed to evaluate the efficacy and safety of intravenously delivered Olvi-Vec oncolytic VACV for patients with recurrent NSCLC in the United States in the first half of 2023. In November 2023, we agreed with Newsoara that we would directly engage a CRO on mutually agreeable terms to conduct certain startup activities for the NSCLC trial in the United States only, with Newsoara reimbursing us for the costs and expenses of such agreed-upon startup activities. Newsoara is permitted to defer such reimbursement payments until the completion of its next round of financing, which Newsoara expects to occur in 2024.

Previous wording

We have developed a new process for larger-scale manufacturing using a closed, mammalian-cell-based production system. This process is being implemented in our manufacturing facility and is intended to produce Olvi-Vec and other clinical products for use in our subsequent clinical trials and in our commercial launches. We may also make further changes to our manufacturing facilities and processes at various points during development or commercialization, for a number of reasons, such as controlling costs, achieving scale, decreasing processing time, increasing manufacturing success rate or for other reasons. The manufacturing changes could require changes in raw materials, components and services that are obtained from third-party suppliers. The inability of suppliers to provide those supplies or services or delays in acquiring the supplies or services would delay the manufacture of clinical or commercial product supplies.

Current wording

We have developed a new process for larger-scale manufacturing using a closed, mammalian-cell-based production system. This process is being implemented in our manufacturing facility and is intended to produce Olvi-Vec and other clinical products for use in our subsequent clinical trials and in our commercial launches. We may also make further changes to our manufacturing facilities and processes at various points during development or commercialization, for a number of reasons, such as controlling costs, achieving scale, decreasing processing time, increasing manufacturing success rate, improving product quality or for other reasons. The manufacturing changes could require changes in raw materials, components and services that are obtained from third-party suppliers. The inability of suppliers to provide those supplies or services or delays in acquiring the supplies or services would delay the manufacture of clinical or commercial product supplies.

Previous wording

Currently marketed products for ovarian cancer include generic products cisplatin (manufactured by 18 companies), carboplatin (manufactured by 22 companies) and paclitaxel (manufactured by 19 companies), along with the following brand products (and generic manufacturers): Abbvie’s Elahere, Sanofi-Aventis’s Taxotere (17 manufacturers), Celgene Corp.’s Abraxane (one manufacturer), Esai Inc.’s Hexalen, Roche Holding AG’s (Roche)Xeloda, Roche/Genentech, Inc.’s Avastin (four manufacturers), Baxter Healthcare’s Cytoxan andlfex, Etoposide (10 manufacturers), Eli Lilly and Company’s Gemzar (15 manufacturers) and Alimta(14 manufacturers), Pfizer Inc.’s CamPtosar (19 manufacturers), Janssen Pharmaceutical’s Doxil (one manufacturer), Aspen Pharmacare’s Alkeran, Meitheal Pharmaceuticals’s Topotecan, Laboratoires Pierre Fabre’s Navelbine(four manufacturers), GSK’s Zejula, AstraZeneca’s Lynparza, and Clovis Oncology’s Rubraca.

Current wording

Currently marketed products for ovarian cancer include generic products cisplatin (manufactured by 18 companies), carboplatin (manufactured by 22 companies) and paclitaxel (manufactured by 19 companies), along with the following brand products (and generic manufacturers): Abbvie’s Elahere, Sanofi-Aventis’s Taxotere (17 manufacturers), Celgene Corp.’s Abraxane (one manufacturer), Esai Inc.’s Hexalen, Roche Holding AG’s (Roche)Xeloda, Roche/Genentech, Inc.’s Avastin (four manufacturers), Baxter Healthcare’s Cytoxan andlfex, Etoposide (10 manufacturers), Eli Lilly and Company’s Gemzar (15 manufacturers) and Alimta(14 manufacturers), Pfizer Inc.’s CamPtosar (19 manufacturers), Janssen Pharmaceutical’s Doxil (one manufacturer), Aspen Pharmacare’s Alkeran, Meitheal Pharmaceuticals’s Topotecan, Laboratoires Pierre Fabre’s Navelbine(four manufacturers), GSK’s Zejula, AstraZeneca’s Lynparza, and pharmaand GMBH’s Rubraca.

Previous wording

For the core technology in our CHOICE platform and Olvi-Vec and our other product candidates, patents have issued and applications are pending at each of the U.S. provisional, Patent Cooperation Treaty, and national stages with, at a minimum, filings submitted to the United States, European Patent Conventions and Japan. As of March 31, 2024, our patent portfolio consisted of 19 issued U.S. patents, one pending U.S. patent application, 14 issued foreign patents, and six pending foreign patent applications, which relate generally to the composition of our current and potential future products, and their methods of use. V2ACT LLC has exclusive rights to V2ACT Immunotherapy under one issued U.S. patent, one pending U.S. patent application and two pending non-U.S. patent applications. Any future provisional patent applications are not eligible to become issued patents until, among other things, we file a non-provisional patent application within 12 months of filing of one or more of our related provisional patent applications. If we do not timely file any non-provisional patent applications, we may lose our priority date with respect to our provisional patent applications and any patent protection on the inventions disclosed in our provisional patent applications. Although we intend to timely file non-provisional patent applications relating to our provisional patent applications, we cannot predict whether any of our future patent applications will result in the issuance of patents that effectively protect our technology or Olvi-Vec, V2ACT Immunotherapy or our other product candidates, or if any of our future issued patents will effectively prevent others from commercializing competitive products. We may be subject to a third-party pre-issuance submission of prior art to the U.S. Patent and Trademark Office (“USPTO”). Publications of discoveries in the scientific literature often lag behind the actual discoveries, and patent applications in the United States and other jurisdictions are typically not published until 18 months after filing or in some cases not at all until they are issued as a patent. Therefore, we cannot be certain that we were the first to make the inventions claimed in our pending patent applications, or that we were the first to file for patent protection of such inventions.

Current wording

For the core technology in our CHOICE platform and Olvi-Vec and our other product candidates, patents have issued and applications are pending at each of the U.S. provisional, Patent Cooperation Treaty, and national stages with, at a minimum, filings submitted to the United States, European Patent Conventions and Japan. As of June 30, 2024, our patent portfolio consisted of 11 issued U.S. patents, one pending U.S. patent application, 9 issued foreign patents, and six pending foreign patent applications, which relate generally to the composition of our current and potential future products, and their methods of use. V2ACT LLC has exclusive rights to V2ACT Immunotherapy under one issued U.S. patent, one pending U.S. patent application and two pending non-U.S. patent applications. Any future provisional patent applications are not eligible to become issued patents until, among other things, we file a non-provisional patent application within 12 months of filing of one or more of our related provisional patent applications. If we do not timely file any non-provisional patent applications, we may lose our priority date with respect to our provisional patent applications and any patent protection on the inventions disclosed in our provisional patent applications. Although we intend to timely file non-provisional patent applications relating to our provisional patent applications, we cannot predict whether any of our future patent applications will result in the issuance of patents that effectively protect our technology or Olvi-Vec, V2ACT Immunotherapy or our other product candidates, or if any of our future issued patents will effectively prevent others from commercializing competitive products. We may be subject to a third-party pre-issuance submission of prior art to the U.S. Patent and Trademark Office (“USPTO”). Publications of discoveries in the scientific literature often lag behind the actual discoveries, and patent applications in the United States and other jurisdictions are typically not published until 18 months after filing or in some cases not at all until they are issued as a patent. Therefore, we cannot be certain that we were the first to make the inventions claimed in our pending patent applications, or that we were the first to file for patent protection of such inventions.

Previous wording

In the ordinary course of our business, we collect, receive, process, generate, use, transfer, make accessible, protect, secure, dispose of, transmit and store (collectively, “process”) personal data and other sensitive information, including proprietary and confidential business data, intellectual property, trade secrets, clinical trial data and sensitive third-party data. Accordingly, we may be subject to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements and other obligations related to data privacy and security.

Current wording

In the ordinary course of our business, we collect, receive, process, generate, use, transfer, make accessible, protect, secure, dispose of, transmit and store (collectively, “process”) personal data and other sensitive information, including proprietary and confidential business data, intellectual property, trade secrets, data we collect about trial participants in connection with clinical trials and sensitive third-party data. Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements and other obligations relating to data privacy and security.

Previous wording

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), imposes specific requirements relating to the privacy, security, and transmission of individually identifiable protected health information. In the past few years, numerous U.S. states—including California, Virginia, Colorado, Connecticut, and Utah—have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 (“CCPA”), applies to the personal data of consumers, business representatives and employees who are California residents, and requires covered businesses to provide specific disclosures in privacy notices and to honor certain requests of such individuals to exercise certain privacy rights. The CCPA provides for fines of up to $7,500 per intentional violation and allows private litigants affected by certain data breaches to recover significant statutory damages. The CCPA and other comprehensive U.S. state privacy laws exempt some data processed in the context of clinical trials, but these developments may further complicate compliance efforts, and increase legal risk and compliance costs for us and the third parties with whom we work. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future.

Current wording

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), imposes specific requirements relating to the privacy, security, and transmission of individually identifiable protected health information. In the past few years, numerous U.S. states—including California, Virginia, Colorado, Connecticut, and Utah—have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 (“CCPA”) applies to the personal data of consumers, business representatives and employees who are California residents, and requires covered businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for fines of up to $7,500 per intentional violation and allows private litigants affected by certain data breaches to recover significant statutory damages. The CCPA and other comprehensive U.S. state privacy laws exempt some data processed in the context of clinical trials, but these developments may further complicate compliance efforts, and increase legal risk and compliance costs for us, the third parties with whom we work and our customers. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. We may also be subject to new U.S. state laws governing the privacy of consumer health data. For example, Washington’s My Health My Data Act (“MHMD”) broadly defines consumer health data, places restrictions on processing consumer health data (including imposing stringent requirements for consents), provides consumers certain rights with respect to their health data, and creates a private right of action to allow individuals to sue for violations of the law. Other states are considering and may adopt similar laws.

Previous wording

In the ordinary course of business, we may transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area (EEA) and the UK have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it believes are generally inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws.

Current wording

In the ordinary course of business, we may transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area (EEA) and the UK have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it generally believes are inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws.

Previous wording

Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA’s standard contractual clauses, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers for relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States.

Current wording

Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA standard contractual clauses, the UK’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States.

Previous wording

In addition to data privacy and security laws, we are contractually subject to industry standards adopted by industry groups and, we are, or may become subject to obligations in the future. We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. For example, certain privacy laws, such as the GDPR, and the CCPA, require companies to impose specific contractual restrictions on their service providers. Moreover, some clinical trial subjects about whom we or our potential collaborators obtain information, as well as the providers who share this information with us, may contractually limit our ability to use and disclose the information.

Current wording

In addition to data privacy and security laws, we are contractually subject to industry standards adopted by industry groups and, we are, or may become subject to such obligations in the future. We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. For example, certain privacy laws, such as the GDPR, and the CCPA, require our customers to impose specific contractual restrictions on their service providers. Additionally, some of our customer contracts require us to host personal data locally.

Previous wording

Obligations related to data privacy and security (and consumers’ data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires significant resources and may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf.

Current wording

Obligations related to data privacy and security (and consumers’ data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires significant resources, which may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf.

Previous wording

As of March 31, 2024, we had 23 full-time and part-time employees, including 15 employees engaged in research and development and manufacturing. As our development and commercialization plans and strategies develop, we expect to need additional managerial, operational, sales, marketing, financial and other personnel. Future growth would impose significant added responsibilities on members of management, including:

Current wording

As of June 30, 2024, we had 24 full-time and part-time employees, including 16 employees engaged in research and development and manufacturing. As our development and commercialization plans and strategies develop, we expect to need additional managerial, operational, sales, marketing, financial and other personnel. Future growth would impose significant added responsibilities on members of management, including:

Previous wording

Cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties with whom we work. Such threats are prevalent and continue to increase, are becoming increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties with whom we work may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services.

Current wording

Cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties with whom we work. Such threats are prevalent and continue to rise, are becoming increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties with whom we work may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services.

Previous wording

We and the third parties with whom we work are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, attacks enhanced or facilitated by artificial intelligence, and other similar threats. In particular, severe ransomware attacks are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, ability to provide our products or services, disruption of clinical trials, loss of data (including data related to clinical trials) and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.

Current wording

We and the third parties with whom we work are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, attacks enhanced or facilitated by artificial intelligence, and other similar threats. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, ability to provide our products or services, disruption of clinical trials, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.

Previous wording

We rely on third parties service providers to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, information technology infrastructure, cloud-based infrastructure, encryption and authentication technology, employee email, content delivery to customers, and other functions. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If the third parties with whom we work experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or that of the third parties with whom we work have not been compromised.

Current wording

We rely on third parties to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, content delivery to customers, and other functions. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If the third parties with whom we work experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or that of the third parties with whom we work have not been compromised.

Previous wording

Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems or those of the third parties with whom we work. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to provide our products. For example, the loss of clinical trial data from completed or ongoing or planned clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. Our current security measures may be insufficient to prevent or deter such incidents or interruptions. We may expend significant resources or modify our business activities (including our clinical trial activities) to try to protect against security incidents. Certain data privacy and security obligations may require us to implement and maintain specific security measures, industry-standard or reasonable security measures to protect our information technology systems and sensitive information.

Current wording

Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems or those of the third parties with whom we work. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to provide our products. Our current security measures may be insufficient to prevent or deter such incidents or interruptions. We may expend significant resources or modify our business activities (including our clinical trial activities) to try to protect against security incidents. Certain data privacy and security obligations may require us to implement and maintain specific security measures, industry-standard or reasonable security measures to protect our information technology systems and sensitive information.

Previous wording

Applicable data privacy and security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents, orto implement other requirements, such as providing credit monitoring. Such disclosures and compliance with such requirements are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may cause customers to stop or prevent customers from using our products, deter new customers from using our products, and negatively impact our ability to grow and operate our business.

Current wording

Applicable data privacy and security obligations may require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents, or to take other actions, such as providing credit monitoring and identity theft protection services. Such disclosures and related actions can be costly, and the disclosure or the failure to comply with such applicable requirements could lead to adverse consequences. If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may prevent or cause customers to stop using our products, deter new customers from using our products, and negatively impact our ability to grow and operate our business.

Previous wording

Under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended, and corresponding provisions of state law, if a corporation undergoes an “ownership change,” the corporation’s ability to use its pre-change NOL carryforwards and R&D credits to offset its post-change income and taxes, respectively, may be limited. For purposes of these rules, an “ownership change” generally occurs if one or more stockholders or groups of stockholders who own at least 5% of a company’s stock increase their ownership by more than 50 percentage points over their lowest ownership percentage within a rolling three-year period. The application of these rules could limit the amount of NOLs or R&D credit carryforwards that we can utilize annually to offset future taxable income or tax liabilities. In addition, at the state level, there may be periods during which the use of NOLs is suspended or otherwise limited, which could accelerate or permanently increase state taxes owed.

Current wording

Under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended, and corresponding provisions of state law, if a corporation undergoes an “ownership change,” the corporation’s ability to use its pre-change NOL carryforwards and R&D credits to offset its post-change income and taxes, respectively, may be limited. For purposes of these rules, an “ownership change” generally occurs if one or more stockholders or groups of stockholders who own at least 5% of a company’s stock increase their ownership by more than 50 percentage points over their lowest ownership percentage within a rolling three-year period. The application of these rules could limit the amount of NOLs or R&D credit carryforwards that we can utilize annually to offset future taxable income or tax liabilities. In addition, at the state level, there may be periods during which the use of NOLs is suspended or otherwise limited, which could accelerate or permanently increase state taxes owed. For example, California recently imposed limits on the usability of California state NOL carryforwards and certain state tax credits in tax years beginning after 2023 and before 2027.

Previous wording

The stock market in general, and the markets for pharmaceutical, biopharmaceutical and biotechnology stocks in particular, have experienced extreme price and volume fluctuations that have been often unrelated or disproportionate to the operating performance of the issuer. In particular, the trading prices for pharmaceutical, biopharmaceutical and biotechnology companies have been highly volatile, and we note recent instances of extreme stock price run-ups followed by rapid price declines and stock price volatility seemingly unrelated to company performance following a number of recent initial public offerings, particularly among companies with relatively smaller public floats. For example, the daily closing market price for our common stock has varied significantly since the commencement of trading of our common stock on Nasdaq on January 26, 2023, ranging between a high price of $38.00 on June 21, 2023, and a low price of $5.56 on February 3, 2023. During this time, the price per share of common stock has ranged from an intra-day low of $5.35 per share to an intra-day high of $40.98 per share. Since the closing of our IPO, we have not experienced any material changes in our financial condition or results of operations that would explain such price volatility or trading volume. These broad market fluctuations may adversely affect the trading price of our common stock. In particular, a large proportion of our common stock has been and may continue to be traded by short sellers which has put and may continue to put pressure on the supply and demand for our common stock, further influencing volatility in its market price. Additionally, these and other external factors have caused and may continue to cause the market price and demand for our common stock to fluctuate, which may limit or prevent investors from readily selling their shares of common stock and may otherwise negatively affect the liquidity of our common stock.

Current wording

The stock market in general, and the markets for pharmaceutical, biopharmaceutical and biotechnology stocks in particular, have experienced extreme price and volume fluctuations that have been often unrelated or disproportionate to the operating performance of the issuer. In particular, the trading prices for pharmaceutical, biopharmaceutical and biotechnology companies have been highly volatile, and we note recent instances of extreme stock price run-ups followed by rapid price declines and stock price volatility seemingly unrelated to company performance following a number of recent initial public offerings, particularly among companies with relatively smaller public floats. For example, the daily closing market price for our common stock has varied significantly since the commencement of trading of our common stock on Nasdaq on January 26, 2023, ranging between a high price of $38.00 on June 21, 2023, and a low price of $1.60 on August 5, 2024. Since the closing of our IPO, we have not experienced any material changes in our financial condition or results of operations that would explain such price volatility or trading volume. These broad market fluctuations may adversely affect the trading price of our common stock. In particular, a large proportion of our common stock has been and may continue to be traded by short sellers which has put and may continue to put pressure on the supply and demand for our common stock, further influencing volatility in its market price. Additionally, these and other external factors have caused and may continue to cause the market price and demand for our common stock to fluctuate, which may limit or prevent investors from readily selling their shares of common stock and may otherwise negatively affect the liquidity of our common stock.