TELA Bio, Inc.

Previous wording

We have incurred net losses since our incorporation on April 17, 2012. For the years ended December 31, 2023, 2022 and 2021, we had net losses of $46.7 million, $44.3 million and $33.3 million, respectively. As of December 31, 2023, we had an accumulated deficit of $320.9 million.

Current wording

We have incurred net losses since our incorporation on April 17, 2012. For the years ended December 31, 2024, 2023 and 2022, we had net losses of $37.8 million, $46.7 million and $44.3 million, respectively. As of December 31, 2024, we had an accumulated deficit of $358.7 million.

Previous wording

As of December 31, 2023, our commercial organization consisted of 166 employees in the U.S. and 14 employees in Europe. To generate future revenue growth, we plan to expand the size and geographic scope of our direct sales

Current wording

As of December 31, 2024, our commercial organization consisted of 133 employees in the U.S. and 16 employees in Europe. To generate future revenue growth, we plan to continue to expand the size and geographic scope of our direct

Previous wording

organization. This growth may require us to split or adjust existing sales territories, which may adversely affect our ability to retain customers in those territories. Additionally, our future success will depend largely on our ability to continue to hire, train, retain and motivate skilled sales and marketing personnel with significant industry experience and technical knowledge of medical devices and related products. The competition for talented individuals experienced in selling and marketing medical device products is intense, and we cannot assure you that we can assemble or maintain an effective team. We cannot assure you that we will be able to hire and retain additional personnel on favorable or commercially reasonable terms, if at all. Our operating results are directly dependent upon the sales and marketing efforts of our employees. Failure to hire or retain qualified sales and marketing personnel would prevent us from expanding our business and generating revenue. If we are unable to expand our sales and marketing capabilities, we may not be able to effectively commercialize our products, which could have an adverse effect on our business, financial condition and results of operations.

Current wording

sales organization. This growth may require us to split or adjust existing sales territories, which may adversely affect our ability to retain customers in those territories. Additionally, our future success will depend largely on our ability to continue to hire, train, retain and motivate skilled sales and marketing personnel with significant industry experience and technical knowledge of medical devices and related products. The competition for talented individuals experienced in selling and marketing medical device products is intense, and we cannot assure you that we can assemble or maintain an effective team. We cannot assure you that we will be able to hire and retain additional personnel on favorable or commercially reasonable terms, if at all. Our operating results are directly dependent upon the sales and marketing efforts of our employees. Failure to hire or retain qualified sales and marketing personnel would prevent us from expanding our business and generating revenue. If we are unable to expand our sales and marketing capabilities, we may not be able to effectively commercialize our products, which could have an adverse effect on our business, financial condition and results of operations.

Previous wording

Macroeconomic conditions, including the lingering economic effects of the COVID-19 pandemic on hospital systems, may negatively impact certain aspects of our business, our prospects, results of operations and financial condition.

Current wording

Macroeconomic conditions, including those placing financial strain on hospital systems and their ability to perform the procedures in which our products are used, may negatively impact certain aspects of our business, our prospects, results of operations and financial condition.

Previous wording

Macroeconomic conditions, including the lingering economic effects of the COVID-19 pandemic, have negatively impacted our business, results of operations and financial condition, and, if unresolved or exacerbated by inflationary pressures, geopolitical conflict or other macroeconomic events, may adversely impact our business, financial condition and prospects. While the direct impact of COVID-19 and its variants has largely subsided, we cannot predict the severity of any long-term impact stemming from financial and resource strains on the healthcare system, labor and staffing in the hospital sector, and hospital capacity for elective procedures, that resulted from measures taken to address the COVID-19 pandemic. Any prolonged delays in normalized levels of elective surgeries by governmental, hospital or payor actions would continue to impair net sales of our products.

Current wording

Macroeconomic conditions, including those placing financial strain on hospital systems and their ability to perform the procedures in which our products are used, or those stemming from external cybersecurity events, supply chain disruptions of critical surgical supplies, inflationary pressures, tariffs, geopolitical conflict or other macroeconomic events, may adversely impact our business, financial condition and prospects. These financial and resource strains on the healthcare system, including those first arising in response to the COVID-19 pandemic, may further impair labor and staffing in the hospital sector, and in turn hospital capacity for elective procedures. Any prolonged delays in normalized levels of elective surgeries by governmental, hospital or payor actions would continue to impair net sales of our products.

Previous wording

General supply chain disruptions, initially arising from COVID-19, have in the wake of geopolitical turmoil, such as the ongoing Russia-Ukraine conflict and the current conflict in Israel and Gaza (including any escalation or expansion) continued to threaten trade globally and weaken supply systems. We currently rely on Aroa, which is headquartered in New Zealand, for supply of our products. While there have been minimal disruptions to our supply chain to date, there is a risk that in the future supplies of our products could be disrupted or delayed based on competition within the supply chain or otherwise affected by substantial inflationary pressures due to macroeconomic conditions. There can be no assurance that we would be able to timely implement any mitigation plans relating to our supply chain.

Current wording

General supply chain disruptions, initially arising from COVID-19, have in the wake of severe weather events and geopolitical turmoil, such as the ongoing Russia-Ukraine conflict and the current conflict in the Middle East (including any escalation or expansion) continue to threaten trade globally and weaken supply systems. We currently rely on Aroa, which is headquartered in New Zealand, for supply of our products. While there have been minimal disruptions to our supply chain to date, there is a risk that in the future supplies of our products could be disrupted or delayed based on competition within the supply chain or otherwise affected by substantial inflationary pressures from other underlying macroeconomic conditions. There can be no assurance that we would be able to timely implement any mitigation plans relating to our supply chain.

Previous wording

Continued concerns about the systemic impact of potential economic slowdown or recession, liquidity constraints, failures and instability in the U.S. and international financial banking systems, and geopolitical turmoil, including the ongoing Russia-Ukraine conflict and the current conflict in Israel and Gaza (including any escalation or expansion), have contributed to increased market volatility and diminished expectations for economic growth in the world. These conditions may lead to continued volatility in the future, which could result in a decline in our stock price, high inflation, increase our cost of capital and adversely affect our ability to access the capital markets in the future even after local conditions improve.

Current wording

Continued concerns about the systemic impact of potential economic slowdown or recession, liquidity constraints, failures and instability in the U.S. and international financial banking systems, and geopolitical turmoil, including the ongoing Russia-Ukraine conflict and the current conflict in the Middle East (including any escalation or expansion), have contributed to increased market volatility and diminished expectations for economic growth in the world. These conditions may lead to continued volatility in the future, which could result in a decline in our stock price, high inflation, increase our cost of capital and adversely affect our ability to access the capital markets in the future even after local conditions improve.

Previous wording

Market acceptance of our medical products in the U.S. and other countries is dependent upon the procurement practices of our customers, patient need for our products and procedures and the reimbursement of patients’ medical expenses by government healthcare programs and third-party payors. The continuing uncertainty surrounding global economic conditions and financial markets, including the lingering economic impact of the COVID-19 pandemic on our customers, may adversely affect demand for our products and procedures and result in lower reimbursement rates or coverage for our products, resulting in lower sales volume and downward pricing pressure on our products and slower adoption of new products.

Current wording

Market acceptance of our medical products in the U.S. and other countries is dependent upon the procurement practices of our customers, patient need for our products and procedures and the reimbursement of patients’ medical expenses by government healthcare programs and third-party payors. The continuing uncertainty surrounding global economic conditions and financial markets may adversely affect demand for our products and procedures and result in lower reimbursement rates or coverage for our products, resulting in lower sales volume and downward pricing pressure on our products and slower adoption of new products.

Previous wording

Sales of our OviTex products accounted for 67%, 70% and 78% of total revenue for the years ended December 31, 2023, 2022 and 2021, respectively. We first commercialized OviTex products in the U.S. in 2016 and have subsequently launched our OviTex products in Europe, introduced our larger sized OviTex products, our OviTex LPR product for use in laparoscopic and robotic-assisted hernia surgical repairs and larger configurations of our LPR product. In addition to our OviTex products, we have also commercialized our OviTex PRS products for use in surgery for soft-tissue repair or reinforcement in plastic and reconstructive procedures and most recently the LiquiFix Hernia Mesh Fixation Devices (LiquiFix FIX8™ and LiquiFix Precision™) pursuant to our distribution agreement with Advanced Medical Solutions Limited. While we continue to diversify our portfolio and revenue sources, we expect that sales of our OviTex products and our OviTex PRS products will account for the majority of our revenue for the foreseeable future while we continue to grow market share for our OviTex PRS products and other ancillary products that we may develop or distribute from time to time. Our failure to successfully increase sales of these products or any other event impeding our ability to sell these products would result in a material adverse effect on our business, financial condition and results of operations.

Current wording

Sales of our OviTex products accounted for 66%, 67% and 70% of total revenue for the years ended December 31, 2024, 2023 and 2022, respectively. We first commercialized OviTex products in the U.S. in 2016 and have subsequently launched our OviTex products in Europe, introduced our larger sized OviTex products, as well as OviTex LPR and OviTex IHR product configurations for deeper penetration into laparoscopic and robotic-assisted hernia surgical repairs. In addition to our OviTex products, we have also commercialized our OviTex PRS products for use in surgery for soft-tissue repair or reinforcement in plastic and reconstructive procedures and most recently the LIQUIFIX Hernia Mesh Fixation Devices (LIQUIFIX FIX8™ and LIQUIFIX Precision™) pursuant to our distribution agreement with Advanced Medical Solutions Limited. While we continue to diversify our portfolio and revenue sources, we expect that sales of our OviTex products will account for the majority of our revenue for the foreseeable future while we continue to grow market share for our OviTex PRS products, LIQUIFIX and any complementary products that we may develop or distribute from time to time. Our failure to successfully increase sales of these products or any other event impeding our ability to sell these products would result in a material adverse effect on our business, financial condition and results of operations.

Previous wording

Our ability to grow our revenue in future periods will depend on our ability to increase sales of our OviTex and OviTex PRS products and any new product or product indications that we introduce, which will, in turn, depend in part on our success in expanding our customer base and driving increased use of our products. New products or product indications may also need to be approved or cleared by the FDA and comparable non-U.S. regulatory agencies to drive revenue growth. If we cannot achieve revenue growth, it could have a material adverse effect on our business, financial condition and results of operations.

Current wording

Our ability to grow our revenue in future periods will depend on our ability to increase sales of our OviTex in hernia and abdominal wall reconstruction and OviTex PRS products in plastic and reconstructive procedures and any new product or product indications that we introduce, which will, in turn, depend in part on our success in expanding our customer base and driving increased use of our products. New products or product indications may also need to be approved or cleared by the FDA and comparable non-U.S. regulatory agencies to drive revenue growth. If we cannot achieve revenue growth, it could have a material adverse effect on our business, financial condition and results of operations.

Previous wording

marketing them for that use. OviTex PRS or any other product we may develop for use in breast surgery will need to be approved specifically for that indication and there can be no guarantee that it will be approved. We have engaged in discussions with the FDA regarding an IDE protocol to study the safety and effectiveness of our OviTex PRS product for an indication in breast reconstruction surgery. There can be no assurance that we will be able to secure a PMA approval in a timely manner, or at all. Any marketing for OviTex PRS or any other product for a use in breast reconstruction surgery would be deemed off-label promotion of that product if it has been cleared for a general indication of use to reinforce or repair soft-tissue and has not received an approval specifically for use in breast surgery. We train our marketing personnel and direct sales force to not promote our OviTex or OviTex PRS products for uses outside of the FDA-cleared indications for use, known as “off-label uses.” We cannot, however, prevent a surgeon or medical professional from using our OviTex or OviTex PRS products or other products we may commercialize in the future for off-label uses.

Current wording

The products we commercialize have been cleared by the FDA and other regulatory authorities for specific indications. Our OviTex products are reinforced tissue matrices designed for use as a surgical mesh to reinforce and/or repair soft-tissue where weakness exists and indications for use of our OviTex products include the repair of hernia and/or abdominal wall defects which require the use of reinforcing or bridging material to obtain the desired surgical outcome. Our OviTex PRS products are reconstructive reinforced tissue matrices designed for implantation to reinforce soft-tissue where weakness exists in patients requiring soft tissue repair or reinforcement in plastic and reconstructive surgery. In connection with the March 2019 meeting of the General and Plastic Surgery Devices Panel of the Medical Devices Advisory Committee, the FDA stated that no surgical mesh device has been cleared or approved for use in breast surgery, and that to obtain such indication, the product sponsor must obtain an approved PMA. This statement applies to our OviTex PRS products as they are not cleared or approved for use in breast surgery and thus, we are prohibited from marketing them for that use. OviTex PRS or any other product we may develop for use in breast surgery will need to be approved specifically for that indication and there can be no guarantee that it will be approved. In October 2024, we received approval from the FDA for our investigational device exemption application relating to the study of the safety and effectiveness of our OviTex PRS product in implant-based breast reconstruction, but anticipate additional FDA interactions related to identification of an adequate clinical protocol that would be sufficient to support a pre-market application to obtain approval for an indication for OviTex PRS for use in breast reconstruction. There can be no assurance that we will be able to secure a PMA approval in a timely manner, or at all. Any marketing for OviTex PRS or any other product for a use in breast reconstruction surgery would be deemed off-label promotion of that product if it has been cleared for a general indication of use to reinforce or repair soft-tissue and has not received an approval specifically for use in breast surgery. We train our marketing personnel and direct sales force to not promote our OviTex or OviTex PRS products for uses outside of the FDA-cleared indications for use, known as “off-label uses.” We cannot, however, prevent a surgeon or medical professional from using our OviTex or OviTex PRS products or other products we may commercialize in the future for off-label uses.

Previous wording

Even if surgeons or medical professionals use our OviTex and OviTex PRS products only for their approved indications, a failure by such surgeons and medical professionals to use our products in accordance with the processes and procedures established to properly utilize our OviTex and OviTex PRS products could result in product liability lawsuits, costly investigations and potentially affect our ability to achieve sufficient market penetration for our OviTex and OviTex PRS products. In those possible events, our reputation could be damaged and adoption of the products would be impaired. We may also be required to reassess the training, written instructions and product warnings or other labeling information we provide our customers. This process could require us to expend significant time and capital and could have a material adverse effect on our business, financial condition and results of operations and impair our ability to grow our business.

Current wording

Even if surgeons or medical professionals use our OviTex and OviTex PRS products only for their approved indications, a failure by such surgeons and medical professionals to employ proper surgical techniques to handle and use our products in accordance with proper instructions for use could result in product liability lawsuits, costly investigations and potentially affect our ability to achieve sufficient market penetration for our OviTex and OviTex PRS products. In those possible events, our reputation could be damaged and adoption of the products would be impaired. We may also be required to reassess the training, written instructions and product warnings or other labeling information we provide our customers. This process could require us to expend significant time and capital and could have a material adverse effect on our business, financial condition and results of operations and impair our ability to grow our business.

Previous wording

Our ability to successfully commercialize and achieve market acceptance of our products depends, in significant part, on the availability of adequate financial coverage and reimbursement from third-party payors, including governmental payors (such as the Medicare and Medicaid programs in the U.S.), managed care organizations and private health insurers. The primary customers for our products are hospitals and ambulatory surgery centers who will then seek reimbursement from third-party payors for the procedures performed using our products. While some third-party payors currently cover and provide reimbursement for procedures using our currently cleared or approved products, we can give no assurance that these third-party payors will continue to provide coverage and adequate reimbursement for the procedures using our products, to permit hospitals and surgeons to offer procedures using our products to patients requiring treatment, or that current reimbursement levels for procedures using our products will continue. Additionally, no uniform policy for coverage and reimbursement exists in the U.S. and coverage and reimbursement can differ significantly from payor to payor. If third-party payors reverse or limit their coverage for the procedures using our currently cleared or approved products in the future, this could have a material adverse effect on our business. If we are forced to lower the price we charge for our products, this could have a material adverse effect on our business, financial condition and results of operations and impair our ability to grow our business. See the section of this Annual Report titled “Coverage and Reimbursement” for more information.

Current wording

procedures using our products, to permit hospitals and surgeons to offer procedures using our products to patients requiring treatment, or that current reimbursement levels for procedures using our products will continue. Additionally, no uniform policy for coverage and reimbursement exists in the U.S. and coverage and reimbursement can differ significantly from payor to payor. If third-party payors reverse or limit their coverage for the procedures using our currently cleared or approved products in the future, this could have a material adverse effect on our business. If we are forced to lower the price we charge for our products, this could have a material adverse effect on our business, financial condition and results of operations and impair our ability to grow our business. See the section of this Annual Report titled “Coverage and Reimbursement” for more information.

Previous wording

sophisticated methods of controlling healthcare costs, including examining the cost effectiveness of procedures, in addition to their safety and efficacy, when making coverage and payment decisions. Payors continually review new and existing technologies for possible coverage and can, without notice, deny or reverse coverage or alter pre-authorization requirements for new or existing procedures. We cannot provide assurance that we will be successful in any efforts we may potentially undertake to reverse such non-coverage decisions. If we are not successful in reversing non-coverage policies, or if third-party payors that currently cover or reimburse certain procedures reverse or limit their coverage of such procedures in the future, or if other third-party payors issue similar policies, our business could be adversely impacted.

Current wording

Healthcare costs have risen significantly over the past decade, which has resulted in or led to numerous cost reform initiatives. Third-party payors, whether U.S. or non-U.S., or governmental or commercial, are developing increasingly sophisticated methods of controlling healthcare costs, including examining the cost effectiveness of procedures, in addition to their safety and efficacy, when making coverage and payment decisions. Payors continually review new and existing technologies for possible coverage and can, without notice, deny or reverse coverage or alter pre-authorization requirements for new or existing procedures. We cannot provide assurance that we will be successful in any efforts we may potentially undertake to reverse such non-coverage decisions. If we are not successful in reversing non-coverage policies, or if third-party payors that currently cover or reimburse certain procedures reverse or limit their coverage of such procedures in the future, or if other third-party payors issue similar policies, our business could be adversely impacted.

Previous wording

It is important to our business that we continue to enhance our OviTex and OviTex PRS products and develop and introduce new reinforced tissue matrix products. Developing products is expensive and time-consuming and could divert management’s attention away from other aspects of our business. The success of any new reinforced tissue matrix product offering or product enhancements to our OviTex and OviTex PRS products will depend on several factors, including our ability to:

Current wording

It is important to our business that we continue to enhance our OviTex and OviTex PRS products and develop and introduce new reinforced tissue matrix products and complementary soft -tissue reconstruction solutions. Developing products is expensive and time-consuming and could divert management’s attention away from other aspects of our business. The success of any new product offerings or product enhancements to our OviTex and OviTex PRS products will depend on several factors, including our ability to:

Previous wording

Approximately 10%, 8% and 5% of our revenue for the years ended December 31, 2023, 2022 and 2021, respectively, came from sales in markets outside of the U.S. Part of our sales strategy is to maintain our European presence. European sales are subject to a number of risks, including:

Current wording

Approximately 15%, 10% and 8% of our revenue for the years ended December 31, 2024, 2023 and 2022, respectively, came from sales in markets outside of the U.S. Part of our sales strategy is to maintain our European presence. European sales are subject to a number of risks, including:

Previous wording

Under the Aroa License Aroa also holds the FDA clearances under which we commercialize our OviTex and OviTex LPR products, and maintains ultimate responsibility for all regulatory interactions with FDA relating to our OviTex producst, including OviTex LPR and decisions made with respect to changing or updating those clearances. If Aroa fails to comply with all applicable regulatory requirements and maintain the FDA clearances related to our OviTex products, we may be unable to commercialize our OviTex products on a timely basis, or at all. Our ability to supply our OviTex and OviTex PRS products commercially and to develop any future products depends, in part, on our ability to obtain these materials, components and products in accordance with regulatory requirements and in sufficient quantities for commercialization and clinical testing. While Aroa has historically met our demand for its products and services on a timely basis in the past, we cannot guarantee that it will always be able to meet our demand for its products. If Aroa fails to meet demand or notifies us that it believes it will fail to meet demand for our OviTex and OviTex PRS products, we are required under the Aroa License to work with Aroa to cure its supply failure and may, only in certain circumstances and on a temporary basis, engage a replacement contract manufacturer to mitigate a failure by Aroa to meet demand for our OviTex and OviTex PRS products. As such, we are highly dependent upon Aroa’s continued ability to supply our OviTex and OviTex PRS products at the levels we require and any production shortfall that impairs the supply of our

Current wording

commercialization and clinical testing. While Aroa has historically met our demand for its products and services on a timely basis in the past, we cannot guarantee that it will always be able to meet our demand for its products. If Aroa fails to meet demand or notifies us that it believes it will fail to meet demand for our OviTex and OviTex PRS products, we are required under the Aroa License to work with Aroa to cure its supply failure and may, only in certain circumstances and on a temporary basis, engage a replacement contract manufacturer to mitigate a failure by Aroa to meet demand for our OviTex and OviTex PRS products. As such, we are highly dependent upon Aroa’s continued ability to supply our OviTex and OviTex PRS products at the levels we require and any production shortfall that impairs the supply of our OviTex and OviTex PRS products could have a material adverse effect on our business, financial condition and results of operations and adversely affect our ability to satisfy demand for our OviTex and OviTex PRS products, which could adversely affect our product sales and operating results materially.

Previous wording

We may encounter unforeseen situations in Aroa’s manufacturing and assembly of our OviTex and OviTex PRS products that would result in delays or shortfalls in its production. For example, Aroa was unable to supply us with our products from September 2017 to December 2017 due to a quality testing process failure identified by Aroa. Personnel shortages and reduced manufacturing capacity due to the COVID-19 pandemic may also result in a disruption in production.

Current wording

We may encounter unforeseen situations in Aroa’s manufacturing and assembly of our OviTex and OviTex PRS products that would result in delays or shortfalls in its production. For example, Aroa was unable to supply us with our products from September 2017 to December 2017 due to a quality testing process failure identified by Aroa. Any personnel shortages and reduced manufacturing capacity may also result in a disruption in production.

Previous wording

The ovine rumen used in the manufacturing of our products is sourced through Aroa in New Zealand. Although Aroa obtains its supply of ovine rumen from jurisdictions with sheep that are not currently known to carry any prion disease (progressive neurodegenerative disorders, including scrapie disease), there can be no assurance that these flocks will remain prion disease-free or that a future outbreak or presence of other unintended and potentially hazardous agents would not adversely affect our products or patients that may receive them. The geographic concentration of our supply chain increases our vulnerability to disruption due to natural disasters, disease or other events. If there is a disruption in the supply of ovine rumen to our manufacturer and supplier, we may be unable to fulfill customer orders or delay the commercialization of new products.

Current wording

The ovine rumen used in the manufacturing of our products is sourced through Aroa in New Zealand. Although Aroa obtains its supply of ovine rumen from jurisdictions with sheep that are not currently known to carry any prion disease (progressive neurodegenerative disorders, including scrapie disease), there can be no assurance that these flocks will remain prion disease-free or that a future outbreak or presence of other unintended and potentially hazardous agents

Previous wording

We have licensed certain intellectual property rights covering our current products from third parties, including Aroa. We are heavily dependent on our agreements with such third parties for our current products. If, for any reason, one or more of our agreements is terminated or we otherwise lose those rights, it could harm our business. Our license and other agreements impose, and any future collaboration agreements or license agreements we enter into are likely to impose various development, commercialization, funding, milestone, royalty, diligence, sublicensing, insurance, patent prosecution and enforcement or other obligations on us. If we breach any material obligations, or use the intellectual property licensed to us in an unauthorized manner, we may be required to pay damages and the licensor may have the right to terminate the license, which could result in us being unable to develop, manufacture and sell products that are

Current wording

We have licensed certain intellectual property rights covering our current products from third parties, including Aroa. We are heavily dependent on our agreements with such third parties for our current products. If, for any reason, one or more of our agreements is terminated or we otherwise lose those rights, it could harm our business. Our license and other agreements impose, and any future collaboration agreements or license agreements we enter into are likely to impose

Previous wording

We own seventeen issued or allowed U.S. patents and have sixteen pending U.S. patent applications. As of December 31, 2023, we had rights, whether through ownership or licensing, to nineteen issued or allowed U.S. patents, sixteen pending U.S. patent applications, five issued non-U.S. patents and three pending non-U.S. patent applications. Our issued U.S. patents will expire between 2035 and 2041. The licensed patents will expire between 2029 and 2031.

Current wording

We own twenty-three issued or allowed U.S. patents and have twelve pending U.S. patent applications. As of December 31, 2024, we had rights, whether through ownership or licensing, to twenty-five issued or allowed U.S. patents, twelve pending U.S. patent applications, eight issued non-U.S. patents and seven pending non-U.S. patent applications., including six applications under the Patent Cooperation Treaty (“PCT”). Our issued U.S. patents will expire between 2035 and 2041. The licensed patents will expire between 2029 and 2031.

Previous wording

Although an issued patent is presumed valid and enforceable, its issuance is not conclusive as to its validity or its enforceability and it may not provide us with adequate proprietary protection or competitive advantages against competitors with similar products. Competitors could purchase our OviTex or OviTex PRS products and attempt to replicate the competitive advantages we derive from our development efforts, willfully infringe our intellectual property rights, design around the relevant patents, or develop and obtain patent protection for more effective technologies, designs or methods. We may be unable to prevent the unauthorized disclosure or use of our technical knowledge or trade secrets by consultants, suppliers, vendors, former employees and current employees. The laws of some non-U.S.

Current wording

competitors with similar products. Competitors could purchase our OviTex or OviTex PRS products and attempt to replicate the competitive advantages we derive from our development efforts, willfully infringe our intellectual property rights, design around the relevant patents, or develop and obtain patent protection for more effective technologies, designs or methods. We may be unable to prevent the unauthorized disclosure or use of our technical knowledge or trade secrets by consultants, suppliers, vendors, former employees and current employees. The laws of some non-U.S. countries do not protect our proprietary rights to the same extent as the laws of the U.S., and we may encounter significant problems in protecting our proprietary rights in these countries.

Previous wording

Moreover, we may become party to adversarial proceedings regarding our or third-party patent portfolios. Such proceedings could include supplemental examination or contested post-grant proceedings such as review, reexamination, inter partes review, interference or derivation proceedings before the U.S. Patent and Trademark Office (“USPTO”) and challenges in U.S. District Courts. Patents may be subjected to opposition, post-grant review or comparable proceedings lodged in various foreign, both national and regional, patent offices. The legal threshold for initiating litigation or contested proceedings may be low, so that even lawsuits or proceedings with a low probability of success might be

Current wording

Moreover, we may become party to adversarial proceedings regarding our or third-party patent portfolios. Such proceedings could include supplemental examination or contested post-grant proceedings such as review, reexamination, inter partes review, interference or derivation proceedings before the U.S. Patent and Trademark Office (“USPTO”) and challenges in U.S. District Courts. Patents may be subjected to opposition, post-grant review or comparable proceedings lodged in various foreign, both national and regional, patent offices. The legal threshold for initiating litigation or contested proceedings may be low, so that even lawsuits or proceedings with a low probability of success might be initiated. Litigation and contested proceedings can also be expensive and time-consuming, and our adversaries in these proceedings may have the ability to dedicate substantially greater resources to prosecuting these legal actions than we can. We may also occasionally use these proceedings to challenge the patent rights of others. We cannot be certain that any particular challenge will be successful in limiting or eliminating the challenged patent rights of the third party.

Previous wording

Even if we were ultimately to prevail, any of these events could require us to divert substantial financial and management resources that we would otherwise be able to devote to our business. Intellectual property litigation, regardless of its outcome, may cause negative publicity, adversely impact prospective customers, cause product shipment delays, or prohibit us from manufacturing, importing, marketing or otherwise commercializing our products, services and technology. In addition, if the breadth or strength of protection provided the patents and patent applications we own or in-license is threatened, it could dissuade companies from collaborating with us to license, develop or commercialize current or future products. In addition, because of the substantial amount of discovery required in connection with intellectual property litigation, there is a risk that some of our confidential information could be compromised by disclosure during this type of litigation. There could also be public announcements of the results of hearings, motions or other interim proceedings or developments, and if securities analysts or investors view these announcements in a negative light, the price of our common stock could be adversely affected.

Current wording

Even if we were ultimately to prevail, any of these events could require us to divert substantial financial and management resources that we would otherwise be able to devote to our business. Intellectual property litigation, regardless of its outcome, may cause negative publicity, adversely impact prospective customers, cause product shipment delays, or prohibit us from manufacturing, importing, marketing or otherwise commercializing our products, services and technology. In addition, if the breadth or strength of protection provided the patents and patent applications we own or in-license is threatened, it could dissuade companies from collaborating with us to license, develop or commercialize current or future products. In addition, because of the substantial amount of discovery required in connection with intellectual property litigation, there is a risk that some of our confidential information could be

Previous wording

Filing, prosecuting and defending patents covering our products in all countries throughout the world would be prohibitively expensive, and the laws of some foreign countries do not protect intellectual property rights to the same extent as the laws of the U.S. Many companies have encountered significant problems in protecting and defending intellectual property rights in certain foreign jurisdictions. This could make it difficult for us to stop infringement of our foreign patents, if obtained, or the misappropriation of our other intellectual property rights. For example, some foreign countries have compulsory licensing laws under which a patent owner must grant licenses to third parties. In addition, some countries limit the enforceability of patents against third parties, including government agencies or government contractors. In these countries, patents may provide limited or no benefit. Patent protection must ultimately be sought on a country-by-country basis, which is an expensive and time-consuming process with uncertain outcomes. Accordingly, we may choose not to seek patent protection in certain countries, and we will not have the benefit of patent protection in such countries. Additionally, in the event that our trademarks are successfully challenged, we could be forced to rebrand our products, which could result in loss of brand recognition and could require us to devote resources to advertising and

Current wording

Filing, prosecuting and defending patents covering our products in all countries throughout the world would be prohibitively expensive, and the laws of some foreign countries do not protect intellectual property rights to the same extent as the laws of the U.S. Many companies have encountered significant problems in protecting and defending intellectual property rights in certain foreign jurisdictions. This could make it difficult for us to stop infringement of our foreign patents, if obtained, or the misappropriation of our other intellectual property rights. For example, some foreign countries have compulsory licensing laws under which a patent owner must grant licenses to third parties. In addition, some countries limit the enforceability of patents against third parties, including government agencies or government contractors. In these countries, patents may provide limited or no benefit. Patent protection must ultimately be sought on

Previous wording

In the U.S., Aroa has obtained and holds 510(k) clearances from the FDA to market our OviTex products and obtained the 510(k) clearances from the FDA held by us for our first two OviTex PRS products, while we obtained and hold the 510(k) clearance for our OviTex PRS Long-Term Resorbable product. An element of our strategy is to continue to upgrade our reinforced tissue matrix products. We expect that any such modifications may require new 510(k) clearances; however, future modifications may be subject to the substantially more costly, time-consuming and uncertain PMA process. The FDA will require a PMA, rather than a 510(k) clearance for the use of OviTex PRS in breast surgery. If the FDA requires us to go through a lengthier, more rigorous examination for future products or modifications to existing products than we had expected, product introductions or modifications could be delayed or canceled, which could cause our sales to decline.

Current wording

In the U.S., Aroa has obtained and holds 510(k) clearances from the FDA to market our OviTex products and obtained the 510(k) clearances from the FDA held by us for our first two OviTex PRS products, while we obtained and hold the 510(k) clearance for our OviTex PRS Long-Term Resorbable product. An element of our strategy is to continue to upgrade our reinforced tissue matrix products. We expect that any such modifications may require new 510(k) clearances; however, future modifications may be subject to the substantially more costly, time-consuming and uncertain PMA process. The FDA will require a PMA, rather than a 510(k) clearance for the use of OviTex PRS in breast reconstruction. If the FDA requires us to go through a lengthier, more rigorous examination for future products or modifications to existing products than we had expected, product introductions or modifications could be delayed or canceled, which could cause our sales to decline.

Previous wording

To sell our products in member countries of the EEA our products must comply with the general safety and performance requirements of the EU Medical Devices Regulation (Regulation 2017/745) (“MDR”), which was passed by the EU Parliament on April 5, 2017, and became effective on May 26, 2021. The MDR repeals and replaces the former Medical Devices Directive (Council Directive 93/42/EEC) and the Active Implantable Medical Devices Directive (Council Directive 90/385/EEC). Compliance with the new MDR requirements is a prerequisite to be able to affix the Conformité Européenne, or CE, mark to our products, without which they cannot be sold or marketed in the EEA. In the EEA, we have obtained the CE mark for our OviTex products. For more information regarding regulation of our products, see “Business—Government Regulation.”

Current wording

To sell our products in member countries of the EEA our products must comply with the general safety and performance requirements of the EU MDR, which became effective on May 26, 2021. Compliance with the new MDR requirements is a prerequisite to be able to affix the Conformité Européenne, or CE, mark to our products, without which they cannot be sold or marketed in the EEA. In the EEA, we have obtained the CE mark for our OviTex products. For more information regarding regulation of our products, see “Business—Government Regulation.”

Previous wording

An element of our strategy is to continue to add new features and expand the indications and uses for our current products. Any modification to a 510(k)-cleared device that could significantly affect its safety or effectiveness, or that would constitute a major change in its intended use, design or manufacture, requires a new 510(k) clearance or, possibly, approval of a PMA. The FDA requires every manufacturer to make this determination in the first instance, but the FDA may review any manufacturer’s decision. The FDA may not agree with our decisions regarding whether new clearances or approvals are necessary. Such modifications can be expensive and uncertain in time and outcome. We may not be able to obtain additional 510(k) clearances or PMAs for new products or for modifications to, or additional indications for, our products in a timely fashion, or at all. Delays in obtaining required future clearances or approvals would adversely affect our ability to introduce new or enhanced products in a timely manner, which in turn would harm our future growth. We have made modifications to our products in the past and expect to make additional modifications in the future that we believe do not or will not require additional clearances or approvals. If the FDA disagrees and requires new clearances or approvals for these modifications, we may be required to recall and to stop selling or marketing such products as modified until we obtain clearance or approval, which could harm our operating results and require us to

Current wording

An element of our strategy is to continue to add new features and expand the indications and uses for our current products. Any modification to a 510(k)-cleared device that could significantly affect its safety or effectiveness, or that would constitute a major change in its intended use, design or manufacture, requires a new 510(k) clearance or, possibly, approval of a PMA. The FDA requires every manufacturer to make this determination in the first instance, but the FDA may review any manufacturer’s decision. The FDA may not agree with our decisions regarding whether new clearances or approvals are necessary. Such modifications can be expensive and uncertain in time and outcome. We may not be able to obtain additional 510(k) clearances or PMAs for new products or for modifications to, or additional indications for, our products in a timely fashion, or at all. Delays in obtaining required future clearances or approvals would adversely affect our ability to introduce new or enhanced products in a timely manner, which in turn would harm our future growth. We have made modifications to our products in the past and expect to make additional modifications in the future that we believe do not or will not require additional clearances or approvals. If the FDA disagrees and requires new clearances or approvals for these modifications, we may be required to recall and to stop selling or marketing such products as modified until we obtain clearance or approval, which could harm our operating results and require us to redesign such products. In these circumstances, we may be subject to significant enforcement actions, including significant fines or penalties.

Previous wording

We are subject to the FDA’s medical device reporting regulations and similar EU and other foreign regulations, which require us to report to the FDA when we receive or become aware of information that reasonably suggests that one or more of our products may have caused or contributed to a death or serious injury or malfunctioned in a way that, if the malfunction were to recur, could cause or contribute to a death or serious injury. The timing of our obligation to report is triggered by the date we become aware of the adverse event as well as the nature of the event. We may fail to report adverse events of which we become aware within the prescribed timeframe. We may also fail to recognize that we have become aware of a reportable adverse event, especially if it is not reported to us as an adverse event or if it is an adverse

Current wording

We are subject to the FDA’s medical device reporting regulations and similar EU and other foreign regulations, which require us to report to the FDA when we receive or become aware of information that reasonably suggests that one or more of our products may have caused or contributed to a death or serious injury or malfunctioned in a way that, if the malfunction were to recur, could cause or contribute to a death or serious injury. The timing of our obligation to report is triggered by the date we become aware of the adverse event as well as the nature of the event. We may fail to report adverse events of which we become aware within the prescribed timeframe. We may also fail to recognize that we have become aware of a reportable adverse event, especially if it is not reported to us as an adverse event or if it is an adverse event that is unexpected or removed in time from the use of the product. If we fail to comply with our reporting obligations, the FDA could take action, including untitled letters, warning letters, administrative actions, criminal

Previous wording

event that is unexpected or removed in time from the use of the product. If we fail to comply with our reporting obligations, the FDA could take action, including untitled letters, warning letters, administrative actions, criminal prosecution, imposition of civil monetary penalties, revocation of related approvals, seizure of our products or delay in clearance or approval of future products.

Current wording

prosecution, imposition of civil monetary penalties, revocation of related approvals, seizure of our products or delay in clearance or approval of future products.

Previous wording

On April 5, 2017, the European Parliament passed the Medical Devices Regulation (Regulation 2017/745), which repeals and replaces the EU Medical Devices Directive and the Active Implantable Medical Devices Directive. Unlike directives, which must be implemented into the national laws of the EEA member states, the regulations would be directly applicable, i.e., without the need for adoption of EEA member state laws implementing them, in all EEA member states and are intended to eliminate current differences in the regulation of medical devices among EEA member states. The Medical Devices Regulation is intended to, among other things, establish a uniform, transparent, predictable and sustainable regulatory framework across the EEA for medical devices and ensure a high level of safety and health while supporting innovation.

Current wording

In the EU, the MDR repealed and replaced the MDD on May 26, 2021. There is a transition period during which certificates issued under the MDD remain valid, subject to compliance with certain requirements under the MDR (e.g. having put in place a quality management system in accordance with the MDR by May 26, 2024). The Medical Devices Regulation is intended to, among other things, establish a uniform, transparent, predictable and sustainable regulatory framework across the EEA for medical devices and ensure a high level of safety and health while supporting innovation.

Previous wording

The MDR became fully effective on May 26, 2021. It includes new regulations which, among other things:

Current wording

The MDR introduces new regulations which, among other things:

Previous wording

Disruptions at the FDA and other agencies may also slow the time necessary for new devices to be reviewed and/or approved or cleared by necessary government agencies, which would adversely affect our business. For example, over the last several years, the U.S. government has shut down several times and certain regulatory agencies, such as the FDA, have had to furlough critical FDA employees and stop critical activities. If a prolonged government shutdown occurs, it could significantly impact the ability of the FDA to timely review and process our regulatory submissions, which could have a material adverse effect on our business.

Current wording

Disruptions at the FDA and other agencies may also slow the time necessary for new devices to be reviewed and/or approved or cleared by necessary government agencies, which would adversely affect our business. For example, over the last several years, the U.S. government has shut down several times and certain regulatory agencies, such as the FDA, have had to furlough critical FDA employees and stop critical activities. Currently, federal agencies in the U.S. are operating under a continuing resolution that is set to expire at the end of September 2025. A prolonged government shutdown, significant leadership, personnel, and/or policy changes, or other substantial modification in agency activities

Previous wording

Our current and future operations with respect to the commercialization of our products are subject to various U.S. federal and state healthcare laws and regulations. These laws impact, among other things, our proposed sales, marketing, support and education programs and constrain our business and financial arrangements and relationships with third-party payors, surgeons and other healthcare professionals. For more information, see the sections entitled “Business –

Current wording

Our current and future operations with respect to the commercialization of our products are subject to various U.S. federal and state healthcare laws and regulations. These laws impact, among other things, our proposed sales, marketing, support and education programs and constrain our business and financial arrangements and relationships with third-party payors, surgeons and other healthcare professionals. For more information, see the sections entitled “Business – Government Regulation* – Anti-Kickback Statutes, – False Claims Laws; – Transparency Laws; and – Other Federal Healthcare Fraud and Abuse Laws*” in this Annual Report.

Previous wording

If our operations are found to be in violation of any of these laws or any other governmental regulations that may apply to us, we may be subject to significant civil, criminal and administrative penalties, damages, fines, imprisonment, exclusion from government funded healthcare programs, such as Medicare and Medicaid, additional oversight and reporting requirements if we become subject to a corporate integrity agreement to resolve allegations of non-compliance with these laws and the curtailment or restructuring of our operations. If any of the physicians or other providers or entities with whom we expect to do business is found not to be in compliance with applicable laws, they may be subject to the same criminal, civil or administrative sanctions, including exclusions from government funded healthcare programs.

Current wording

If our operations are found to be in violation of any of these laws or any other governmental regulations that may apply to us, we may be subject to significant civil, criminal and administrative penalties, damages, fines, imprisonment, exclusion from government funded healthcare programs, such as Medicare and Medicaid, additional oversight and reporting requirements if we become subject to a corporate integrity agreement to resolve allegations of non-compliance with these laws and the curtailment or restructuring of our operations. If any of the physicians or other providers or entities with whom we expect to do business is found not to be in compliance with applicable laws, they may be subject

Previous wording

laws and regulations. We also face risks inherent in handling large volumes of data and in protecting the security of such data. We could be subject to attacks on our systems by outside parties or fraudulent or inappropriate behavior by our service providers or employees. Third parties may also gain access to users’ accounts using stolen or inferred credentials, computer malware, viruses, spamming, phishing attacks or other means, and may use such access to obtain users’ personal data or prevent use of their accounts. Further, our general liability insurance and corporate risk program may not cover all potential claims to which we are exposed and may not be adequate to indemnify us for all liability that may be imposed.

Current wording

Our business processes personal data, including some data related to health. When conducting clinical trials, we face risks associated with collecting trial participants’ data, especially health data, in a manner consistent with applicable laws and regulations. We also face risks inherent in handling large volumes of data and in protecting the security of such data. We could be subject to attacks on our systems by outside parties or fraudulent or inappropriate behavior by our service providers or employees. Third parties may also gain access to users’ accounts using stolen or inferred credentials, computer malware, viruses, spamming, phishing attacks or other means, and may use such access to obtain users’ personal data or prevent use of their accounts. Further, our general liability insurance and corporate risk program may not cover all potential claims to which we are exposed and may not be adequate to indemnify us for all liability that may be imposed.

Previous wording

As our operations and business grow, we may become subject to or affected by new or additional data protection laws and regulations and face increased scrutiny or attention from regulatory authorities. In the U.S., HIPAA imposes, among other things, certain standards relating to the privacy, security, transmission and breach reporting of individually identifiable health information. Certain states have also adopted comparable privacy and security laws and regulations, some of which may be more stringent than HIPAA. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. In addition, California enacted the CCPA on June 28, 2018, which took effect on January 1, 2020. The CCPA created individual privacy rights for California consumers and increased the privacy and security obligations of entities handling certain personal data. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches in certain instances that is expected to increase data breach litigation. The CCPA may increase our compliance costs and potential liability, and many similar laws have been proposed at the federal level and in other states. Additionally, the California Privacy Rights Act, or the CPRA, took effect in most material respects on January 1, 2023. The CPRA modifies the CCPA significantly, potentially resulting in further uncertainty and requiring us to incur additional costs and expenses to comply. A failure to comply with these current or future federal and state laws and regulations and industry standards relating to data privacy and security could lead to investigatory or regulatory action, private litigation or class actions that could result in exposure to civil or criminal penalties, monetary or statutory damages, attorney fee awards and/or exposure to adverse publicity that could negatively affect our operating results and business.

Current wording

As our operations and business grow, we may become subject to or affected by new or additional data protection laws and regulations and face increased scrutiny or attention from regulatory authorities. In the U.S., HIPAA imposes, among other things, certain standards relating to the privacy, security, transmission and breach reporting of individually identifiable health information. Certain states have also adopted comparable privacy and security laws and regulations, some of which may be more stringent than HIPAA. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. Further, led by California, with its CCPA, which created individual privacy rights for California residents and increased the privacy and security obligations of entities handling certain personal data, a great number of states have passed comprehensive privacy laws. These laws may increase our compliance costs and potential liability. Further, similar laws have been proposed in numerous other states and privacy-related laws have also been proposed at the federal level. There are also states that are specifically regulating health information. For example, Washington’s My Health My Data Act, which went into effect in March 2024, requires regulated entities to obtain consent to collect health information, grants consumers certain rights, including to request deletion, and provides for robust enforcement mechanisms, including enforcement by the state attorney-general and by litigants through a private right of action for consumer claims. These current and future data privacy laws and regulations may require us to modify our data collection or processing practices and policies, incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement, reputational damage, and/or litigation.

Previous wording

This risk is enhanced in certain jurisdictions as we expand our operations internationally. The EU’s GDPR became effective in May 2018. The GDPR applies extraterritorially and imposes several stringent requirements for controllers and processors of personal data, of data subjects residing in the European Economic Area. For example, the GDPR imposes higher standards for obtaining consent from individuals to process their personal data, more robust disclosures to individuals and a strengthened individual data rights regime, shortened timelines for data breach notifications, limitations on retention of information, increased requirements pertaining to special categories of personal data and pseudonymised (i.e., key-coded) data and additional obligations when we contract third-party processors in connection with the processing of the personal data. This risk is increased because EU member states have made their own laws and regulations limiting the processing of personal data, including special categories of data (e.g., racial or ethnic origin, political opinions, religious or philosophical beliefs) and profiling and automated individual decision-making of individuals, which limits our ability to process personal data or other data and could cause our compliance costs and liability risks to increase, harming our business and financial condition.

Current wording

This risk is enhanced in certain jurisdictions as we expand our operations internationally. The EU’s GDPR became effective in May 2018. The GDPR applies extraterritorially and imposes several stringent requirements for controllers and processors of personal data, of data subjects residing in the European Economic Area. For example, the GDPR imposes higher standards for obtaining consent from individuals to process their personal data (where consent is required), more robust disclosures to individuals and a strengthened individual data rights regime, shortened timelines for data breach notifications, limitations on retention of information, increased requirements pertaining to special categories of personal data and pseudonymised (i.e., key-coded) data and additional obligations when we contract third-party processors in connection with the processing of the personal data. This risk is increased because EU member states have made their own laws and regulations limiting the processing of personal data, including special categories of data (e.g., racial or ethnic origin, political opinions, religious or philosophical beliefs) and profiling and automated individual decision-making of individuals, which limits our ability to process personal data or other data and could cause our compliance costs and liability risks to increase, harming our business and financial condition.

Previous wording

Further, the United Kingdom’s exit from the European Union, referred to as Brexit, has created uncertainty regarding data protection regulation in the United Kingdom. The United Kingdom has transposed the GDPR into domestic law with a United Kingdom version of the GDPR that took effect in January 2021 (UK GDPR). Currently, the EU GDPR and UK GDPR remain largely aligned, but the UK has announced plans to reform the country’s data protection legal framework in its Data Reform Bill, which will introduce significant changes from the EU GDPR. This may lead to additional compliance costs and could increase our overall risk exposure as we may no longer be able to take a unified approach across the EEA and the UK, and we will need to amend our processes and procedures to align with the new framework. Non-compliance with GDPR, and UK GDPR, is subject to significant penalties, including fines of up to €20.0 million (£17.5 million under UK GDPR) or 4% of total worldwide revenue, whichever is greater. The implementation and enforcement of the GDPR (and UK GDPR) may subject us to enforcement risk and requirements to change certain of our data collection, processing and other policies and practices. We could incur significant costs investigating and defending such claims and, if we are found liable, significant damages. If any of these events were to occur, our business and financial results could be adversely affected. Other jurisdictions outside the EU and the United

Current wording

Further, the United Kingdom’s exit from the European Union, referred to as Brexit, has created uncertainty regarding data protection regulation in the United Kingdom. The United Kingdom has transposed the GDPR into domestic law with a United Kingdom version of the GDPR that took effect in January 2021 (UK GDPR). Currently, the EU GDPR and UK GDPR remain largely aligned, but the UK announced plans to reform the country’s data protection legal framework in its Data Reform Bill, which failed in the legislative process. A new Data (Use and Access) Bill, or UK Bill, has been introduced into parliament. If passed, the final version of the UK Bill may have the effect of further altering the similarities between the UK and EU data protection regime and threaten the UK adequacy decision from the EU Commission. This may lead to additional compliance costs and could increase our overall risk exposure as we may no longer be able to take a unified approach across the EEA and the UK, and we will need to amend our processes and procedures to align with the new framework. Non-compliance with GDPR, and UK GDPR, is subject to significant penalties, including fines of up to €20.0 million (£17.5 million under UK GDPR) or 4% of total worldwide revenue, whichever is greater. The implementation and enforcement of the GDPR (and UK GDPR) may subject us to enforcement risk and requirements to change certain of our data collection, processing and other policies and practices. We could incur significant costs investigating and defending such claims and, if we are found liable, significant damages. If any of these events were to occur, our business and financial results could be adversely affected. Other jurisdictions outside the EU and the United Kingdom are similarly introducing or enhancing laws and regulations relating to privacy and data security, which enhances risks relating to compliance with such laws.

Previous wording

The GDPR also regulates cross-border transfers of personal data and requires transferee countries to have protections equivalent to protections available in the EU. The GDPR imposes strict rules on the transfer of personal data to countries outside the EEA, Switzerland or the United Kingdom, including the United States, to other countries in respect of which the European Commission or the United Kingdom government has not issued a so-called “adequacy decision” or “ adequacy regulation” (known as “third countries”), unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data. This includes putting in place the European Commission’s Standard Contractual Clauses (SCCs) for transfers outside of the EEA and a similar transfer mechanism for transfers of personal data outside of the United Kingdom, the International Data Transfer Agreement or Addendum (IDTA). Under both the GDPR and the UK GDPR, exporters are also required to assess the risk of the data transfer on a case-by-case basis, including conducting an analysis of the laws in the destination country. The SCCs had to be in place by December 27, 2022, whereas the IDTA had to be implemented in all existing contracts by March 21, 2024. Finalizing the implementation of the updated SCCs and UK IDTA, and conducting the required risk assessments, may continue to necessitate significant contractual overhaul of our data transfer arrangements with customers, sub-processors and vendors. On June 28, 2021, the European Commission published its decision recognizing the United Kingdom as having adequate laws to the protect the rights and freedoms of data subjects such that personal data may transfer to from the EU to the United Kingdom without an approved transfer mechanism. The decision is effective for four years and its continuing effect is dependent on United Kingdom and regulation on data privacy not diverging materially from the GDPR. The United Kingdom Government also confirmed that data transfers to the EU remain free flowing.

Current wording

The GDPR also regulates cross-border transfers of personal data and requires transferee countries to have protections equivalent to protections available in the EU. The GDPR imposes strict rules on the transfer of personal data to countries outside the EEA, Switzerland or the United Kingdom, including the United States, to other countries in respect of which the European Commission or the United Kingdom government has not issued a so-called “adequacy decision” or “ adequacy regulation” (known as “third countries”), unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data. This includes putting in place the European Commission’s Standard Contractual Clauses (SCCs) for transfers outside of the EEA and a similar transfer mechanism for transfers of personal data outside of the United Kingdom, the International Data Transfer Agreement or Addendum (IDTA). Under both the GDPR and the UK GDPR, exporters are also required to assess the risk of the data transfer on a case-by-case basis, including conducting an analysis of the laws in the destination country. Finalizing the implementation of the updated SCCs and UK IDTA, and conducting the required risk assessments, may continue to necessitate significant contractual overhaul of our data transfer arrangements with customers, sub-processors and vendors. On June 28, 2021, the European Commission published its decision recognizing the United Kingdom as having adequate laws to the protect the rights and freedoms of data subjects such that personal data may transfer to from the EU to the United Kingdom without an approved transfer mechanism. The United Kingdom Government also confirmed that data transfers to the EU remain free flowing.