Krystal Biotech, Inc.

Previous wording

Although we received approval from the FDA for VYJUVEK for the treatment of DEB on May 19, 2023, we can provide no assurances that we will obtain regulatory approval in any other jurisdiction, which would have an adverse impact on our results of operations. In addition, the successful commercialization of VYJUVEK will depend on a number of factors, including the risks identified in these “Risk Factors.” One or more of these factors, many of which are beyond our control, could cause significant delays or an inability to successfully commercialize VYJUVEK.

Current wording

Although we received approval from the FDA and the European Commission for VYJUVEK for the treatment of DEB, we can provide no assurances that we will obtain regulatory approval in any other jurisdiction, which would have an adverse impact on our results of operations. In addition, the successful commercialization of VYJUVEK will depend on a number of factors and involves risk, including some of the risks identified in these “Risk Factors.” One or more of these factors, many of which are beyond our control could cause significant delays or an inability to successfully commercialize VYJUVEK.

Previous wording

The Patient Protection and Affordable Care Act, as amended by the Health Care and Education Reconciliation Act of 2010 (collectively, the “ACA”) includes a subtitle called the Biologics Price Competition and Innovation Act of 2009 (“BPCIA”), which created an abbreviated approval pathway for biological products that are biosimilar to or interchangeable with an FDA-licensed reference biological product. Under the BPCIA, an application for a biosimilar product may not be submitted to the FDA until four years following the date that the reference product was first licensed by the FDA. In addition, the approval of a biosimilar product may not be made effective by the FDA until 12 years from the date on which the reference product was first licensed. During this 12-year period of exclusivity, another company may still market a competing version of the reference product if the FDA approves a Biologics License Application, or BLA, for the competing product containing the sponsor’s own preclinical data and data from adequate and well-controlled clinical trials to demonstrate the safety, purity, and potency of the other company’s product. In addition, a competitor may choose to challenge our patent rights relating to the reference product by initiating litigation during the 12-year period of exclusivity. After the FDA approves the BLA for the competing product, the competitor may also bring a declaratory judgment action of non-infringement, invalidity, and/or unenforceability of our patent rights. The law is complex and is still being interpreted and implemented by the FDA. As a result, its ultimate impact, implementation, and meaning are subject to uncertainty.

Current wording

The Patient Protection and Affordable Care Act (“ACA”) includes a subtitle called the Biologics Price Competition and Innovation Act of 2009 (“BPCIA”), which created an abbreviated approval pathway for biological products that are biosimilar to or interchangeable with an FDA-licensed reference biological product. Under the BPCIA, an application for a biosimilar product may not be submitted to the FDA until four years following the date that the reference product was first licensed by the FDA. In addition, the approval of a biosimilar product may not be made effective by the FDA until 12 years from the date on which the reference product was first licensed. During this 12-year period of exclusivity, another company may still market a competing product if the FDA approves a Biologics License Application, or BLA, for the competing product containing that company’s own preclinical data and data from adequate and well-controlled clinical trials to demonstrate the safety, purity, and potency of that company’s product. In addition, a competitor may choose to challenge our patent rights relating to the reference product by initiating litigation during the 12-year period of exclusivity. After the FDA approves the BLA for the competing product, the competitor may also bring a declaratory judgment action of non-infringement, invalidity, and/or unenforceability of our patent rights. The law is complex and is still being interpreted and implemented by the FDA. As a result, its ultimate impact, implementation, and meaning are subject to uncertainty.

Previous wording

We believe that any of our product candidates approved as a biological product under a BLA should qualify for the 12-year period of exclusivity. However, there is a risk that this exclusivity could be shortened due to congressional action or otherwise, or that the FDA will not consider our investigational medicines to be reference products for competing products, potentially creating the opportunity for generic competition sooner than anticipated. Other aspects of the BPCIA, some of which may impact the BPCIA exclusivity provisions, have also been the subject of recent litigation. Moreover, the extent to which a biosimilar, once licensed, will be substituted for any one of our approved products in a way that is similar to traditional generic substitution for non-biological products is not yet clear, and will depend on a number of marketplace and regulatory factors that are still developing.

Current wording

We believe that any of our product candidates approved as a biological product under a BLA should qualify for the 12-year period of exclusivity. However, there is a risk that this exclusivity could be shortened due to congressional action or otherwise, or that the FDA will not consider our investigational genetic medicines to be reference products for competing products, potentially creating the opportunity for generic competition sooner than anticipated. Other aspects of the BPCIA, some of which may impact the BPCIA exclusivity provisions, have also been the subject of recent litigation. Moreover, the extent to which a biosimilar, once licensed, will be substituted for any one of our approved products in a way that is similar to traditional generic substitution for non-biological products is not yet clear, and will depend on a number of marketplace and regulatory factors that are still developing.

Previous wording

We are aware of several companies and institutions that have developed, or are currently developing, alternative autologous or palliative gene therapy or other approaches for our targeted indications, including DEB, cystic fibrosis, solid tumors, and aesthetic skin conditions. Many of our potential competitors, alone or with their strategic partners, have substantially greater financial, technical, and other resources, such as larger research and development, clinical, marketing, and manufacturing organizations. Mergers and acquisitions in the biotechnology and pharmaceutical industries may result in even more resources being concentrated among a smaller number of competitors. Our commercial opportunities could be reduced or eliminated if competitors develop and commercialize products that are safer, more effective, have fewer or less severe side effects, are more convenient, or are less expensive than VYJUVEK or any product candidate that we may develop and commercialize. Competitors also may obtain FDA or other regulatory approval for their products more rapidly or earlier than we may obtain approval for our product candidates, which could result in our competitors establishing a strong market position before we are able to enter the market. Additionally, technologies developed by our competitors may render VYJUVEK or any of our product candidates uneconomical or obsolete, and we may not be successful in marketing VYJUVEK or any of our product candidates that obtain regulatory approval against competitors.

Current wording

We are aware of several companies and institutions that have developed, or are currently developing, alternative autologous or palliative gene therapy or other approaches for our targeted indications, including DEB, cystic fibrosis, solid tumors, and aesthetic skin conditions. Many of our potential competitors, alone or with their strategic partners, have substantially greater financial, technical, and other resources, such as larger research and development, clinical, marketing, and manufacturing organizations. Mergers and acquisitions in the biotechnology and pharmaceutical industries may result in even more resources being concentrated among a smaller number of competitors. Our commercial opportunities could be reduced or eliminated if competitors commercialize products that are safer, more effective, have fewer or less severe side effects, are more convenient, or are less expensive than VYJUVEK or any product candidate that we may commercialize. Competitors also may obtain FDA or other regulatory approval for their products more rapidly or earlier than we may obtain approval for our product candidates, which could result in our competitors establishing a strong market position before we are able to enter the market. Additionally, technologies developed by our competitors may render VYJUVEK or any of our product candidates uneconomical or obsolete, and we may not be successful in marketing VYJUVEK or any of our product candidates that obtain regulatory approval against such competitors.

Previous wording

Gene therapy remains a novel technology. Ethical, social, and legal concerns about gene therapy could result in additional regulations restricting or prohibiting VYJUVEK or our product candidates. Public perception may be influenced by claims that gene therapy is unsafe, and gene therapy may not gain the acceptance of the public or the medical community. In particular, our success depends upon physicians who specialize in the treatment of DEB or genetic diseases targeted by our product candidates prescribing VYJUVEK or treatments that involve the use of our product candidates that may be in lieu of, or in addition to, existing treatments with which they are familiar and for which greater clinical data may be available. More restrictive government regulations or negative public opinion would have an adverse effect on our business, financial condition, results of operations and prospects and may delay or impair the development and commercialization of VYJUVEK or our product candidates or demand for VYJUVEK or any product candidates we may develop. For example, earlier gene therapy trials led to several well- publicized adverse events, including cases of leukemia and death seen in trials using other vectors. Serious adverse events in our clinical trials, or other clinical trials involving gene therapy products or our competitors’ products, even if not ultimately attributable to the relevant product candidates, and the resulting publicity, could result in increased government regulation, unfavorable public perception, potential regulatory delays in the testing or approval of our product candidates, stricter labeling requirements for those product candidates that are approved and a decrease in demand for any such product candidates.

Current wording

Gene therapy remains a novel technology. Ethical, social, and legal concerns about gene therapy could result in additional regulations restricting or prohibiting VYJUVEK or our product candidates. Public perception may be influenced by claims that gene therapy is unsafe, and gene therapy may not gain the acceptance of the public or the medical community. In particular, our success depends upon physicians who specialize in the treatment of DEB or genetic diseases targeted by our product candidates prescribing VYJUVEK or treatments that involve the use of our product candidates that may be in lieu of, or in addition to, existing treatments with which they are familiar and for which greater clinical data may be available. More restrictive government regulations or negative public opinion would have an adverse effect on our business, financial condition, results of operations, and prospects and may delay or impair the commercialization of VYJUVEK, regulatory approval of our product candidates, or demand for VYJUVEK or any product candidates that are approved for commercial sale. For example, earlier gene therapy trials led to several well-publicized adverse events, including cases of leukemia and death seen in trials using other vectors. Serious adverse events in our clinical trials or other clinical trials involving gene therapy products, even if not ultimately attributable to the relevant product candidates, and the resulting publicity, could result in increased government regulation, unfavorable public perception, potential regulatory delays in the testing or approval of our product candidates, stricter labeling requirements for those product candidates that are approved, and a decrease in demand for any such product candidates.

Previous wording

From time to time, we may become involved in disputes, claims and lawsuits relating to our business operations. For example, we may face or initiate claims related to intellectual property matters, employment matters, or commercial matters. Any dispute, claim or lawsuit may divert management’s attention away from our business, we may incur significant expenses in addressing or defending any dispute, claim, or lawsuit, and we may be required to pay damage awards or settlements or become subject to equitable remedies that could adversely affect our operations and financial results. Litigation related to these disputes may be costly and time-consuming and could materially and adversely impact our financial position and results of operations if resolved against us. In addition, the uncertainty associated with litigation could lead to increased volatility in our stock price.

Current wording

From time to time, we may become involved in disputes, claims, and lawsuits relating to our business operations. For example, we may face or initiate claims related to intellectual property matters, employment matters, or commercial matters. Any dispute, claim, or lawsuit may divert management’s attention away from our business, we may incur significant expenses in addressing or defending any dispute, claim, or lawsuit, and we may be required to pay damage awards or settlements or become subject to equitable remedies that could materially and adversely affect our operations and financial results. In addition, the uncertainty associated with litigation could lead to increased volatility in our stock price.

Previous wording

Social media is increasingly being used by us, our employees, or others to communicate about our business, VYJUVEK, our clinical development programs, DEB, and the diseases our product candidates are being developed to treat. We use social media in connection with our commercialization efforts of VYJUVEK and intend to use it in connection with our commercialization efforts of our product candidates, if approved. Social media practices in the biotechnology and biopharmaceutical industries continue to evolve, and regulations and regulatory guidance relating to such use are evolving and not always clear. This evolution creates uncertainty and risk of noncompliance with regulations applicable to our business, resulting in potential regulatory actions against us, along with the potential for litigation and heightened scrutiny by the FDA, the Securities and Exchange Commission, or the SEC, and other regulators. For example, patients may use social media channels to comment on their experience in an ongoing clinical trial of our product candidates, or to report an alleged adverse event. If such disclosures occur, there is a risk that clinical trial enrollment may be adversely impacted, that we may fail to monitor and comply with applicable adverse event reporting obligations, or that we may not be able to defend our business or the public’s legitimate interests in the face of the political and market pressures generated by social media due to restrictions on what we may say about our product candidates. There is also a risk of inappropriate disclosure of sensitive information, loss of trade secrets or other intellectual property, public exposure of personal information of our employees, patients who use VYJUVEK, clinical trial patients, and others, or negative or inaccurate posts or comments about us on any social networking website. In addition, we may encounter attacks on social media regarding our company, management, VYJUVEK, or our product candidates that seriously damage our reputation, brand image, and goodwill. If any of these events were to occur or we otherwise fail to comply with applicable regulations, we could incur liability, face regulatory actions, or incur other harm to our business that could have a material adverse effect on our business, prospects, operating results, and financial condition and could adversely affect the price of our common stock.

Current wording

Social media is increasingly being used by us, our employees, or others to communicate about our business, VYJUVEK, our clinical development programs, DEB, and the diseases our product candidates are being developed to treat. We use social media in connection with our commercialization efforts of VYJUVEK and intend to use it in connection with our commercialization efforts of our product candidates, if approved. Social media practices in the biotechnology and biopharmaceutical industries continue to evolve, and regulations and regulatory guidance relating to such use are evolving and not always clear. This evolution creates uncertainty and risk of noncompliance with regulations applicable to our business, resulting in potential regulatory actions against us, along with the potential for litigation and heightened scrutiny by the FDA, the EMA, the Securities and Exchange Commission, or the SEC, and other regulators. For example, patients may use social media channels to comment on their experience in an ongoing clinical trial of our product candidates, or to report an alleged adverse event. If such disclosures occur, there is a risk that clinical trial enrollment may be adversely impacted, that we may fail to monitor and comply with applicable adverse event reporting obligations, or that we may not be able to defend our business or the public’s legitimate interests in the face of the political and market pressures generated by social media due to restrictions on what we may say about our product candidates. There is also a risk of inappropriate disclosure of sensitive information, loss of trade secrets or other intellectual property, public exposure of personal information of our employees, patients who use VYJUVEK, clinical trial patients, and others, or negative or inaccurate posts or comments about us on any social networking website. In addition, we may encounter attacks on social media regarding our company, management, VYJUVEK, or our product candidates that seriously damage our reputation, brand image, and goodwill. If any of these events were to occur or we otherwise fail to comply with applicable regulations, we could incur liability, face regulatory actions, or incur other harm to our business that could have a material adverse effect on our business, prospects, operating results, and financial condition, and could adversely affect the price of our common stock.

Previous wording

We have experienced a period of significant expansion in personnel and of our facilities, infrastructure and overhead as we developed our own manufacturing facilities, built our sales, marketing and distribution infrastructure that we believe is necessary to commercialize VYJUVEK, and increased our research and development efforts. The commercialization of VYJUVEK and our ongoing development of other product candidates will continue to impose significant capital requirements, as well as added responsibilities on members of management, including the need to identify, recruit, maintain, and integrate new personnel in the United States and abroad. Our future performance and our ability to compete effectively will depend, in part, on our ability to manage our growth effectively. If we are successful in executing our business strategy, we will need to expand our managerial, operational, financial, and other systems and resources to manage our operations, continue our research and development activities and build a commercial infrastructure to support commercialization of any of our product candidates that are approved for sale, and, depending on demand, may need to scale up the manufacturing process for any approved product, which is subject to risks and uncertainties. Future growth would impose significant added responsibilities on members of management. Our management, finance, development personnel, systems, including infrastructure such as IT and facilities, currently in place may not be adequate to support this expected future growth. Our need to effectively manage our operations, growth, and product candidates requires that we continue to develop more robust business processes and improve our systems and procedures in each of these areas and to attract and retain enough numbers of talented employees. We may be unable to successfully implement these tasks on a larger scale and, accordingly, may not achieve our research, development, and growth goals.

Current wording

We have experienced a period of significant expansion in personnel and of our facilities, infrastructure and overhead as we developed our own manufacturing facilities, built our sales, marketing, and distribution infrastructure that we believe is necessary to commercialize VYJUVEK, and increased our research and development efforts. The commercialization of VYJUVEK and our ongoing development of other product candidates will continue to impose significant capital requirements, as well as added responsibilities on members of management, including the need to identify, recruit, maintain, and integrate new personnel in the United States and abroad. Our future performance and our ability to compete effectively will depend, in part, on our ability to manage our growth effectively. If we are successful in executing our business strategy, we will need to expand our managerial, operational, financial, and other systems and resources to manage our operations, continue our research and development activities and build a commercial infrastructure to support commercialization of any of our product candidates that are approved for sale. Depending on demand, we may need to scale up the manufacturing process for any approved product, which is subject to risks and uncertainties. Future growth would impose significant added responsibilities on members of management. Our management, finance, development personnel, and systems (including infrastructure such as IT and facilities) currently in place may not be adequate to support this expected future growth. Our need to effectively manage our operations, growth, and product candidates requires that we continue to develop more robust business processes and improve our systems and procedures in each of these areas and to attract and retain enough numbers of talented employees. We may be unable to successfully implement these tasks on a larger scale and, accordingly, may not achieve our research, development, and growth goals.

Previous wording

Recruiting and retaining other qualified employees and scientific advisors for our business, including scientific and technical personnel, also will be critical to our success. Competition for skilled personnel, including in gene therapy research and vector manufacturing, is intense and the turnover rate can be high. We may not be able to attract and retain personnel on acceptable terms given the competition among numerous pharmaceutical and biotechnology companies and academic institutions for individuals with similar skill sets. In addition, failure to succeed in preclinical or clinical trials or applications for marketing approval may make it more challenging to recruit and retain qualified personnel. The inability to recruit, or loss of services of certain executives, key employees, or advisors, may impede the progress of our research, development and commercialization objectives and have a material adverse effect on our business, financial condition, results of operations and prospects.

Current wording

Recruiting and retaining qualified employees and scientific advisors for our business, including scientific and technical personnel, also will be critical to our success. Competition for skilled personnel, including in gene therapy research and vector manufacturing, is intense and the turnover rate can be high. We may not be able to attract and retain personnel on acceptable terms given the competition among numerous pharmaceutical and biotechnology companies and academic institutions for individuals with similar skill sets. In addition, failure to succeed in preclinical or clinical trials or applications for marketing approval may make it more challenging to recruit and retain qualified personnel. The inability to recruit, or loss of services of certain executives, key employees, or advisors, may impede the progress of our research, development, and commercialization objectives and have a material adverse effect on our business, financial condition, results of operations, and prospects.

Previous wording

We are exposed to the risk of fraud or other misconduct by our employees, principal investigators, and advisors. Misconduct by these parties could include intentional failures to comply with FDA regulations or the regulations applicable in the European Union, or EU, and other jurisdictions, provide accurate information to the FDA, the European Medicines Agency (“EMA”) and other regulatory authorities, comply with healthcare fraud and abuse laws and regulations in the United States and abroad, report financial information or data accurately or disclose unauthorized activities. Sales, marketing, and business arrangements in the healthcare industry are subject to extensive laws and regulations intended to prevent fraud, misconduct, kickbacks, self-dealing and other abusive practices. These laws and regulations restrict or prohibit a wide range of pricing, discounting, marketing and promotion, sales commission, customer incentive programs and other business arrangements. It is not always possible to identify and deter employee misconduct, and the precautions we take to detect and prevent this activity may not be effective in controlling unknown or unmanaged risks or losses or in protecting us from government investigations or other actions or lawsuits stemming from a failure to comply with these laws or regulations. If any such actions are instituted against us and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business, financial condition, results of operations and prospects, including the imposition of significant fines, criminal penalties, or other sanctions.

Current wording

We are exposed to the risk of fraud or other misconduct by our employees, principal investigators, and advisors. Misconduct by these parties could include intentional failures to comply with FDA regulations or the regulations applicable in the EU and other jurisdictions, provide accurate information to the FDA, the EMA, and other regulatory authorities, comply with healthcare fraud and abuse laws and regulations in the United States and abroad, report financial information or data accurately or disclose unauthorized activities. Sales, marketing, and business arrangements in the healthcare industry are subject to extensive laws and regulations intended to prevent fraud, misconduct, kickbacks, self-dealing, and other abusive practices. These laws and regulations restrict or prohibit a wide range of pricing, discounting, marketing and promotion, sales commission, customer incentive programs, and other business arrangements. It is not always possible to identify and deter employee misconduct, and the precautions we take to detect and prevent this activity may not be effective in controlling unknown or unmanaged risks or losses or in protecting us from government investigations or other actions or lawsuits stemming from a failure to comply with these laws or regulations. If any such actions are instituted against us and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business, financial condition, results of operations, and prospects, including the imposition of significant fines, criminal penalties, or other sanctions.

Previous wording

In the United States, there have been and continue to be a number of legislative efforts to contain healthcare costs. Any legislative changes that result in price controls, reduce access to and reimbursement for care or add additional regulations may have an adverse effect on our financial condition and results of operations. Any changes that reduce, or impede the ability to obtain, reimbursement for VYJUVEK or our product candidates that we intend to commercialize in the United States could adversely affect successful commercialization of VYJUVEK and our plans to introduce our product candidates in the United States. For example, the Bipartisan Budget Act of 2018, among other things, amended the ACA, effective January 1, 2019, to increase from 50 percent to 70 percent the point-of-sale discount that is owed by pharmaceutical manufacturers who participate in Medicare Part D and to close the coverage gap in most Medicare drug plans, commonly referred to as the “donut hole.”

Current wording

In the United States, there have been and continue to be a number of legislative efforts to contain healthcare costs. Any legislative changes that result in price controls, reduce access to and reimbursement for care, or add additional regulations may have an adverse effect on our financial condition and results of operations. Any changes that reduce, or impede the ability to obtain, reimbursement for VYJUVEK or our product candidates that we intend to commercialize in the United States could adversely affect successful commercialization of VYJUVEK and our plans to introduce our product candidates in the United States.

Previous wording

Other legislative changes have been proposed and adopted in the United States since the ACA was enacted. For example, in August 2011, the Budget Control Act of 2011, among other things, created measures for spending reductions by Congress. A Joint Select Committee on Deficit Reduction, tasked with recommending a targeted deficit reduction of at least $1.2 trillion for the years 2012 through 2021, was unable to reach required goals, thereby triggering the legislation’s automatic reduction to several government programs. This includes aggregate reductions of Medicare payments to providers of up to 2% per fiscal year, which went into effect in April 2013 and will remain in effect through 2027 unless additional Congressional action is taken. In January 2013, the American Taxpayer Relief Act of 2012, among other things, further reduced Medicare payments to certain providers, and increased the time for Medicare contractors to recoup Medicare overpayments to providers from three to five years. In August 2022, the Inflation Reduction Act of 2022 (“IRA”) was signed into law. The IRA includes several provisions to lower prescription drug costs for people with Medicare and reduce drug spending by the federal government. In relevant part, the IRA allows Medicare to negotiate prices for certain prescription drugs, requires drug manufacturers to pay a rebate to the federal government if prices for single-source drugs and biologicals covered under Medicare Part B and nearly all covered drugs under Part D increase faster than the rate of inflation, caps out of pocket spending for Medicare Part D enrollees, and makes other benefit design changes to Medicare Part D intended to lower drug costs for enrollees and Medicare. Implementation of these changes began in 2023, and will continue to be implemented over the next several years. Multiple pharmaceutical manufacturers have challenged the law in court, largely on constitutional grounds. These suits will likely continue and the ultimate effects of such legal challenges are unclear. At this time, we continue to evaluate the effect of the IRA on our business operations and financial condition and results as the full impact of the IRA remains uncertain.

Current wording

In August 2022, the Inflation Reduction Act (“IRA”) was signed into law. The IRA includes several provisions to lower prescription drug costs for people with Medicare and reduce drug spending by the federal government. In relevant part, the IRA allows Medicare to negotiate prices for certain prescription drugs, requires drug manufacturers to pay a rebate to the federal government if prices for single-source drugs and biologicals covered under Medicare Part B and nearly all covered drugs under Part D increase faster than the rate of inflation, caps out of pocket spending for Medicare Part D enrollees, and makes other benefit design changes to Medicare Part D intended to lower drug costs for enrollees and Medicare. Implementation of these changes began in 2023 and will continue to be implemented over the next several years. Beginning January 1, 2025, Medicare Part D enrollees now have a new annual out-of-pocket cap of $2,000 on prescription drugs. Other 2025 Medicare Part D changes include the elimination of the coverage gap phase and the replacement of the Coverage Gap Discount Program with the Manufacturer Discount Program, which requires drug manufacturers to pay a 10% discount for brand-name drugs and biologics during the initial coverage period and a 20% discount during the catastrophic phase. Multiple pharmaceutical manufacturers have challenged the law in court, largely on constitutional grounds. These suits will likely continue and the ultimate effects of such legal challenges are unclear. On April 15, 2025, President Trump issued an executive order directing the Secretary of the Department of Health and Human Services to take certain actions on drug pricing reform, including working with Congress on amendments to the IRA and rule making to establish new Medicare payment models for so-called “high-cost” prescription drugs and biological products. At this time, we continue to evaluate the effect of the IRA on our business operations and financial condition and results as the full impact of the IRA remains uncertain.

Previous wording

These initiatives, as well as other healthcare reform measures that may be adopted in the future, may result in more rigorous coverage criteria and in additional downward pressure on the price that we receive for any approved product. Any reduction in reimbursement from Medicare or other government programs may result in a similar reduction in payments from private payors. The implementation of cost containment measures or other healthcare reforms could result in reduced demand for our product and product candidates or additional pricing pressures and may adversely impact our ability to generate sufficient revenue, attain consistent profitability, or commercialize our product candidates, if approved.

Current wording

Additional changes may affect our business, including those governing enrollment in federal healthcare programs, reimbursement changes, fraud and abuse enforcement, and expansion of new programs, such as Medicare payment for performance initiatives. Healthcare reform measures that may be adopted in the future, may result in more rigorous coverage criteria and in additional downward pressure on the price that we receive for any approved product. Any reduction in reimbursement from Medicare or other government programs may result in a similar reduction in payments from private payors. The implementation of cost containment measures or other healthcare reforms could result in reduced demand for our product and product candidates or additional pricing pressures and may adversely impact our ability to generate sufficient revenue, attain consistent profitability, or commercialize our product candidates, if approved.

Previous wording

With the FDA approval of VYJUVEK, our operations are directly, or indirectly through our prescribers, customers, and purchasers, subject to various federal and state fraud and abuse laws and regulations, including, without limitation, the federal Anti-Kickback Statute, federal civil and criminal false claims laws and the Physician Payments Sunshine Act and regulations. These laws impact, among other things, our sales, marketing, access assistance, sponsored genetic patient testing, and educational programs. In addition, we are subject to patient privacy laws by both the federal government and the states in which we conduct our business as well as other jurisdictions. The laws that affect our operations include, but are not limited to:

Current wording

With the FDA approval of VYJUVEK, our operations are directly, or indirectly through our prescribers, customers, and purchasers, subject to various federal and state fraud and abuse laws and regulations, including, without limitation, the federal Anti-Kickback Statute, federal civil and criminal false claims laws and the Physician Payments Sunshine Act and regulations. These laws impact, among other things, our sales, marketing, access assistance, sponsored genetic patient testing, and educational programs. In addition, we are subject to patient privacy laws by both the federal government and the states in which we conduct our business, as well as by foreign jurisdictions. The laws that affect our operations include, but are not limited to:

Previous wording

•federal civil and criminal false claims laws and civil monetary penalty laws which prohibit, among other things, individuals or entities from knowingly presenting, or causing to be presented, claims for payment or approval from Medicare, Medicaid, or other government payors that are false or fraudulent. The ACA provides that a claim for items or services resulting from an Anti-Kickback Statute violation is a false claim under the federal False Claims Act (“FCA”). Cases against pharmaceutical manufacturers support the view that certain marketing practices, including off-label promotion, may implicate the FCA;

Current wording

•federal civil and criminal false claims laws and civil monetary penalty laws which prohibit, among other things, individuals or entities from knowingly presenting, or causing to be presented, claims for payment or approval from Medicare, Medicaid, or other government payors that are false or fraudulent. The ACA provides that a claim for items or services resulting from an Anti-Kickback Statute violation is a false claim under the False Claims Act (“FCA”). Cases against pharmaceutical manufacturers support the view that certain marketing practices, including off-label promotion, may implicate the FCA;

Previous wording

•the federal Health Care Fraud statute imposes criminal and civil liability for executing a scheme to defraud any healthcare benefit program or making false statements relating to healthcare matters;

Current wording

•the federal Health Care Fraud statute imposes criminal and civil liability for executing or attempting to execute a scheme to defraud any healthcare benefit program or making false statements relating to healthcare matters;

Previous wording

•the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and its implementing regulations, and as amended again by the final HIPAA omnibus rule (the “Omnibus Rule” and together with HIPAA and HITECH, the HIPAA Rules), which impose certain requirements relating to the privacy, security and transmission of individually identifiable health information by certain entities subject to the HIPAA Rules, such as health plans, health care clearinghouses and health care providers that engage in certain covered transactions;

Current wording

•the Health Insurance Portability and Accountability Actof 1996 (“HIPAA”) Rules, which impose certain requirements relating to the privacy, security, and transmission of individually identifiable health information by certain entities subject to the HIPAA Rules, such as health plans, health care clearinghouses, and health care providers that engage in certain covered transactions, known as covered entities, as well as their business associates that perform certain services that involve the use or disclosure of individually identifiable health information for or on behalf of covered entities;

Previous wording

•federal transparency laws, including the federal Physician Payment Sunshine Act, that require certain manufacturers of drugs, devices, biologics and medical supplies for which payment is available under Medicare, Medicaid or the Children’s Health Insurance Program, with specific exceptions, to report annually to the Centers for Medicare and Medicaid Services (“CMS”) information related to: (i) payments or other “transfers of value” made to physicians and teaching hospitals, and (ii) ownership and investment interests held by physicians and their immediate family members;

Current wording

•federal transparency laws, including the federal Physician Payment Sunshine Act, that require certain manufacturers of drugs, devices, biologics, and medical supplies for which payment is available under Medicare, Medicaid, or the Children’s Health Insurance Program, with specific exceptions, to report annually to the United States Centers for Medicare and Medicaid Services (“CMS”) information related to: (i) payments or other “transfers of value” made to physicians and teaching hospitals, and (ii) ownership and investment interests held by physicians and their immediate family members;

Previous wording

•state and foreign law equivalents of each of the above federal laws, state laws that require drug manufacturers to report information related to payments and other transfers of value to physicians and other healthcare providers or marketing expenditures and state laws governing the privacy and security of health information in certain circumstances, many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts in certain circumstances, such as specific disease states; and

Current wording

•U.S. state and foreign law equivalents of each of the above federal laws, state laws that require drug manufacturers to report information related to payments and other transfers of value to physicians and other healthcare providers or marketing expenditures; and

Previous wording

•state and foreign laws that govern the privacy and security of health information in some circumstances, many of which differ from each other in significant ways and often are not preempted by the HIPAA Rules, thus complicating compliance efforts.

Current wording

•state and foreign laws governing data privacy and security of health information, many of which differ from each other and require attention to frequently changing regulatory requirements, thus complicating compliance efforts in certain circumstances and increasing exposure to liability.

Previous wording

Often, to avoid the threat of treble damages and penalties under the FCA, health care providers will resolve allegations in a settlement without admitting liability. Any such settlement could materially affect our business, financial operations, and reputation.

Current wording

Often, to avoid the threat of treble damages and penalties under the FCA, health care providers and drug manufacturers will resolve allegations in a settlement without admitting liability. Any such settlement could materially affect our business, financial operations, and reputation.

Previous wording

Privacy and data security have become significant areas of legal and regulatory focus in the United States, European Union and in many other jurisdictions where we conduct or may conduct our operations. In our ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, “process”) personal information and other sensitive information, including, but not limited to, health information, individuals’ financial information, as well as proprietary and confidential business data, including trade secrets, intellectual property, and sensitive third-party data (collectively, “sensitive data”). Our data processing activities may subject us to numerous privacy and data security obligations, including, but not limited to, domestic and international laws, regulations, guidance, industry standards, external and internal privacy and security policies, and contractual requirements.

Current wording

Privacy and data security have become significant areas of legal and regulatory focus in the United States, European Union, and in many other jurisdictions where we conduct or may conduct our operations. In our ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, “process”) personal information and other sensitive information, including, but not limited to, health information, individuals’ financial information, as well as proprietary and confidential business data, including trade secrets, intellectual property, and sensitive third-party data (collectively, “sensitive data”). The legislative and regulatory landscape for privacy and data security continues to evolve, and there has been an increasing focus on privacy and data security issues, which may affect our business and is expected to increase our compliance costs and exposure to liability. Our data processing activities may subject us to numerous privacy and data security obligations, including, but not limited to, domestic and international laws, regulations, guidance, industry standards, external and internal privacy and security policies, and contractual requirements.

Previous wording

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal information privacy laws, consumer protection laws, and other similar laws. Notably, HIPAA, as amended by HITECH, imposes requirements on certain entities regarding the privacy, security, and transmission of individually identifiable health information and the California Consumer Privacy Act of 2018 (“CCPA”) requires businesses to provide specific disclosures in their privacy notices and honor California residents’ privacy rights. The CCPA provides for civil penalties of up to $7,500 per violation and allows private litigants affected by certain data breaches to recover significant statutory damages. Although the CCPA does not apply to certain data that we process in the context of clinical trials, efforts to comply with the CCPA may increase our annual compliance costs and subject us to potential liability with respect to other personal information we may maintain about California residents. In addition, the California Privacy Rights Act of 2020 (“CPRA”), which came into effect on January 1, 2023, expanded the CCPA’s requirements, extending it to cover personal information of business representatives and employees and the CPRA established a new regulatory agency to implement and enforce the law. Other states, such as Virginia, Nevada, and Colorado, have also passed comprehensive privacy laws, and similar laws are being considered in several other states, as well as at the federal and local levels. While these states’ laws, like the CCPA, also exempt some data processed in the context of clinical trials, these developments further complicate our compliance efforts and increase both legal risk and compliance costs for us and the third parties upon whom we rely.

Current wording

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal information privacy laws, consumer protection laws, and other similar laws. Notably, HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, imposes requirements on covered entities, as well as their business associates regarding the privacy, security, and transmission of individually identifiable health information. Further, states continue to adopt new laws or amend existing laws related to data privacy, requiring attention to frequently changing regulatory requirements. For example, and the California Consumer Privacy Act of 2018 (“CCPA”) requires businesses to provide specific disclosures in their privacy notices and honor residents’ privacy rights. The CCPA provides for civil penalties of up to $7,500 per violation and allows private litigants affected by certain data breaches to recover significant statutory damages. Although the CCPA does not apply to certain data that we process in the context of clinical trials, efforts to comply with the CCPA may increase our annual compliance costs and subject us to potential liability with respect to other personal information we may maintain about California residents. In addition, the California Privacy Rights Act of 2020 (“CPRA”), which came into effect on January 1, 2023, expanded the CCPA’s requirements, extending it to cover personal information of business representatives and employees and the CPRA established a new regulatory agency to implement and enforce the law. Other states, such as Virginia, Nevada, Connecticut, Utah, Texas, and Colorado, have also passed comprehensive privacy laws, and similar laws are being considered in several other states, as well as at the federal and local levels, which impose similar obligations to those in the CCPA. Further, other states, such as Nevada and Washington, have enacted privacy laws specifically governing consumer health information, with Washington providing for a private right of action. Although many of these laws currently exempt certain health-related information, the laws may increase our potential liability related to our data processing activities, complicate our compliance efforts, and increase both legal risk and compliance costs for us and the third parties upon whom we rely.

Previous wording

Our results of operations could be adversely affected by general conditions in the global economy and in the global financial markets, including inflation and interest rates and concerns of a recession in the United States or other major markets due to a number of factors. For example, inflation and rising interest rates have recently caused volatility and disruptions in the capital and credit markets, and it is unclear how long such volatility will continue. In addition, Russia’s invasion of Ukraine and/or the Israeli conflicts in the Middle East may lead to a prolonged, adverse impact on global economic, sociopolitical, and market conditions. A severe or prolonged economic downturn could result in a variety of risks to our business, including our ability to raise additional capital when needed or on acceptable terms, if at all. A weak or declining economy, sanctions, trade restrictions and other global conditions could also strain our suppliers, possibly resulting in supply delays or disruptions. Any of the foregoing could harm our business, and we cannot anticipate all the ways in which the current economic climate and financial market conditions could adversely impact our business, financial condition, results of operations, and prospects.

Current wording

Our results of operations could be adversely affected by general conditions in the global economy and in the global financial markets, including inflation and interest rates and concerns of a recession in the United States or other major markets due to a number of factors. In addition, the conflict between Russia and Ukraine and the conflicts in the Middle East may lead to a prolonged, adverse impact on global economic, sociopolitical, and market conditions. A severe or prolonged economic downturn could result in a variety of risks to our business, including our ability to raise additional capital if needed or on acceptable terms, if at all. A weak or declining economy, sanctions, trade restrictions, and other global conditions could also strain our suppliers, possibly resulting in supply delays or disruptions. In addition, we may be impacted by the imposition of tariffs, trade protection measures or other policies adopted by any jurisdiction that favors domestic companies and technologies over foreign competitors. Any of the foregoing could materially and adversely affect our business, and we cannot anticipate all the ways in which the current economic climate and financial market conditions could adversely impact our business, financial condition, results of operations, and prospects.

Previous wording

We rely on our information technology systems and infrastructure to manage our business. In addition, we receive, process, store, and transmit, often electronically, confidential data of others, including the participants in our clinical trials. Unauthorized access to our (or any third party with whom we do business, such as suppliers, distributors, manufacturers, or vendors) computer systems or stored data could result in the theft or improper disclosure of personal or confidential information or other sensitive data, the deletion or modification of records, or could cause interruptions in our operations. Cybersecurity threats include, but are not limited to, ransomware attacks, phishing attempts, and the exploitation of software vulnerabilities to gain access to our information technology environment, and cyber-security risks increase when we transmit information from one location to another, including transmissions over the Internet or other electronic networks. Despite our robust security measures and our commitment to implementing and continually improving our cybersecurity posture to mitigate the risk of a cybersecurity incident, we cannot guarantee that such incidents will not occur to us or any third-party with whom we do business. For example, our specialty pharmacy provider was affected by a cybersecurity incident that delayed reimbursement approvals and had a negative impact on our product revenue, net for the first quarter of 2024. Any cybersecurity incident, even if promptly addressed, may harm our reputation, damage our brand, and erode trust. Our facilities and systems, and those of any third-party with whom we do business, may also be vulnerable to acts of vandalism, software viruses, misplaced or lost data, programming and/or human errors, or other similar events which may disrupt our operations or expose personal and confidential information.

Current wording

We rely on our information technology systems and infrastructure to manage our business. In addition, we receive, process, store, and transmit, often electronically, confidential data of others, including the participants in our clinical trials. Unauthorized access to our (or any third party with whom we do business, such as suppliers, distributors, manufacturers, or vendors) computer systems or stored data could result in the theft or improper disclosure of personal or confidential information or other sensitive data, the deletion or modification of records, or could cause interruptions in our operations. Cybersecurity threats include, but are not limited to, ransomware attacks, phishing attempts, and the exploitation of software vulnerabilities to gain access to our information technology environment, and cyber-security risks increase when we transmit information from one location to another, including transmissions over the Internet or other electronic networks. Despite our robust security measures and our commitment to implementing and continually improving our cybersecurity posture to mitigate the risk of a cybersecurity incident, we cannot guarantee that such incidents will not occur to us or any third-party with whom we do business. For example, in 2024, our specialty pharmacy provider was affected by a cybersecurity incident that delayed reimbursement approvals and had a negative impact on our product revenue. A cybersecurity incident, even if promptly addressed, may harm our reputation, damage our brand, and erode trust. Our systems, and those of any third-party with whom we do business, may also be vulnerable to software viruses, stolen, misplaced, or lost data, programming and/or human errors, or other similar events which may disrupt our operations or expose personal and confidential information.

Previous wording

Certain data breaches must be reported to affected individuals and various government and/or regulatory agencies, and in some cases to the media, under provisions of HIPAA, as amended by HITECH, other U.S. federal and state law, and requirements of non-U.S. jurisdictions, including the EU GDPR and relevant member state law in the European Union and other foreign laws, and financial penalties may also apply. Our insurance policies may not be adequate to compensate us for the potential losses arising from breaches, failures or disruptions of our infrastructure, catastrophic events and disasters or otherwise. In addition, such insurance may not be available to us in the future on economically reasonable terms, or at all. Further, our insurance may not cover all claims made against us and defending a suit, regardless of its merit, could be costly and divert management’s attention. Any security breach involving the misappropriation, loss or other unauthorized disclosure or use of confidential information of others, whether by us or a third-party, could: (i) subject us to civil and criminal penalties; (ii) have a negative impact on our reputation; or (iii) expose us to liability to third parties or government authorities.

Current wording

Certain data breaches must be reported to affected individuals and various government and/or regulatory agencies, and in some cases to the media, under provisions of HIPAA, other U.S. federal and state laws, and requirements of non-U.S. jurisdictions, including the EU GDPR and relevant member state law in the European Union and other foreign laws. Although we maintain cyber-security and other customary insurance, our insurance policies may not be adequate to compensate us for the potential losses arising from breaches, failures, or disruptions of our infrastructure. In addition, such insurance may not be available to us in the future on economically reasonable terms, or at all. Further, our insurance may not cover all claims made against us and defending a suit, regardless of its merit, could be costly and divert management’s attention. Any security breach involving the misappropriation, loss or other unauthorized disclosure or use of confidential information of others, whether by us or a third-party, could: (i) subject us to civil and criminal penalties; (ii) have a negative impact on our reputation; or (iii) expose us to liability to third parties or government authorities.

Previous wording

Natural disasters could severely disrupt our operations or the operations of third-party suppliers or service providers and have a material adverse effect on our business, financial condition, results of operations and prospects. The severity and frequency of weather-related natural disasters have been amplified, and are expected to continue to be amplified by, global climate change. Such natural disasters may cause damage to and/or disrupt our operations, which may result in a material adverse effect on our VYJUVEK sales, our other product candidates, business, and results of operations. Moreover, climate change may also result in various chronic physical changes, such as changes in temperature or precipitation patterns or sea-level rise, that could have an adverse impact on our operations. Our suppliers, vendors and business partners also face similar risks, and any disruption to their operations could have an adverse effect on our supply chain and manufacturing operations. If a natural disaster, power outage or other event occurred that prevented us from using all or a significant portion of our headquarters, that damaged critical infrastructure, such as our manufacturing facilities and IT systems, or that otherwise disrupted operations, it may be difficult or, in certain cases, impossible for us to continue our business for a substantial period of time. The disaster recovery and business continuity plans that we have in place currently are limited and may not prove adequate in the event of a serious disaster or similar event. A significant portion of our current supply of materials necessary for production of VYJUVEK and our product candidates, as well as finished VYJUVEK and product candidates, is located at our manufacturing facilities in Pittsburgh, Pennsylvania. We may incur substantial expenses as a result of the limited nature of our disaster recovery and business continuity plans, which could have a material adverse effect on our business, financial condition, results of operations and prospects.

Current wording

Natural or technological disasters could severely disrupt our operations or the operations of third-party suppliers or service providers and have a material adverse effect on our business, financial condition, results of operations, and prospects. The severity and frequency of information technology system failures and cyberattacks continue to increase. Additionally, the severity and frequency of weather-related natural disasters have been amplified, and are expected to continue to be amplified by, global climate change. Such natural and technological disasters may cause damage to and/or disrupt our operations, which may result in a material adverse effect on our VYJUVEK sales, our other product candidates, business, and results of operations. Moreover, climate change may also result in various chronic physical changes, such as changes in temperature or precipitation patterns or sea-level rise, that could have an adverse impact on our operations. Our suppliers, vendors, and business partners also face similar risks, and any disruption to their operations could have an adverse effect on our supply chain, manufacturing operations, or our commercial operations. If a natural disaster, power outage, or other event occurred that prevented us from using all or a significant portion of our headquarters, that damaged critical infrastructure, such as our manufacturing facilities and IT systems, or that otherwise disrupted operations, it may be difficult or, in certain cases, impossible for us to continue our business for a substantial period of time. The disaster recovery and business continuity plans that we have in place currently are limited and may not prove adequate in the event of a serious disaster or similar event. A significant portion of our current supply of materials necessary for production of VYJUVEK and our product candidates, as well as finished VYJUVEK and product candidates, is located at our manufacturing facilities in Pittsburgh, Pennsylvania. We may incur substantial expenses as a result of the limited nature of our disaster recovery and business continuity plans, which could have a material adverse effect on our business, financial condition, results of operations, and prospects.

Previous wording

Companies across industries are facing increasing scrutiny from a variety of stakeholders related to their ESG and sustainability practices. Expectations regarding voluntary ESG initiatives and disclosures may result in increased costs (including but not limited to increased costs related to compliance, stakeholder engagement, contracting and insurance), enhanced compliance or disclosure obligations, or other adverse impacts to our business, financial condition, or results of operations.

Current wording

Companies across industries are facing increasing scrutiny from a variety of stakeholders related to their ESG, including diversity, equity, and inclusion (“DEI”), and sustainability practices. Investor advocacy groups, certain institutional investors, investment funds, and other influential investors have increasingly focused on ESG practices and have placed increasing importance on the non-financial impacts of their investments. Expectations regarding voluntary ESG initiatives and disclosures may result in increased costs (including but not limited to increased costs related to compliance, stakeholder engagement, contracting, and insurance), enhanced compliance or disclosure obligations, or other adverse impacts to our business, financial condition, or results of operations.

Previous wording

While we may at times engage in voluntary initiatives (such as voluntary disclosures, certifications, or goals, among others) to improve the ESG profile of our company and/or VYJUVEK and our product candidates, such initiatives may be costly and may not have the desired effect. Moreover, we may not be able to successfully complete such initiatives due to factors that are within or outside of our control. Even if this is not the case, our actions may subsequently be determined to be insufficient by various stakeholders, and we may be subject to investor or regulator engagement on our ESG efforts, even if such initiatives are currently voluntary.

Current wording

While we may at times engage in voluntary initiatives (such as voluntary disclosures, certifications, or goals, among others) to improve the ESG profile of our company and/or VYJUVEK and our product candidates, such initiatives may be costly and may not have the desired effect. Moreover, we may not be able to successfully complete such voluntary initiatives due to factors that are within or outside of our control. Even if this is not the case, our actions may subsequently be determined to be insufficient by various stakeholders, and we may be subject to investor or regulator engagement on our ESG efforts, even if such initiatives are currently voluntary.

Previous wording

Certain market participants, including major institutional investors and capital providers, use third-party benchmarks and scores to assess companies’ ESG profiles in making investment or voting decisions. Unfavorable ESG ratings could lead to increased negative investor sentiment towards us or our industry, which could negatively impact the price of our common stock, as well as our access to and cost of capital. Furthermore, certain investors and others have been engaged in “anti-ESG” campaigns, and, to the extent we take actions that are seen as positive to some investors, other investors may take issue with such actions. To the extent ESG matters negatively impact our reputation, it may also impede our ability to compete as effectively to attract and retain employees or customers, which may adversely impact our operations.

Current wording

Certain market participants, including major institutional investors and capital providers, use third-party benchmarks and scores to assess companies’ ESG profiles in making investment or voting decisions. Unfavorable ESG ratings could lead to increased negative investor sentiment towards us or our industry, which could negatively impact the price of our common stock. In addition, in recent years “anti-ESG” sentiment has gained momentum across the United States, with several states and Congress having proposed or enacted “anti-ESG” policies, legislation, or initiatives or issued related legal opinions, and the President having recently issued an executive order opposing DEI initiatives in the private sector. Such anti-ESG and anti-DEI-related policies, legislation, initiatives, litigation, legal opinions, and scrutiny could result in us facing additional compliance obligations, becoming the subject of investigations and enforcement actions, or sustaining reputational harm. Therefore, to the extent we take actions that are seen as positive to some investors, other investors may take issue with such actions or face regulatory pressure to refrain from investing in, or divest from, our business. To the extent ESG matters negatively impact our reputation, it may also impede our ability to compete as effectively to attract and retain employees, customers, or business partners which may adversely impact our operations.

Previous wording

In addition, we expect there will likely be increasing levels of regulation, disclosure-related and otherwise, with respect to ESG matters. For example, the SEC recently adopted new rules that require companies to provide significantly expanded climate-related disclosures in their periodic reporting. The new climate disclosure rules were the subject of multiple legal challenges, and the SEC voluntarily stayed the climate disclosure rules pending the completion of judicial review. Therefore, it is unknown whether the new rules will go into effect and if they do, whether there will be significant changes. If the new rules go into effect and are not substantially different than the rules adopted by the SEC, we may be required to incur significant additional costs to comply, including the implementation of significant additional internal controls processes and procedures regarding matters that have not been subject to such controls in the past, and impose increased oversight obligations on our management and board of directors. These and other changes in stakeholder expectations will likely lead to increased costs as well as scrutiny that could heighten all of the risks identified in this risk factor. Additionally, our customers and suppliers may be subject to similar expectations, which may augment or create additional risks, including risks that may not be known to us.

Current wording

In addition, there may be increasing levels of regulation, disclosure-related and otherwise, with respect to ESG matters. For example, in 2024 the SEC adopted new rules that require companies to provide significantly expanded climate-related disclosures in their periodic reporting. The new climate disclosure rules were the subject of multiple legal challenges, and the SEC voluntarily stayed the climate disclosure rules pending the completion of judicial review. In March 2025, the SEC voted to cease defending the climate disclosure rules in court, and in April 2025, the U.S. Court of Appeals for the Eighth Circuit ordered the litigation challenging the SEC’s climate disclosure rules to be held in abeyance. The court directed the SEC to file a status report by July 23, 2025, indicating whether it intends to review or reconsider the rules. Therefore, it is unknown whether the new rules will go into effect and if they do, whether there will be significant changes. If the new rules go into effect and are not substantially different than the rules adopted by the SEC, we may be required to incur significant additional costs to comply, including the implementation of significant additional internal controls processes and procedures regarding matters that have not been subject to such controls in the past, and impose increased oversight obligations on our management and board of directors. Even if the SEC rules are not adopted, states or ex-U.S. jurisdictions in which we currently or may in the future operate may also have or adopt ESG or climate-related disclosure rules requiring similar or broader disclosure obligations. These and other changes in stakeholder expectations will likely lead to increased costs as well as scrutiny that could heighten all of the risks identified in this risk factor. Additionally, our customers and suppliers may be subject to similar expectations, which may augment or create additional risks, including risks that may not be known to us.

Previous wording

We currently have operations and employees located outside the United States and our business strategy incorporates potential additional international expansion to target patient populations outside the United States. Doing business internationally involves a number of risks, including, but not limited to:

Current wording

On April 23, 2025, the EC granted marketing authorization to VYJUVEK, and we are planning for our first European launch in Germany in mid-2025. We currently have operations and employees located outside the United States and our business strategy incorporates potential additional international expansion to target patient populations outside the United States. Doing business internationally involves a number of risks, including, but not limited to:

Previous wording

•complexities and difficulties in obtaining protection and enforcing our intellectual property;

Current wording

•complexities and difficulties in obtaining protection and enforcing our intellectual property, and additional potentially relevant third-party patent rights;

Previous wording

•difficulties in staffing and managing foreign operations;

Current wording

•difficulties in staffing and managing foreign operations, including language barriers and translation;

Previous wording

•financial risks, such as longer payment cycles, difficulty collecting accounts receivable, the impact of local and regional financial crises on demand and payment for our products that are approved for sale, and exposure to foreign currency exchange rate fluctuations;

Current wording

•financial risks, such as longer payment cycles, increased expenses for travel, translation, and insurance, difficulty collecting accounts receivable, the impact of local and regional financial crises on demand and payment for our products that are approved for sale, and exposure to foreign currency exchange rate fluctuations;

Previous wording

We are subject to export control and import laws and regulations, including the U.S. Export Administration Regulations, U.S. Customs regulations, and various economic and trade sanctions regulations administered by the U.S. Treasury Department’s Office of Foreign Assets Controls, and anti-corruption and anti-money laundering laws and regulations, including the U.S. Foreign Corrupt Practices Act of 1977, as amended, the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, the USA PATRIOT Act, and other state and national anti-bribery and anti-money laundering laws in the countries in which we conduct activities. Anti-corruption laws are interpreted broadly and prohibit companies and their employees, agents, contractors and other collaborators and partners from authorizing, promising, offering, providing, soliciting, or receiving, directly or indirectly, improper payments or anything else of value to recipients in the public or private sector. We may engage third parties to sell VYJUVEK or our product candidates, if approved, abroad and/or to obtain necessary marketing authorizations, permits, licenses, patent registrations and other regulatory approvals. We may have direct or indirect interactions with officials and employees of government agencies or government-affiliated hospitals, universities, and other organizations. We can be held liable for the corrupt or other illegal activities of our employees, agents, contractors and other collaborators and partners, even if we do not explicitly authorize or have actual knowledge of such activities. Any violations of the laws and regulations described above may result in substantial civil and criminal fines and penalties, imprisonment, the loss of export or import privileges, debarment, tax reassessments, breach of contract and fraud litigation, reputational harm, and other adverse consequences.

Current wording

We are subject to export control and import laws and regulations, including the U.S. Export Administration Regulations, U.S. Customs regulations, and various economic and trade sanctions regulations administered by the U.S. Treasury Department’s Office of Foreign Assets Controls, and anti-corruption and anti-money laundering laws and regulations, including the U.S. Foreign Corrupt Practices Act of 1977, as amended, the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, the USA PATRIOT Act, and other state and national anti-bribery and anti-money laundering laws in the countries in which we conduct activities. Anti-corruption laws are interpreted broadly and prohibit companies and their employees, agents, contractors and other collaborators and partners from authorizing, promising, offering, providing, soliciting, or receiving, directly or indirectly, improper payments or anything else of value to recipients in the public or private sector. We engage third parties to sell VYJUVEK and may engage third parties to sell our product candidates, if approved, abroad and/or to obtain necessary marketing authorizations, permits, licenses, patent registrations, and other regulatory approvals. We may have direct or indirect interactions with officials and employees of government agencies or government-affiliated hospitals, universities, and other organizations. We can be held liable for the corrupt or other illegal activities of our employees, agents, contractors, and other collaborators and partners, even if we do not explicitly authorize or have actual knowledge of such activities. Any violations of the laws and regulations described above may result in substantial civil and criminal fines and penalties, imprisonment, the loss of export or import privileges, debarment, tax reassessments, breach of contract and fraud litigation, reputational harm, and other adverse consequences.

Previous wording

If we fail in one or more of these factors in a timely manner or at all, we could experience significant delays or an inability to successfully commercialize our product candidates, which would materially harm our business. If we do not receive regulatory approvals for our product candidates or changes to our manufacturing processes, our business, financial condition, results of operations and prospects could be materially and adversely affected.

Current wording

If we fail in one or more of these factors in a timely manner or at all, we could experience significant delays or an inability to successfully commercialize our product candidates, which would materially harm our business. If we do not receive regulatory approvals for our product candidates or required changes to our manufacturing processes, our business, financial condition, results of operations and prospects could be materially and adversely affected.

Previous wording

Regulatory requirements and policy governing gene and cell therapy products have changed frequently and may continue to change in the future. In 2016, the FDA established the Office of Tissues and Advanced Therapies (“OTAT”) within its Center for Biologics Evaluation and Research to consolidate the review of gene therapy and related products, and has established the Cellular, Tissue and Gene Therapies Advisory Committee, among others, to advise this review. In September 2022, the FDA announced retitling of OTAT to the Office of Therapeutic Products (“OTP”) and elevation of OTP to a “Super Office” to meet its growing cell and gene therapy workload. If we engage a National Institutes of Health funded institution to conduct a clinical trial, that institution’s Institutional Biosafety Committee as well as its Institutional Review Board (“IRB”), would need to review the proposed clinical trial to assess the safety of the trial. Similarly, the EMA may issue new guidelines concerning the development and marketing authorization for gene therapy medicinal products and require that we comply with these new guidelines.

Current wording

Regulatory requirements and policy governing gene and cell therapy products have changed frequently and may continue to change in the future. In 2016, the FDA established the Office of Tissues and Advanced Therapies (“OTAT”) within its Center for Biologics Evaluation and Research to consolidate the review of gene therapy and related products, and has established the Cellular, Tissue and Gene Therapies Advisory Committee, among others, to advise this review. In September 2022, the FDA announced retitling of OTAT to the Office of Therapeutic Products, or OTP, and elevation of OTP to a “Super Office” to meet its growing cell and gene therapy workload. If we engage a National Institutes of Health funded institution to conduct a clinical trial, that institution’s Institutional Biosafety Committee as well as its Institutional Review Board would need to review the proposed clinical trial to assess the safety and ethics of the trial. Similarly, the EMA may issue new guidelines concerning the development and marketing authorization for gene therapy medicinal products and require that we comply with these new guidelines.

Previous wording

These regulatory review committees and advisory groups and the new guidelines they promulgate may lengthen the regulatory review process, require us to perform additional studies, increase our development costs, lead to changes in regulatory positions and interpretations, delay or prevent approval and commercialization of our product candidates or lead to significant post-approval limitations or restrictions. These additional processes may result in a review and approval process that are longer than we otherwise would have expected. Delay or failure to obtain, or unexpected costs in obtaining, the regulatory approval necessary to bring a potential product to market could decrease our ability to generate sufficient product revenue, and our business, financial condition, results of operations and prospects would be materially and adversely affected.

Current wording

These regulatory review committees and advisory groups and the new guidelines they promulgate may lengthen the regulatory review process, require us to perform additional studies, increase our development costs, lead to changes in regulatory positions and interpretations, delay or prevent approval and commercialization of our product candidates, or lead to significant post-approval limitations or restrictions. These additional processes may result in a review and approval process that is longer than we otherwise would have expected. Delay or failure to obtain, or unexpected costs in obtaining, the regulatory approval necessary to bring a potential product to market could decrease our ability to generate sufficient product revenue, and our business, financial condition, results of operations, and prospects would be materially and adversely affected.

Previous wording

In addition to side effects caused by our product candidates, the administration process or related procedures also can cause adverse side effects. If any such adverse events occur, our clinical trials could be suspended or terminated. If we are unable to demonstrate that such adverse events were caused by the administration process or related procedures and not by our product candidates, the FDA, the European Commission, the EMA, or other regulatory authorities could order us to cease further development of, or deny approval of, our product candidates for any or all targeted indications. Even if we can demonstrate that any serious adverse events are not product-related, such occurrences could affect patient recruitment or the ability of enrolled patients to complete the trial. Moreover, if we elect, or are required, to delay, suspend or terminate any clinical trial of our product candidates, the commercial prospects of such product candidates may be harmed and our ability to generate product revenue from the product candidates may be delayed or eliminated. Any of these occurrences may harm our ability to develop product candidates, and may harm our business, financial condition, and prospects significantly.

Current wording

In addition to side effects caused by our product or product candidates, the administration process or related procedures also can cause adverse side effects. If any such adverse events occur, our clinical trials could be suspended or terminated. If we are unable to demonstrate that such adverse events were caused by the administration process or related procedures and not by our product candidates, the FDA, the European Commission, the EMA, or other regulatory authorities could order us to cease further development of, or deny approval of, our product candidates for any or all targeted indications. Even if we can demonstrate that any serious adverse events are not product-related, such occurrences could affect patient recruitment or the ability of enrolled patients to complete the trial. Moreover, if we elect, or are required, to delay, suspend, or terminate any clinical trial of our product candidates, the commercial prospects of such product candidates may be harmed and our ability to generate product revenue from the product candidates may be delayed or eliminated. Any of these occurrences may harm our ability to develop product candidates, and may harm our business, financial condition, and prospects significantly.