Krystal Biotech, Inc.

Previous wording

To date, we have invested substantial efforts and financial resources in the research and development of VYJUVEK and our product candidates. Our near-term prospects, including our ability to develop our product candidates and generate revenue, and our future growth is substantially dependent on the commercial success of VYJUVEK.

Current wording

To date, we have invested substantial efforts and financial resources in the research and development of VYJUVEK and our product candidates. Our near-term prospects, including our ability to develop our product candidates and generate revenue, and our future growth are substantially dependent on the commercial success of VYJUVEK.

Previous wording

Although we received approval from the FDA for VYJUVEK for the treatment of DEB, we can provide no assurances that we will obtain regulatory approval in any other jurisdiction, which would have an adverse impact on our results of operations. In addition, the successful commercialization of VYJUVEK will depend on a number of factors and involves risk, including some of the risks identified in these “Risk Factors.” One or more of these factors, many of which are beyond our control, could cause significant delays or an inability to successfully commercialize VYJUVEK.

Current wording

Although we received approval from the U.S. Food and Drug Administration, or FDA, the European Commission, and Japan’s Ministry of Health, Labour and Welfare, or MHLW, for VYJUVEK for the treatment of dystrophic epidermolysis bullosa, or DEB, we can provide no assurances that we will obtain regulatory approval in any other jurisdiction, which could have an adverse impact on our results of operations. In addition, the successful commercialization of VYJUVEK will depend on a number of factors and involves risk, including some of the risks identified in these “Risk Factors.” One or more of these risks, many of which are beyond our control, could cause significant delays or an inability to successfully commercialize VYJUVEK.

Previous wording

Although a substantial amount of our efforts focus on the commercialization of VYJUVEK and the development and potential approval of our current product candidates, a key component of our strategy is to identify, develop and potentially commercialize a portfolio of genetic medicines. Research programs to identify new product candidates require substantial technical, financial, and human resources and may not be successful in identifying potential product candidates. Even if we identify product candidates that initially show promise, we may fail to successfully develop and commercialize such product candidates for many reasons, including the following:

Current wording

Although a substantial amount of our efforts are focused on the commercialization of VYJUVEK and the development and potential approval of our current product candidates, a key component of our strategy is to identify, develop and potentially commercialize a portfolio of genetic medicines. Research programs to identify new product candidates require substantial technical, financial, and human resources and may not be successful in identifying potential product candidates. Even if we identify product candidates that initially show promise, we may fail to successfully develop and commercialize such product candidates for many reasons, including the following:

Previous wording

Additionally, because we have limited resources, we may forego or delay pursuit of opportunities with certain programs or product candidates or for indications that later prove to have commercial potential. Our resource allocation decisions may cause us to fail to timely capitalize on viable commercial products or profitable market opportunities. Our spending on current and future research and development programs may not yield any commercially viable products. If we do not accurately evaluate the commercial potential for a particular product candidate, we may relinquish valuable rights to that product candidate through strategic collaboration, licensing, or other arrangements in cases in which it would have been more advantageous for us to retain sole development and commercialization rights to such product candidate. Alternatively, we may allocate internal resources to a product candidate in a therapeutic area in which it would have been more advantageous to enter into a partnering arrangement.

Current wording

Additionally, because we have limited resources, we may forego or delay pursuit of opportunities with certain programs or product candidates or for indications that later prove to have commercial potential. Our resource allocation decisions may cause us to fail to capitalize timely on viable commercial products or profitable market opportunities. Our spending on current and future research and development programs may not yield any commercially viable products. If we do not accurately evaluate the commercial potential for a particular product candidate, we may relinquish valuable rights to that product candidate through strategic collaboration, licensing, or other arrangements in cases in which it would have been more advantageous for us to retain sole development and commercialization rights to such product candidate. Alternatively, we may allocate internal resources to a product candidate in a therapeutic area in which it would have been more advantageous to enter into a partnering arrangement.

Previous wording

The ACA includes a subtitle called the Biologics Price Competition and Innovation Act of 2009 (“BPCIA”), which created an abbreviated approval pathway for biological products that are biosimilar to or interchangeable with an FDA-licensed reference biological product. Under the BPCIA, an application for a biosimilar product may not be submitted to the FDA until four years following the date that the reference product was first licensed by the FDA. In addition, the approval of a biosimilar product may not be made effective by the FDA until 12 years from the date on which the reference product was first licensed. During this 12-year period of exclusivity, another company may still market a competing product if the FDA approves a Biologics License Application, or BLA, for the competing product containing that company’s own preclinical data and data from adequate and well-controlled clinical trials to demonstrate the safety, purity, and potency of that company’s product. In addition, a competitor may choose to challenge our patent rights relating to the reference product by initiating litigation during the 12-year period of exclusivity. After the FDA approves the BLA for the competing product, the competitor may also bring a declaratory judgment action of non-infringement, invalidity, and/or unenforceability of our patent rights. The law is complex and is still being interpreted and implemented by the FDA. As a result, its ultimate impact, implementation, and meaning are subject to uncertainty.

Current wording

The Patient Protection and Affordable Care Act (“ACA”) includes a subtitle called the Biologics Price Competition and Innovation Act of 2009 (“BPCIA”), which created an abbreviated approval pathway for biological products that are biosimilar to or interchangeable with an FDA-licensed reference biological product. Under the BPCIA, an application for a biosimilar product may not be submitted to the FDA until four years following the date that the reference product was first licensed by the FDA. In addition, the approval of a biosimilar product may not be made effective by the FDA until 12 years from the date on which the reference product was first licensed. During this 12-year period of exclusivity, another company may still market a competing product if the FDA approves a Biologics License Application, or BLA, for the competing product containing that company’s own preclinical data and data from adequate and well-controlled clinical trials to demonstrate the safety, purity, and potency of that company’s product. In addition, a competitor may choose to challenge our patent rights relating to the reference product by initiating litigation during the 12-year period of exclusivity. After the FDA approves the BLA for the competing product, the competitor may also bring a declaratory judgment action of non-infringement, invalidity, and/or unenforceability of our patent rights. The law is complex and is still being interpreted and implemented by the FDA, and recent FDA policies, described in draft guidance, could lower development burdens and accelerate the timing and volume of biosimilar competition. As a result, its ultimate impact, implementation, and meaning are subject to uncertainty.

Previous wording

We are aware of several companies and institutions that have developed, or are currently developing, alternative autologous or palliative gene therapy or other approaches for our targeted indications, including DEB, cystic fibrosis, solid tumors, and aesthetic skin conditions. Many of our potential competitors, alone or with their strategic partners, have substantially greater financial, technical, and other resources, such as larger research and development, clinical, marketing, and manufacturing organizations. Mergers and acquisitions in the biotechnology and pharmaceutical industries may result in even more resources being concentrated among a smaller number of competitors. Our commercial opportunities could be reduced or eliminated if competitors commercialize products that are safer, more effective, have fewer or less severe side effects, are more convenient, or are less expensive than VYJUVEK or any product candidate that we may commercialize. Competitors also may obtain FDA or other regulatory approval for their products more rapidly or earlier than we may obtain approval for our product candidates, which could result in our competitors establishing a strong market position before we are able to enter the market. Additionally, technologies developed by our competitors may render VYJUVEK or any of our product candidates uneconomical or obsolete, and we may not be successful in marketing VYJUVEK or any of our product candidates that obtain regulatory approval against such competitors.

Current wording

We are aware of several companies and institutions that have developed, or are currently developing, alternative autologous, or palliative gene therapy or other approaches for our targeted indications, including DEB. Many of our potential competitors, alone or with their strategic partners, have substantially greater financial, technical, and other resources, such as larger research and development, clinical, marketing, and manufacturing organizations. Mergers and acquisitions in the biotechnology and pharmaceutical industries may result in even more resources being concentrated among a smaller number of competitors. Our commercial opportunities could be reduced or eliminated if competitors commercialize products that are safer, more effective, have fewer or less severe side effects, are more convenient, or are less expensive than VYJUVEK or any product candidate that we may commercialize. Competitors also may obtain FDA or other regulatory approval for their products more rapidly or earlier than we may obtain approval for our product candidates, which could result in our competitors establishing a strong market position before we are able to enter the market. Additionally, technologies developed by our competitors may render VYJUVEK or any of our product candidates uneconomical or obsolete, and we may not be successful in marketing VYJUVEK or any of our product candidates that obtain regulatory approval against such competitors.

Previous wording

•decreased demand for VYJUVEK or any of our product candidates that are approved for commercial sale in the future;

Current wording

•decreased demand for VYJUVEK or any of our product candidates that are approved for commercial sale;

Previous wording

With respect to VYJUVEK and any of our product candidates that are approved for commercial sale in the future, we are, and will be, highly dependent upon physician and patient perceptions of us and the safety and quality of our products. We could be adversely affected if we are subject to negative publicity. We could also be adversely affected if any of our products or any similar products distributed by other companies prove to be, or are asserted to be, harmful to patients. Because of our dependence upon consumer perceptions, any adverse publicity could have a material adverse impact on our financial condition or results of operations.

Current wording

With respect to VYJUVEK and any of our product candidates that are approved for commercial sale, we are, and will be, highly dependent upon physician and patient perceptions of us and the safety and quality of our products. We could be adversely affected if we are subject to negative publicity. We could also be adversely affected if any of our products or any similar products distributed by other companies prove to be, or are asserted to be, harmful to patients. Because of our dependence upon consumer perceptions, any adverse publicity could have a material adverse impact on our financial condition or results of operations.

Previous wording

Our product liability insurance coverage may not be adequate to cover all liabilities that we may incur. We may need to increase our insurance coverage when we begin commercialization of VYJUVEK outside of the United States or the commercialization of our product candidates, if approved. Insurance coverage is becoming increasingly expensive. As a result, we may be unable to maintain or obtain sufficient insurance at a reasonable cost to protect us against losses that could have a material adverse effect on our business. A successful product liability claim, or series of claims brought against us, particularly if judgments exceed any insurance coverage we may have, could decrease our cash resources and adversely affect our business, financial condition, and results of operations.

Current wording

Our product liability insurance coverage may not be adequate to cover all liabilities that we may incur. We may need to increase our insurance coverage when we begin commercialization of our product candidates, if approved. Insurance coverage is becoming increasingly expensive. As a result, we may be unable to maintain or obtain sufficient insurance at a reasonable cost to protect us against losses that could have a material adverse effect on our business. A successful product liability claim, or series of claims brought against us, particularly if judgments exceed any insurance coverage we may have, could decrease our cash resources and adversely affect our business, financial condition, and results of operations.

Previous wording

Gene therapy remains a novel technology. Ethical, social, and legal concerns about gene therapy could result in additional regulations restricting or prohibiting VYJUVEK or our product candidates. Public perception may be influenced by claims that gene therapy is unsafe, and gene therapy may not gain the acceptance of the public or the medical community. In particular, our success depends upon physicians who specialize in the treatment of DEB or genetic diseases targeted by our product candidates prescribing VYJUVEK or treatments that involve the use of our product candidates that may be in lieu of, or in addition to, existing treatments with which they are familiar and for which greater clinical data may be available. More restrictive government regulations or negative public opinion would have an adverse effect on our business, financial condition, results of operations, and prospects and may delay or impair the commercialization of VYJUVEK, regulatory approval of our product candidates, or demand for VYJUVEK or any product candidates that are approved for commercial sale. For example, earlier gene therapy trials led to several well-publicized adverse events, including cases of leukemia and death seen in trials using other vectors. Serious adverse events in our clinical trials or other clinical trials involving gene therapy products, even if not ultimately attributable to the relevant product candidates, and the resulting publicity, could result in increased government regulation, unfavorable public perception, potential regulatory delays in the testing or approval of our product candidates, stricter labeling requirements for those product candidates that are approved, and a decrease in demand for any such product candidates.

Current wording

Gene therapy remains a novel technology. Ethical, social, and legal concerns about gene therapy could result in additional regulations restricting or prohibiting VYJUVEK or our product candidates. Public perception may be influenced by claims that gene therapy is unsafe, and gene therapy may not gain the acceptance of the public or the medical community. In particular, our success depends upon physicians who specialize in the treatment of DEB or genetic diseases targeted by our product candidates prescribing VYJUVEK or treatments that involve the use of our product candidates that may be in lieu of, or in addition to, existing treatments with which they are familiar and for which greater clinical data may be available. More restrictive government regulations or negative public opinion would have an adverse effect on our business, financial condition, results of operations, and prospects and may delay or impair the commercialization of VYJUVEK, regulatory approval of our product candidates, or demand for VYJUVEK or any product candidates that are approved for commercial sale. For example, other companies’ gene therapies and earlier gene therapy trials using other vectors led to several well-publicized adverse events, including death. Serious adverse events in our clinical trials or other clinical trials involving gene therapy products, even if not ultimately attributable to the relevant product candidates, and the resulting publicity, could result in increased government regulation, unfavorable public perception, potential regulatory delays in the testing or approval of our product candidates, stricter labeling requirements for those product candidates that are approved, and a decrease in demand for any such product candidates.

Previous wording

From time to time, we may become involved in disputes, claims, and lawsuits relating to our business operations. For example, we may face or initiate claims related to intellectual property matters, employment matters, or commercial matters. Any dispute, claim, or lawsuit may divert management’s attention away from our business, we may incur significant expenses in addressing or defending any dispute, claim, or lawsuit, and we may be required to pay damage awards or settlements or become subject to equitable remedies that could materially and adversely affect our operations and financial results. In addition, the uncertainty associated with litigation could lead to increased volatility in our stock price.

Current wording

From time to time, we may become involved in disputes, claims, and lawsuits relating to our business operations. For example, we may face or initiate claims related to intellectual property matters, employment matters, or commercial matters. Any dispute, claim, or lawsuit may divert management’s attention away from our business, result in significant expenses to address or defend such matters, and require us to pay damage awards or settlements or become subject to equitable remedies, any of which could materially and adversely affect our operations and financial results. In addition, the uncertainty associated with litigation could lead to increased volatility in our stock price.

Previous wording

Social media is increasingly being used by us, our employees, or others to communicate about our business, VYJUVEK, our clinical development programs, DEB, and the diseases our product candidates are being developed to treat. We use social media in connection with our commercialization efforts of VYJUVEK and intend to use it in connection with our commercialization efforts of our product candidates, if approved. Social media practices in the biotechnology and biopharmaceutical industries continue to evolve, and regulations and regulatory guidance relating to such use are evolving and not always clear. This evolution creates uncertainty and risk of noncompliance with regulations applicable to our business, resulting in potential regulatory actions against us, along with the potential for litigation and heightened scrutiny by the FDA, the Securities and Exchange Commission, or the SEC, and other regulators. For example, patients may use social media channels to comment on their experience in an ongoing clinical trial of our product candidates, or to report an alleged adverse event. If such disclosures occur, there is a risk that clinical trial enrollment may be adversely impacted, that we may fail to monitor and comply with applicable adverse event reporting obligations, or that we may not be able to defend our business or the public’s legitimate interests in the face of the political and market pressures generated by social media due to restrictions on what we may say about our product candidates. There is also a risk of inappropriate disclosure of sensitive information, loss of trade secrets or other intellectual property, public exposure of personal information of our employees, patients who use VYJUVEK, clinical trial patients, and others, or negative or inaccurate posts or comments about us on any social networking website. In addition, we may encounter attacks on social media regarding our company, management, VYJUVEK, or our product candidates that seriously damage our reputation, brand image, and goodwill. If any of these events were to occur or we otherwise fail to comply with applicable regulations, we could incur liability, face regulatory actions, or incur other harm to our business that could have a material adverse effect on our business, prospects, operating results, and financial condition, and could adversely affect the price of our common stock.

Current wording

Social media is increasingly being used by us, our employees, or others to communicate about our business, VYJUVEK, our clinical development programs, DEB, and the diseases our product candidates are being developed to treat. We use social media in connection with our commercialization efforts of VYJUVEK and intend to use it in connection with our commercialization efforts of our product candidates, if approved. Social media practices in the biotechnology and biopharmaceutical industries continue to evolve, and regulations and regulatory guidance relating to such use are evolving and not always clear. This evolution creates uncertainty and risk of noncompliance with regulations applicable to our business, resulting in potential regulatory actions against us, along with the potential for litigation and heightened scrutiny by the FDA, the European Medicines Agency, or EMA, the European Commission, the MHLW, the SEC, and other regulators. For example, patients may use social media to comment on their experience in an ongoing clinical trial of our product candidates, or to report an alleged adverse event. If such disclosures occur, there is a risk that clinical trial enrollment may be adversely impacted, that we may fail to monitor and comply with applicable adverse event reporting obligations, or that we may not be able to defend our business or the public’s legitimate interests in the face of the political and market pressures generated by social media due to restrictions on what we may say about our product candidates. There is also a risk of inappropriate disclosure of sensitive information, loss of trade secrets or other intellectual property, public exposure of personal information of our employees, patients who use VYJUVEK, clinical trial patients, and others, or negative or inaccurate posts or comments about us on social media. In addition, we may encounter attacks on social media regarding our company, management, VYJUVEK, or our product candidates that seriously damage our reputation, brand image, and goodwill. If any of these events were to occur or we otherwise fail to comply with applicable regulations, we could incur liability, face regulatory actions, or incur other harm to our business that could have a material adverse effect on our business, prospects, operating results, and financial condition, and could adversely affect the price of our common stock.

Previous wording

We are exposed to the risk of fraud or other misconduct by our employees, principal investigators, and advisors. Misconduct by these parties could include intentional failures to comply with FDA regulations or the regulations applicable in the EU and other jurisdictions, provide accurate information to the FDA, the EMA, and other regulatory authorities, comply with healthcare fraud and abuse laws and regulations in the United States and abroad, report financial information or data accurately or disclose unauthorized activities. Sales, marketing, and business arrangements in the healthcare industry are subject to extensive laws and regulations intended to prevent fraud, misconduct, kickbacks, self-dealing, and other abusive practices. These laws and regulations restrict or prohibit a wide range of pricing, discounting, marketing and promotion, sales commission, customer incentive programs, and other business arrangements. It is not always possible to identify and deter employee misconduct, and the precautions we take to detect and prevent this activity may not be effective in controlling unknown or unmanaged risks or losses or in protecting us from government investigations or other actions or lawsuits stemming from a failure to comply with these laws or regulations. If any such actions are instituted against us and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business, financial condition, results of operations, and prospects, including the imposition of significant fines, criminal penalties, or other sanctions.

Current wording

We are exposed to the risk of fraud or other misconduct by our employees, principal investigators, and advisors. Misconduct by these parties could include intentional failures to comply with FDA regulations, regulations applicable in the EU, Japan, and other jurisdictions; to provide accurate information to the FDA, the European Commission, the EMA, the MHLW, and other regulatory authorities; to comply with healthcare fraud and abuse laws and regulations in the United States and abroad; to report financial information or data accurately; or to disclose unauthorized activities. Sales, marketing, and business arrangements in the healthcare industry are subject to extensive laws and regulations intended to prevent fraud, misconduct, kickbacks, self-dealing, and other abusive practices. These laws and regulations restrict or prohibit a wide range of pricing, discounting, marketing and promotion, sales commission, customer incentive programs, and other business arrangements. It is not always possible to identify and deter employee misconduct, and the precautions we take to detect and prevent this activity may not be effective in controlling unknown or unmanaged risks or losses or in protecting us from government investigations or other actions or lawsuits stemming from a failure to comply with these laws or regulations. If any such actions are instituted against us and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business, financial condition, results of operations, and prospects, including the imposition of significant fines, criminal penalties, or other sanctions.

Previous wording

In addition, principal investigators for our clinical trials may serve as scientific advisors or consultants to us from time to time and receive compensation in connection with such services. Under certain circumstances, we may be required to report some of these relationships to the FDA. The FDA may conclude that a financial relationship between us and a principal investigator has created a conflict of interest or otherwise affected interpretation of the clinical trial. The FDA may therefore question the integrity of the data generated at the applicable clinical trial site and the utility of the clinical trial itself may be jeopardized. This could result in a delay in approval, or rejection, of our marketing applications by the FDA and may ultimately lead to the denial of marketing approval of our current and future product candidates.

Current wording

In addition, principal investigators for our clinical trials may serve as scientific advisors or consultants to us from time to time and receive compensation in connection with such services. Under certain circumstances, we may be required to report some of these relationships to the FDA or regulators in other jurisdictions if we conduct clinical trials outside of the United States. The FDA or other applicable regulators may conclude that a financial relationship between us and a principal investigator has created a conflict of interest or otherwise affected interpretation of the clinical trial data. The FDA or other applicable regulators may therefore question the integrity of the data generated at the applicable clinical trial site and the utility of the clinical trial itself may be jeopardized. This could result in a delay in approval, or rejection, of our marketing applications by the FDA or foreign regulators and may ultimately lead to the denial of marketing approval of our current and future product candidates.

Previous wording

In August 2022, the IRA was signed into law. The IRA includes several provisions to lower prescription drug costs for people with Medicare and reduce drug spending by the federal government. In relevant part, the IRA allows Medicare to negotiate prices for certain prescription drugs, requires drug manufacturers to pay a rebate to the federal government if prices for single-source drugs and biologicals covered under Medicare Part B and nearly all covered drugs under Part D increase faster than the rate of inflation, caps out of pocket spending for Medicare Part D enrollees, and makes other benefit design changes to Medicare Part D intended to lower drug costs for enrollees and Medicare. Implementation of these changes began in 2023 and will continue to be implemented over the next several years. Beginning January 1, 2025, Medicare Part D enrollees now have a new annual out-of-pocket cap of $2,000 on prescription drugs. Other 2025 Medicare Part D changes include the elimination of the coverage gap phase and the replacement of the Coverage Gap Discount Program with the Manufacturer Discount Program, which requires drug manufacturers to pay a 10% discount for brand-name drugs and biologics during the initial coverage period and a 20% discount during the catastrophic phase. Multiple pharmaceutical manufacturers have challenged the law in court, largely on constitutional grounds. These suits will likely continue and the ultimate effects of such legal challenges are unclear.

Current wording

In August 2022, the Inflation Reduction Act (“IRA”) was signed into law. The IRA includes several provisions to lower prescription drug costs for people with Medicare and reduce drug spending by the federal government. In relevant part, the IRA allows Medicare to negotiate prices for certain prescription drugs, requires drug manufacturers to pay a rebate to the federal government if prices for single-source drugs and biologicals covered under Medicare Part B and nearly all covered drugs under Part D increase faster than the rate of inflation, caps out of pocket spending for Medicare Part D enrollees, and makes other benefit design changes to Medicare Part D intended to lower drug costs for enrollees and Medicare. Implementation of these changes began in 2023 and will continue to be implemented over the next several years. Beginning January 1, 2025, Medicare Part D enrollees now have a new annual out-of-pocket cap of $2,000 on prescription drugs. Other 2025 Medicare Part D changes include the elimination of the coverage gap phase and the replacement of the Coverage Gap Discount Program with the Manufacturer Discount Program, under which drug manufacturers are required provide a 10% discount for brand-name drugs and biologics during the initial coverage phase and a 20% discount during the catastrophic phase. Multiple pharmaceutical manufacturers have challenged the law in court, largely on constitutional grounds. To date, the majority of these challenges have been unsuccessful, with courts upholding the IRA. However, these suits will likely continue and the ultimate effects of such legal challenges are unclear. On April 15, 2025, President Trump issued an executive order directing the Secretary of the Department of Health and Human Services to take certain actions on drug pricing reform, including working with Congress on amendments to the IRA and rule making to establish new Medicare payment models for so-called “high-cost” prescription drugs and biological products. Subsequently, President Trump has issued additional executive orders directing additional actions designed to lower drug prices, including by tying the price of certain drugs to the price of those drugs in other countries. It is unclear whether the Trump administration executive orders will lead to actual legislative initiatives. At this time, we continue to evaluate the effect of the IRA and the Trump administration’s executive actions on our business operations and financial condition and results as the full impact of the IRA and the executive actions remains uncertain.

Previous wording

Further, there has been heightened governmental scrutiny in recent years over the manner in which manufacturers set prices for their marketed products and the cost of prescription drugs to consumers and government healthcare programs, which have resulted in several recent Congressional inquiries and proposed and enacted bills designed to, among other things, reduce the cost of prescription drugs, bring more transparency to product pricing, review the relationship between pricing and manufacturer patient programs, and reform government program reimbursement methodologies for products. In addition, the United States government, state legislatures, and foreign governments have shown significant interest in implementing cost containment programs, including price-controls, restrictions on reimbursement and requirements for substitution of generic products for branded prescription drugs to limit the growth of government paid health care costs. For example, the United States government has passed legislation requiring pharmaceutical manufacturers to provide rebates and discounts to certain entities and governmental payors to participate in federal healthcare programs. Individual states in the United States have also been increasingly passing legislation and implementing regulations designed to control pharmaceutical product pricing, including price or patient reimbursement constraints, discounts, restrictions on certain product access and marketing cost disclosure and transparency measures, and, in some cases, designed to encourage importation from other countries and bulk purchasing.

Current wording

Further, there has been heightened governmental scrutiny in recent years over the manner in which manufacturers set prices for their marketed products and the cost of prescription drugs to consumers and government healthcare programs, which have resulted in several recent Congressional inquiries and proposed and enacted bills designed to, among other things, reduce the cost of prescription drugs, bring more transparency to product pricing, review the relationship between pricing and manufacturer patient programs, and reform government program reimbursement methodologies for products. In addition, the United States government, state legislatures, and foreign governments have shown significant interest in implementing cost containment programs, including price-controls, restrictions on reimbursement, and requirements for substitution of generic products for branded prescription drugs to limit the growth of government paid health care costs. For example, the United States government has passed legislation requiring pharmaceutical manufacturers to provide rebates and discounts to certain entities and governmental payors to participate in federal healthcare programs. Individual states in the United States have also increasingly enacted legislation and implemented regulations designed to control pharmaceutical product pricing, including price or patient reimbursement constraints, required discounts, restrictions on certain product access and marketing cost disclosure and transparency measures, and, in some cases, measures designed to encourage importation from other countries and bulk purchasing.

Previous wording

Additional changes may affect our business, including those governing enrollment in federal healthcare programs, reimbursement changes, fraud and abuse enforcement, and expansion of new programs, such as Medicare payment for performance initiatives. Healthcare reform measures that may be adopted in the future, may result in more rigorous coverage criteria and in additional downward pressure on the price that we receive for any approved product. Any reduction in reimbursement from Medicare or other government programs may result in a similar reduction in payments from private payors. The implementation of cost containment measures or other healthcare reforms could result in reduced demand for our product and product candidates or additional pricing pressures and may adversely impact our ability to generate sufficient revenue, attain consistent profitability, or commercialize our product candidates, if approved.

Current wording

Additional changes may affect our business, including those governing enrollment in federal healthcare programs, reimbursement changes, fraud and abuse enforcement, and expansion of new programs, such as Medicare payment for performance initiatives. Healthcare reform measures that may be adopted could result in more rigorous coverage criteria and in additional downward pressure on the price that we receive for any approved product. Any reduction in reimbursement from Medicare or other government programs may result in a similar reduction in payments from private payors. The implementation of cost containment measures or other healthcare reforms could result in reduced demand for our product and product candidates that are approved for sale or additional pricing pressures and may adversely impact our ability to generate sufficient revenue, attain consistent profitability, or commercialize our product candidates, if approved.

Previous wording

With the FDA approval of VYJUVEK, our operations are directly, or indirectly through our prescribers, customers, and purchasers, subject to various federal and state fraud and abuse laws and regulations, including, without limitation, the federal Anti-Kickback Statute, federal civil and criminal false claims laws and the Physician Payments Sunshine Act and regulations. These laws impact, among other things, our sales, marketing, access assistance, sponsored genetic patient testing, and educational programs. In addition, we are subject to patient privacy laws by both the federal government and the states in which we conduct our business, as well as by foreign jurisdictions. The laws that affect our operations include, but are not limited to:

Current wording

With the FDA approval of VYJUVEK, our operations are directly, or indirectly through our prescribers, customers, and purchasers, subject to various federal and state fraud and abuse laws and regulations, including, without limitation, the federal Anti-Kickback Statute, federal civil and criminal false claims laws, and the Physician Payments Sunshine Act and regulations. These laws impact, among other things, our sales, marketing, access assistance, sponsored genetic patient testing, and educational programs. In addition, we are subject to privacy and data security laws concerning personal information and health information imposed by both the federal government and the states in which we conduct our business, as well as by foreign jurisdictions. The laws that affect our operations include, but are not limited to:

Previous wording

•federal civil and criminal false claims laws and civil monetary penalty laws which prohibit, among other things, individuals or entities from knowingly presenting, or causing to be presented, claims for payment or approval from Medicare, Medicaid, or other government payors that are false or fraudulent. The ACA provides that a claim for items or services resulting from an Anti-Kickback Statute violation is a false claim under the FCA. Cases against pharmaceutical manufacturers support the view that certain marketing practices, including off-label promotion, may implicate the FCA;

Current wording

•federal civil and criminal false claims laws and civil monetary penalty laws which prohibit, among other things, individuals or entities from knowingly presenting, or causing to be presented, claims for payment or approval from Medicare, Medicaid, or other government payors that are false or fraudulent. The ACA provides that a claim for items or services resulting from an Anti-Kickback Statute violation is a false claim under the False Claims Act (“FCA”). Cases against pharmaceutical manufacturers support the view that certain marketing practices, including off-label promotion, may implicate the FCA;

Previous wording

•the HIPAA Rules, which impose certain requirements relating to the privacy, security, and transmission of individually identifiable health information by certain entities subject to the HIPAA Rules, such as health plans, health care clearinghouses, and health care providers that engage in certain covered transactions, known as covered entities, as well as their business associates that perform certain services that involve the use or disclosure of individually identifiable health information for or on behalf of covered entities;

Current wording

•the Health Insurance Portability and Accountability Act of 1996 Rules (“HIPAA Rules”), which impose certain requirements relating to the privacy, security, and transmission of individually identifiable health information by certain entities subject to the HIPAA Rules, such as health plans, health care clearinghouses, and health care providers that engage in certain covered transactions, known as covered entities, as well as their business associates that perform certain services that involve the use or disclosure of individually identifiable health information for or on behalf of covered entities;

Previous wording

•federal transparency laws, including the federal Physician Payment Sunshine Act, that require certain manufacturers of drugs, devices, biologics, and medical supplies for which payment is available under Medicare, Medicaid, or the Children’s Health Insurance Program, with specific exceptions, to report annually to CMS information related to: (i) payments or other “transfers of value” made to physicians and teaching hospitals, and (ii) ownership and investment interests held by physicians and their immediate family members;

Current wording

•federal transparency laws, including the federal Physician Payment Sunshine Act, that require certain manufacturers of drugs, devices, biologics, and medical supplies for which payment is available under Medicare, Medicaid, or the Children’s Health Insurance Program, with specific exceptions, to report annually to the United States Centers for Medicare and Medicaid Services (“CMS”) information related to: (i) payments or other “transfers of value” made to physicians and teaching hospitals, and (ii) ownership and investment interests held by physicians and their immediate family members;

Previous wording

•state and foreign law equivalents of each of the above federal laws, state laws that require drug manufacturers to report information related to payments and other transfers of value to physicians and other healthcare providers or marketing expenditures; and

Current wording

•U.S. state and foreign law equivalents of each of the above federal laws, state laws that require drug manufacturers to report information related to payments and other transfers of value to physicians and other healthcare providers or marketing expenditures; and

Previous wording

The risk of our being found in violation of these laws is increased by the fact that many of them have not been fully interpreted by the regulatory authorities or the courts, and their provisions are open to a variety of interpretations. Any action against us for violation of these laws, even if we successfully defend against it, could cause us to incur significant legal expenses and divert our management’s attention from the operation of our business. The shifting compliance environment and the need to build and maintain a robust and expandable systems to comply with multiple jurisdictions with different compliance and/or reporting requirements increases the possibility that we may run afoul of one or more of the requirements.

Current wording

The risk of our being found in violation of these laws is increased by the fact that many of them have not been fully interpreted by the regulatory authorities or the courts, and their provisions are open to a variety of interpretations. Any action against us for violation of these laws, even if we successfully defend against such action, could cause us to incur significant legal expenses and divert our management’s attention from the operation of our business. The shifting compliance environment and the need to build and maintain a robust and expandable systems to comply with multiple jurisdictions with different compliance and/or reporting requirements increases the possibility that we may run afoul of one or more of the requirements.

Previous wording

Although we maintain workers’ compensation insurance for certain costs and expenses we may incur due to injuries to our employees resulting from the use of hazardous materials or other work-related injuries, this insurance may not provide adequate coverage against potential liabilities. We also may incur substantial costs to comply with current or future environmental, health, and safety laws and regulations, which have tended to become more stringent over time. These current or future laws and regulations may impair our research, development, or production efforts. Failure to comply with these laws and regulations also may result in substantial fines, penalties, or other sanctions or liabilities, which could materially adversely affect our business, financial condition, results of operations, and prospects.

Current wording

Although we maintain workers’ compensation insurance for certain costs and expenses that we may incur due to injuries to our employees resulting from the use of hazardous materials or other work-related injuries, this insurance may not provide adequate coverage against potential liabilities. We also may incur substantial costs to comply with current or future environmental, health, and safety laws and regulations, which have tended to become more stringent over time. These current or future laws and regulations may impair our research, development, or production efforts. Failure to comply with these laws and regulations also may result in substantial fines, penalties, or other sanctions or liabilities, which could materially adversely affect our business, financial condition, results of operations, and prospects.

Previous wording

Privacy and data security have become significant areas of legal and regulatory focus in the United States, European Union, and in many other jurisdictions where we conduct or may conduct our operations. In our ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, “process”) personal information and other sensitive information, including, but not limited to, health information, individuals’ financial information, as well as proprietary and confidential business data, including trade secrets, intellectual property, and sensitive third-party data (collectively, “sensitive data”). The legislative and regulatory landscape for privacy and data security continues to evolve, and there has been an increasing focus on privacy and data security issues, which may affect our business and is expected to increase our compliance costs and exposure to liability. Our data processing activities may subject us to numerous privacy and data security obligations, including, but not limited to, domestic and international laws, regulations, guidance, industry standards, external and internal privacy and security policies, and contractual requirements.

Current wording

Privacy and data security have become significant areas of legal and regulatory focus in the United States, European Union, Japan, and in many other jurisdictions where we conduct or may conduct our operations. In our ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, “process”) personal information and other sensitive information, including, but not limited to, health information, individuals’ financial information, as well as proprietary and confidential business data, including trade secrets, intellectual property, and sensitive third-party data (collectively, “sensitive data”). The legislative and regulatory landscape for privacy and data security continues to evolve, and there has been an increasing focus on privacy and data security issues, which may affect our business and is expected to increase our compliance costs and exposure to liability. Our data processing activities may subject us to numerous privacy and data security obligations, including, but not limited to, domestic and international laws, regulations, guidance, industry standards, external and internal privacy and security policies, and contractual requirements.

Previous wording

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal information privacy laws, consumer protection laws, and other similar laws. Notably, HIPAA, as amended by HITECH, imposes requirements on covered entities, as well as their business associates regarding the privacy, security, and transmission of individually identifiable health information. Further, states continue to adopt new laws or amend existing laws related to data privacy, requiring attention to frequently changing regulatory requirements. For example, and the California Consumer Privacy Act of 2018 (“CCPA”) requires businesses to provide specific disclosures in their privacy notices and honor residents’ privacy rights. The CCPA provides for civil penalties of up to $7,500 per violation and allows private litigants affected by certain data breaches to recover significant statutory damages. Although the CCPA does not apply to certain data that we process in the context of clinical trials, efforts to comply with the CCPA may increase our annual compliance costs and subject us to potential liability with respect to other personal information we may maintain about California residents. In addition, the California Privacy Rights Act of 2020 (“CPRA”), which came into effect on January 1, 2023, expanded the CCPA’s requirements, extending it to cover personal information of business representatives and employees and the CPRA established a new regulatory agency to implement and enforce the law. Other states, such as Virginia, Nevada, Connecticut, Utah, Texas, and Colorado, have also passed comprehensive privacy laws, and similar laws are being considered in several other states, as well as at the federal and local levels, which impose similar obligations to those in the CCPA. Further, other states, such as Nevada and Washington, have enacted privacy laws specifically governing consumer health information, with Washington providing for a private right of action. Although many of these laws currently exempt certain health-related information, the laws may increase our potential liability related to our data processing activities, complicate our compliance efforts, and increase both legal risk and compliance costs for us and the third parties upon whom we rely.

Current wording

Further, states continue to adopt new laws or amend existing laws related to privacy and data security, requiring attention to frequently changing regulatory requirements. For example, the California Consumer Privacy Act of 2018 (“CCPA”) requires businesses to provide specific disclosures in their privacy notices and honor residents’ privacy rights. The CCPA provides for civil penalties of up to $7,500 per violation and allows private litigants affected by certain data breaches to recover significant statutory damages. Although the CCPA does not apply to certain data that we process in the context of clinical trials, efforts to comply with the CCPA may increase our annual compliance costs and subject us to potential liability with respect to other personal information we may maintain about California residents. In addition, the California Privacy Rights Act of 2020 (“CPRA”), which came into effect on January 1, 2023, expanded the CCPA’s requirements, extending it to cover personal information of business representatives and employees and the CPRA established a new regulatory agency to implement and enforce the law. Other states, such as Virginia, Nevada, Connecticut, Utah, Texas, Colorado, Oregon, Montana, Iowa, Indiana, Tennessee, Delaware, and New Jersey, have enacted comprehensive privacy laws that have taken effect or are scheduled to take effect, and similar laws are being considered in several other states, as well as at the federal and local levels, which impose similar obligations to those in the CCPA. Further, other states, such as Nevada and Washington, have enacted privacy laws specifically governing consumer health information, with Washington providing for a private right of action, and additional states are considering similar consumer health information-related laws. Although many of these laws currently exempt certain health-related information, the laws may increase our potential liability related to our data processing activities, complicate our compliance efforts, and increase both legal risk and compliance costs for us and the third parties upon whom we rely.

Previous wording

Outside of the United States, there are an increasing number of laws, regulations, and industry standards regarding privacy and data security. For example, the EU General Data Protection Regulation (“GDPR”) and UK GDPR impose strict requirements for processing personal information, and companies that violate the GDPR may face temporary or permanent bans on certain data processing activities and they may be subject to other penalties such as fines of up to 20 million Euros under the EU GDPR / 17.5 million pounds sterling under the UK GDPR or 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal information brought by classes of data subjects or consumer protection organizations authorized to represent data subjects’ interests.

Current wording

Outside of the United States, there are an increasing number of laws, regulations, and industry standards regarding privacy and data security. For example, the EU General Data Protection Regulation (“GDPR”), the Japanese Act on the Protection of Personal Information, and UK GDPR impose strict requirements on processing personal information. Companies that violate the GDPR may face temporary or permanent bans on certain data processing activities and may be subject to significant penalties, including fines of up to 20 million Euros under the EU GDPR or 17.5 million pounds sterling under the UK GDPR, or 4% of annual global revenue, whichever is greater. In addition, companies may be subject to private litigation relating to processing of personal information, including actions brought by brought by classes of data subjects or consumer protection organizations authorized to represent data subjects’ interests.

Previous wording

In some circumstances, we may be unable to transfer personal information between certain jurisdictions due to data localization requirements or other limitations on cross-border data flows. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal information to other countries. In particular, the European Economic Area (“EEA”) and the UK have significantly restricted the transfer of personal information to the United States and other countries whose privacy laws they consider inadequate. Although there are various mechanisms that may be used to transfer personal information from the EEA and UK to the United States in compliance with the law, such as the EEA and UK’s standard contractual clauses, these mechanisms are subject to legal challenges, and we may be unable to rely on these measures to lawfully transfer personal information to the United States in all cases. If there is no lawful manner for us to transfer personal information from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally compliant transfer are too onerous, we could face significant adverse consequences, including increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors, and other third parties, and injunctions against our processing or transferring of personal information necessary to operate our business. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers of personal information to recipients outside Europe for allegedly violating the EU GDPR’s cross-border data transfer limitations. Additionally, companies that transfer personal information to recipients outside of the EEA and/or UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups.

Current wording

In some circumstances, we may be unable to transfer personal information between certain jurisdictions due to data localization requirements or other limitations on cross-border data flows. The European Economic Area (“EEA”), the UK, Japan, and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal information to other countries. In particular, the EEA and the UK have significantly restricted the transfer of personal information to the United States and other countries whose privacy laws they consider inadequate. Although there are various mechanisms that may be used to transfer personal information from the EEA and UK to the United States in compliance with the law, such as the EEA and UK’s standard contractual clauses, and other approved data transfer mechanisms, these mechanisms are subject to legal challenges, and we may be unable to rely on these measures to lawfully transfer personal information to the United States in all cases. If there is no lawful manner for us to transfer personal information from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally compliant transfer are too onerous, we could face significant adverse consequences, including increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors, and other third parties, and injunctions against our processing or transferring of personal information necessary to operate our business. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers of personal information to recipients outside of the EEA for allegedly violating the EU GDPR’s cross-border data transfer limitations. Additionally, companies that transfer personal information to recipients outside of the EEA and/or UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups.

Previous wording

We may at times fail (or be perceived to have failed) in our efforts to comply with our privacy and data security obligations. Moreover, despite our efforts, our personnel or third parties on whom we rely on may fail to comply with such obligations, which could negatively impact our business operations. If we or the third parties that process personal information or other sensitive data our behalf fail, or are perceived to have failed, to address or comply with applicable privacy and data security obligations, we could face significant consequences, including but not limited to government enforcement actions (e.g., investigations, fines, penalties, audits, and inspections), litigation (including class-action claims), additional reporting requirements and/or oversight, bans on processing personal information, and orders to destroy or not use personal information. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to loss of customers, significant reputational harm, an inability to process personal information or to operate in certain jurisdictions, limited ability to commercialize VYJUVEK or develop and commercialize our product candidates, expenditures of time and resources to defend ourselves against claims or inquiries, adverse publicity, or substantial changes to our business model or operations.

Current wording

We may at times fail (or be perceived to have failed) in our efforts to comply with our privacy and data security obligations. Moreover, despite our efforts, our personnel or third parties on whom we rely may fail to comply with such obligations, which could negatively impact our business operations. If we or the third parties that process personal information or other sensitive data on our behalf fail, or are perceived to have failed, to address or comply with applicable privacy and data security obligations, we could face significant consequences, including but not limited to government enforcement actions (e.g., investigations, fines, penalties, audits, and inspections), litigation (including class-action claims), additional reporting requirements and/or oversight, bans on processing personal information, and orders to destroy or not use personal information. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to loss of customers, significant reputational harm, an inability to process personal information or to operate in certain jurisdictions, limited ability to commercialize VYJUVEK or develop and commercialize our product candidates, expenditures of time and resources to defend ourselves against claims or inquiries, adverse publicity, or substantial changes to our business model or operations.

Previous wording

Unfavorable global economic conditions could adversely affect our business, financial condition, or results of operations.

Current wording

Unfavorable global economic and geopolitical conditions could adversely affect our business, financial condition, or results of operations.

Previous wording

Our results of operations could be adversely affected by general conditions in the global economy and in the global financial markets, including inflation and interest rates and concerns of a recession in the United States or other major markets due to a number of factors. In addition, the conflict between Russia and Ukraine and the conflicts in the Middle East may lead to a prolonged, adverse impact on global economic, sociopolitical, and market conditions. A severe or prolonged economic downturn could result in a variety of risks to our business, including our ability to raise additional capital if needed or on acceptable terms, if at all. A weak or declining economy, sanctions, trade restrictions, and other global conditions could also strain our suppliers, possibly resulting in supply delays or disruptions. Any of the foregoing could materially and adversely affect our business, and we cannot anticipate all the ways in which the current economic climate and financial market conditions could adversely impact our business, financial condition, results of operations, and prospects.

Current wording

Our results of operations could be adversely affected by general conditions in the global economy and in the global financial markets, including inflation and interest rates and concerns of a recession in the United States or other major markets due to a number of factors. In addition, the current geopolitical uncertainty may lead to prolonged, adverse impacts on global economic, sociopolitical, and market conditions. A severe or prolonged economic downturn could result in a variety of risks to our business, including our ability to raise additional capital if needed or on acceptable terms, if at all. A weak or declining economy, sanctions, trade restrictions, and other global conditions could also strain our suppliers, possibly resulting in supply delays or disruptions. In addition, we may be impacted by the imposition of tariffs, trade protection measures or other policies adopted by any jurisdiction that favors domestic companies and technologies over foreign competitors. Any of the foregoing could materially and adversely affect our business, and we cannot anticipate all the ways in which the current economic climate and financial market conditions could adversely impact our business, financial condition, results of operations, and prospects.

Previous wording

Certain data breaches must be reported to affected individuals and various government and/or regulatory agencies, and in some cases to the media, under provisions of HIPAA, other U.S. federal and state laws, and requirements of non-U.S. jurisdictions, including the EU GDPR and relevant member state law in the European Union and other foreign laws. Although we maintain cyber-security and other customary insurance, our insurance policies may not be adequate to compensate us for the potential losses arising from breaches, failures, or disruptions of our infrastructure. In addition, such insurance may not be available to us in the future on economically reasonable terms, or at all. Further, our insurance may not cover all claims made against us and defending a suit, regardless of its merit, could be costly and divert management’s attention. Any security breach involving the misappropriation, loss or other unauthorized disclosure or use of confidential information of others, whether by us or a third-party, could: (i) subject us to civil and criminal penalties; (ii) have a negative impact on our reputation; or (iii) expose us to liability to third parties or government authorities.

Current wording

Certain data breaches must be reported to affected individuals and various government and/or regulatory agencies, and in some cases to the media, under provisions of HIPAA, other U.S. federal and state laws, and requirements of non-U.S. jurisdictions, including the EU GDPR and relevant member state law in the EU and other foreign laws. Although we maintain cyber-security and other customary insurance, our insurance policies may not be adequate to compensate us for the potential losses arising from breaches, failures, or disruptions of our infrastructure. In addition, such insurance may not be available to us in the future on economically reasonable terms, or at all. Further, our insurance may not cover all claims made against us and defending a suit, regardless of its merit, could be costly and divert management’s attention. Any security breach involving the misappropriation, loss or other unauthorized disclosure or use of confidential information of others, whether by us or a third-party, could: (i) subject us to civil and criminal penalties; (ii) have a negative impact on our reputation; or (iii) expose us to liability to third parties or government authorities.

Previous wording

Artificial intelligence (“AI”)-based platforms and tools are increasingly being used in the biopharmaceutical industry, and we have adopted and integrated in limited situations artificial intelligence platforms for limited specific business uses and may adopt and integrate additional artificial intelligence platforms and/or tools into our business. As with many technological innovations, artificial intelligence presents opportunities, risks and challenges that could impact our business. Harnessing AI’s potential may enable us to speed up the discovery and development of new product candidates, optimize our manufacturing processes, and drive efficiencies. However, AI may exacerbate existing risks, including risks associated with data privacy, cybersecurity, intellectual property, healthcare fraud and abuse, product development and manufacturing, and risks to subjects in clinical trials.

Current wording

Artificial intelligence (“AI”)-based platforms and tools are increasingly being used in the biopharmaceutical industry, and we have adopted and integrated in limited situations artificial intelligence platforms for limited specific business uses and may adopt and integrate additional AI platforms and/or tools into our business. As with many technological innovations, AI presents opportunities, risks and challenges that could impact our business. Harnessing AI’s potential may enable us to speed up the discovery and development of new product candidates, optimize our manufacturing processes, and drive efficiencies. However, AI may exacerbate existing risks, including risks associated with data privacy, cybersecurity, intellectual property, healthcare fraud and abuse, product development and manufacturing, and risks to subjects in clinical trials.

Previous wording

If the models underlying AI technologies that we may use are incorrectly designed or implemented, trained, or reliant on incomplete, inadequate, inaccurate, biased, or otherwise poor quality data, or on data to which we do not have sufficient rights or in relation to which we and/or the providers of such data have not implemented sufficient legal compliance measures, used without sufficient oversight and governance to ensure their responsible use, misused, or used outside of scope of applicable regulatory authorizations, and/or adversely impacted by unforeseen defects, technical challenges, cybersecurity threats, or material performance issues, the performance of our products and business, as well as our reputation, could suffer or we could incur liability resulting from the violation of laws or contracts to which we are a party, regulatory enforcement actions, or civil claims.

Current wording

If the models underlying AI technologies that we use or may use are incorrectly designed, implemented, or trained; rely on incomplete, inadequate, biased, or otherwise poor-quality data; rely on data with respect to which we do not have sufficient rights or for which we or the data providers have not implemented appropriate legal compliance measures; are used without sufficient oversight and governance to ensure responsible use; are misused, or used outside the scope of applicable regulatory authorizations; or are adversely impacted by unforeseen defects, technical challenges, cybersecurity threats, or material performance issues, the performance of our products and business, as well as our reputation, could suffer. In addition, we could incur liability as a result of violations of applicable laws or contracts to which we are a party, regulatory enforcement actions, or civil claims.

Previous wording

Additionally, the use of AI solutions by us or third parties on which we rely could lead to (i) the public disclosure of confidential information (including personal data of our employees, clinical trial participants, or other third parties) in contravention of our internal policies, data protection laws, other applicable laws, or contractual requirements, and/or (ii) the loss of proprietary information, trade secrets, or other intellectual property. In addition to existing risks, AI also introduces new risks, due to the autonomous nature of the technology, which, in some cases, may be deployed to perform tasks, inform decisions, automate decisions, and make predictions. AI may amplify biased and discriminatory decision making, perform unreliably and malfunction, generate insights which are difficult to interpret and explain, and cause direct harm to individuals or groups. Our failure to use AI technologies in a way that maintains trust, quality and control in our business activities and to capitalize on opportunities presented by AI may place us at a competitive disadvantage. Furthermore, uncertainties regarding developing legal and regulatory requirements and standards may require significant resources to modify and maintain business practices to comply with such laws and regulations concerning the use of AI. Failure to address AI risks could reduce our ability to deliver on our strategic objectives, result in reputational harm, and have a material adverse effect on our business, prospects, operating results, and financial condition.

Current wording

Additionally, the use of AI solutions by us or third parties on which we rely could lead to (i) the public disclosure of confidential information (including personal data of our employees, clinical trial participants, or other third parties) in contravention of our internal policies, data protection laws, other applicable laws, or contractual requirements, and/or (ii) the loss of proprietary information, trade secrets, or other intellectual property. In addition to existing risks, AI also introduces new risks, due to the autonomous nature of the technology, which, in some cases, may be deployed to perform tasks, inform decisions, automate decisions, and make predictions. AI may amplify biased and discriminatory decision making, perform unreliably, malfunction, generate insights which are difficult to interpret and explain, and cause direct harm to individuals or groups. Our failure to use AI technologies in a way that maintains trust, quality and control in our business activities and to capitalize on opportunities presented by AI may place us at a competitive disadvantage. Furthermore, uncertainties regarding developing legal and regulatory requirements and standards may require significant resources to modify and maintain business practices to comply with such laws and regulations concerning the use of AI. Failure to address AI risks could reduce our ability to deliver on our strategic objectives, result in reputational harm, and have a material adverse effect on our business, prospects, operating results, and financial condition.

Previous wording

The regulatory framework for AI is rapidly evolving as many federal, state, and foreign government bodies and agencies have introduced or are currently considering additional laws and regulations. Evolving AI-related regulations, particularly in the United States, may impact our ability to develop, use, and commercialize AI technologies in the future. It is possible that further new laws and regulations will be adopted in the United States and in other non-U.S. jurisdictions, or that existing laws and regulations may be interpreted in ways that would limit our ability to use AI for our business, or require us to change the way we use AI in a manner that negatively affects the performance of our system and business and the way in which we use AI. We may need to expend resources to adjust our system in certain jurisdictions if the laws, regulations, or decisions are not consistent across jurisdictions. Further, the cost to comply with such laws, regulations or decisions and/or guidance interpreting existing laws, could be significant and would increase our operating expenses (such as by imposing additional reporting obligations regarding our use of AI). Such an increase in operating expenses, as well as any actual or perceived failure to comply with such laws and regulations, could materially and adversely affect our business, financial condition, results of operations, and prospects.

Current wording

The regulatory framework for AI is rapidly evolving as many federal, state, and foreign government bodies and agencies have introduced or are currently considering additional laws and regulations, including the European Union’s AI act. Evolving AI-related regulations, particularly in the United States, may impact our ability to develop, use, and commercialize AI technologies in the future. It is possible that further new laws and regulations will be adopted in the United States and in other non-U.S. jurisdictions, or that existing laws and regulations may be interpreted in ways that would limit our ability to use AI for our business, or require us to change the way we use AI in a manner that negatively affects the performance of our systems and business. We may need to expend resources to adjust our systems in certain jurisdictions if the laws, regulations, or decisions are not consistent across jurisdictions. Further, the cost to comply with such laws, regulations or decisions and/or guidance interpreting existing laws, could be significant and could increase our operating expenses (such as by imposing additional reporting obligations regarding our use of AI). Such an increase in operating expenses, as well as any actual or perceived failure to comply with such laws and regulations, could materially and adversely affect our business, financial condition, results of operations, and prospects.

Previous wording

Natural or technological disasters could severely disrupt our operations or the operations of third-party suppliers or service providers and have a material adverse effect on our business, financial condition, results of operations, and prospects. The severity and frequency of information technology system failures and cyberattacks continue to increase. Additionally, the severity and frequency of weather-related natural disasters have been amplified, and are expected to continue to be amplified by, global climate change. Such natural and technological disasters may cause damage to and/or disrupt our operations, which may result in a material adverse effect on our VYJUVEK sales, our other product candidates, business, and results of operations. Moreover, climate change may also result in various chronic physical changes, such as changes in temperature or precipitation patterns or sea-level rise, that could have an adverse impact on our operations. Our suppliers, vendors, and business partners also face similar risks, and any disruption to their operations could have an adverse effect on our supply chain, manufacturing operations, or our commercial operations. If a natural disaster, power outage, or other event occurred that prevented us from using all or a significant portion of our headquarters, that damaged critical infrastructure, such as our manufacturing facilities and IT systems, or that otherwise disrupted operations, it may be difficult or, in certain cases, impossible for us to continue our business for a substantial period of time. The disaster recovery and business continuity plans that we have in place currently are limited and may not prove adequate in the event of a serious disaster or similar event. A significant portion of our current supply of materials necessary for production of VYJUVEK and our product candidates, as well as finished VYJUVEK and product candidates, is located at our manufacturing facilities in Pittsburgh, Pennsylvania. We may incur substantial expenses as a result of the limited nature of our disaster recovery and business continuity plans, which could have a material adverse effect on our business, financial condition, results of operations, and prospects.

Current wording

Natural or technological disasters could severely disrupt our operations or the operations of third-party suppliers or service providers and have a material adverse effect on our business, financial condition, results of operations, and prospects. The severity and frequency of information technology system failures and cyberattacks continue to increase. Additionally, the severity and frequency of weather-related natural disasters have been amplified, and are expected to continue to be amplified, by global climate change. Such natural and technological disasters may cause damage to and/or disrupt our operations, which may result in a material adverse effect on our VYJUVEK sales, our product candidates, business, and results of operations. Moreover, climate change may also result in various chronic physical changes, such as changes in temperature or precipitation patterns or sea-level rise, that could have an adverse impact on our operations. Our suppliers, vendors, and business partners also face similar risks, and any disruption to their operations could have an adverse effect on our supply chain, manufacturing operations, or our commercial operations. If a natural disaster, power outage, or other event occurred that prevented us from using all or a significant portion of our headquarters, that damaged critical infrastructure, such as our manufacturing facilities and IT systems, or that otherwise disrupted operations, it may be difficult or, in certain cases, impossible for us to continue our business for a substantial period of time. The disaster recovery and business continuity plans that we have in place currently are limited and may not prove adequate in the event of a serious disaster or similar event. A significant portion of our current supply of materials necessary for production of VYJUVEK and our product candidates, as well as finished VYJUVEK and product candidates, is located at our manufacturing facilities in Pittsburgh, Pennsylvania. We may incur substantial expenses as a result of the limited nature of our disaster recovery and business continuity plans, which could have a material adverse effect on our business, financial condition, results of operations, and prospects.

Previous wording

We currently have operations and employees located outside the United States and our business strategy incorporates potential additional international expansion to target patient populations outside the United States. Doing business internationally involves a number of risks, including, but not limited to:

Current wording

On April 23, 2025, the European Commission granted marketing authorization to VYJUVEK, and we commercially launched VYJUVEK in Germany in August 2025. On July 24, 2025, Japan’s MHLW granted marketing authorization to VYJUVEK, and we commercially launched in Japan in October 2025. We currently have operations and employees located outside the United States and our business strategy incorporates potential additional international expansion to target patient populations outside the United States. Doing business internationally involves a number of risks, including, but not limited to:

Previous wording

We are subject to U.S. and certain foreign export and import controls, anti-corruption laws and anti-money laundering laws and regulations. Compliance with these legal standards could impair our ability to compete in domestic and international markets. We can face criminal liability and other serious consequences for violations, which can harm our business.

Current wording

We are subject to U.S. and certain foreign export and import controls, anti-corruption laws and anti-money laundering laws and regulations. Compliance with these legal standards could impair our ability to compete in domestic and international markets. We could face criminal liability and other serious consequences for violations, which could harm our business.

Previous wording

We are subject to export control and import laws and regulations, including the U.S. Export Administration Regulations, U.S. Customs regulations, and various economic and trade sanctions regulations administered by the U.S. Treasury Department’s Office of Foreign Assets Controls, and anti-corruption and anti-money laundering laws and regulations, including the U.S. Foreign Corrupt Practices Act of 1977, as amended, the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, the USA PATRIOT Act, and other state and national anti-bribery and anti-money laundering laws in the countries in which we conduct activities. Anti-corruption laws are interpreted broadly and prohibit companies and their employees, agents, contractors and other collaborators and partners from authorizing, promising, offering, providing, soliciting, or receiving, directly or indirectly, improper payments or anything else of value to recipients in the public or private sector. We engage third parties to sell VYJUVEK and may engage third parties to sell our product candidates, if approved, abroad and/or to obtain necessary marketing authorizations, permits, licenses, patent registrations, and other regulatory approvals. We may have direct or indirect interactions with officials and employees of government agencies or government-affiliated hospitals, universities, and other organizations. We can be held liable for the corrupt or other illegal activities of our employees, agents, contractors, and other collaborators and partners, even if we do not explicitly authorize or have actual knowledge of such activities. Any violations of the laws and regulations described above may result in substantial civil and criminal fines and penalties, imprisonment, the loss of export or import privileges, debarment, tax reassessments, breach of contract and fraud litigation, reputational harm, and other adverse consequences.

Current wording

We are subject to export control and import laws and regulations, including the U.S. Export Administration Regulations, U.S. Customs regulations, and various economic and trade sanctions regulations administered by the U.S. Treasury Department’s Office of Foreign Assets Controls, and anti-corruption and anti-money laundering laws and regulations, including the U.S. Foreign Corrupt Practices Act of 1977, as amended, the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, the USA PATRIOT Act, and other state and national anti-bribery and anti-money laundering laws in the countries in which we conduct activities. Anti-corruption laws are interpreted broadly and prohibit companies and their employees, agents, contractors and other collaborators and partners from authorizing, promising, offering, providing, soliciting, or receiving, directly or indirectly, improper payments or anything else of value to recipients in the public or private sector. We engage third parties to sell VYJUVEK and may engage third parties to sell our product candidates, if approved, abroad and/or to obtain necessary marketing authorizations, permits, licenses, patent registrations, and other regulatory approvals. We may have direct or indirect interactions with officials and employees of government agencies or government-affiliated hospitals, universities, and other organizations. We can be held liable for the corrupt or other illegal activities of our employees, agents, contractors, and other collaborators and partners, even if we do not explicitly authorize or have actual knowledge of such activities. Furthermore, U.S. export control laws and economic sanctions prohibit the provision of certain products and services to countries, governments, and persons targeted by U.S. sanctions. Any violations of the laws and regulations described above may result in substantial civil and criminal fines and penalties, imprisonment, the loss of export or import privileges, debarment, tax reassessments, breach of contract and fraud litigation, reputational harm, and other adverse consequences.