Acurx Pharmaceuticals (ACXP) Risk Factors

We may not be able to initiate or continue clinical trials for our product candidates, including our planned clinical trials of ibezapolstat, if we are unable to locate and enroll a sufficient number of eligible patients to participate in these clinical trials. CDI is an acute infection that requires rapid diagnosis. For our clinical trials of ibezapolstat, we need to identify potential patients, test them for CDI and enroll them in the clinical trial within a 24-hour period. In addition, our competitors have ongoing clinical trials for product candidates that could be competitive with our product candidates, and patients who would otherwise be eligible for our clinical trials may instead enroll in clinical trials of our competitors' product candidates. For our clinical trials of ibezapolstat, we need to identify potential patients and enroll them in the clinical trial based on a history of diarrhea within 24 hours of a positive stool test for C. difficile toxin. Enrollment delays in our clinical trials may result in increased development costs for our product candidates, which would cause the value of our common stock to decline and limit our ability to obtain additional financing. Our inability to enroll a sufficient number of patients in our planned clinical trials of ibezapolstat would result in significant delays or may require us to abandon one or more clinical trials altogether. ?

We may experience numerous unforeseen events during, or as a result of, clinical trials that could delay or prevent our ability to receive marketing approval or commercialize our product candidates, including: - clinical trials of our product candidates may produce negative or inconclusive results, and we may decide, or regulators may require us, to conduct additional clinical trials or abandon product development programs;- the number of patients required for clinical trials of our product candidates may be larger than we anticipate, enrollment in these clinical trials may be slower than we anticipate or participants may drop out of these clinical trials at a higher rate than we anticipate;- we may be unable to enroll a sufficient number of patients in our clinical trials to ensure adequate statistical power to detect any statistically significant treatment effects;- our third-party contractors may fail to comply with regulatory requirements or meet their contractual obligations to us in a timely manner, or at all;- regulators, institutional review boards or independent ethics committees may not authorize us or our investigators to commence a clinical trial or conduct a clinical trial at a prospective trial site;- we may have delays in reaching or fail to reach agreement on acceptable clinical trial contracts or clinical trial protocols with prospective trial sites;- we may have to suspend or terminate clinical trials of our product candidates for various reasons, including a finding that the participants are being exposed to unacceptable health risks;- regulators, institutional review boards or independent ethics committees may require that we or our investigators suspend or terminate clinical research for various reasons, including noncompliance with regulatory requirements or a finding that the participants are being exposed to unacceptable health risks;- clinical trials are costly and the cost of clinical trials of our product candidates may be greater than we anticipate;- the supply or quality of our product candidates or other materials necessary to conduct clinical trials of our product candidates may be insufficient or inadequate; and - our product candidates may have undesirable side effects or other unexpected characteristics, causing us or our investigators, regulators, institutional review boards or independent ethics committees to suspend or terminate the clinical trials. Our product development costs will increase if we experience delays in testing or marketing approvals. We do not know whether any preclinical tests or clinical trials will begin as planned, will need to be restructured or will be completed on schedule, or at all. Significant preclinical or clinical trial delays also could shorten any periods during which we may have the exclusive right to commercialize our product candidates or allow our competitors to bring products to market before we do and impair our ability to successfully commercialize our product candidates and may harm our business and results of operations.

In connection with obtaining marketing approval from regulatory authorities for the sale of any product candidate, we must complete extensive clinical trials to demonstrate the safety and efficacy of our product candidates in humans. Clinical testing is expensive, difficult to design and implement, can take many years to complete and is uncertain as to outcome. A failure of one or more clinical trials can occur at any stage of testing. The outcome of preclinical testing and early clinical trials, particularly with a small number of patients, may not be predictive of the success of later clinical trials, and interim results of a clinical trial do not necessarily predict final results. The design of a clinical trial can determine whether its results will support approval of a product, and flaws in the design of a clinical trial may not become apparent until the clinical trial is well advanced or completed. We have limited experience in designing clinical trials and may be unable to design and execute a clinical trial to support marketing approval. Moreover, preclinical and clinical data are often susceptible to varying interpretations and analyses, and many companies that believe their product candidates performed satisfactorily in preclinical studies and clinical trials have failed to obtain marketing approval of their products.

Pharmaceutical development has inherent risks. The outcome of preclinical development testing and early clinical trials may not be predictive of the outcome of later clinical trials, and interim results of a clinical trial do not necessarily predict final results. Moreover, preclinical and clinical data are often susceptible to varying interpretations and analyses, and many companies that have believed their product candidates performed satisfactorily in preclinical studies and clinical trials have nonetheless failed to obtain marketing approval of their product candidates. Once a product candidate has displayed sufficient preclinical data to warrant clinical investigation, we will be required to demonstrate through adequate and well-controlled clinical trials that our product candidates are effective with a favorable benefit-risk profile for use in populations for their target indications before we can seek regulatory approvals for their commercial sale. Many drug candidates fail in the early stages of clinical development for safety and tolerability issues or for insufficient clinical activity, despite promising pre-clinical results. Accordingly, no assurance can be made that a safe and efficacious dose can be found for these compounds or that they will ever enter into advanced clinical trials alone or in combination with other product candidates. Moreover, success in early clinical trials does not mean that later clinical trials will be successful because product candidates in later-stage clinical trials may fail to demonstrate sufficient safety or efficacy despite having progressed through initial clinical testing. Companies frequently experience significant setbacks in advanced clinical trials, even after earlier clinical trials have shown promising results. There is an extremely high rate of failure of pharmaceutical candidates proceeding through clinical trials. Individually reported outcomes of patients treated in clinical trials may not be representative of the entire population of treated patients in such studies. In addition, larger scale Phase 3 studies, which are often conducted internationally, are inherently subject to increased operational risks compared to earlier stage studies, including the risk that the results could vary on a region to region or country to country basis, which could materially adversely affect the outcome of the study or the opinion of the validity of the study results by applicable regulatory agencies. From time to time, we may publicly disclose top-line or preliminary data from our clinical trials, which is based on a preliminary analysis of then available data, and the results and related findings and conclusions are subject to change following a more comprehensive review of the data related to the particular study or trial. We also make assumptions, estimations, calculations and conclusions as part of our analyses of such data, and we may not have received or had the opportunity to fully and carefully evaluate all data from the particular study or trial, including all endpoints and safety data. As a result, top-line or preliminary results that we report may differ from future results of the same studies, or different conclusions or considerations may qualify such results, once additional data have been received and fully evaluated. Top-line or preliminary data also remain subject to audit and verification procedures that may result in the final data being materially different from the topline, interim, or preliminary data we previously published. When providing top-line results, we may disclose the primary endpoint of a study before all secondary endpoints have been fully analyzed. A positive primary endpoint does not translate to all, or any, secondary endpoints being met. As a result, top-line and preliminary data should be viewed with caution until the final data are available, including data from the full safety analysis and the final analysis of all endpoints. Further, from time to time, we may also disclose interim data from our preclinical studies and clinical trials. Interim data from clinical trials that we may complete are subject to the risk that one or more of the clinical outcomes may materially change as patient enrollment continues and more patient data become available. For example, time-to-event based endpoints such as duration of response and progression free survival have the potential to change, sometimes drastically, with longer follow-up. In addition, as patients continue on therapy, there can be no assurance given that the final safety data from studies, once fully analyzed, will be consistent with prior safety data presented, will be differentiated from other similar agents in the same class, will support continued development, or will be favorable enough to support regulatory approvals for the indications studied. Further, others, including regulatory agencies, may not accept or agree with our assumptions, estimates, calculations, conclusions or analyses or may interpret or weigh the importance of data differently, which could impact the value of the particular program, the approvability or commercialization of the particular product candidate or product and our company in general. The information we choose to publicly disclose regarding a particular study or clinical trial is based on what is typically extensive information, and regulators or others may not agree with what we determine is material or otherwise appropriate information to include in our disclosure. If the interim, top-line or preliminary data that we report differ from final results, or if others, including regulatory authorities, disagree with the conclusions reached, our ability to obtain approval for, or successfully commercialize, our product candidates may be harmed, which could harm our business, operating results, prospects or financial condition.

In order to be commercially viable, we must research, develop and obtain regulatory approval to manufacture, introduce, market and distribute formulations or products incorporating our technologies. For each drug that we formulate, we must meet a number of critical developmental milestones, including: - demonstration of the benefit of each specific drug through our drug delivery technologies;- demonstration, through non-clinical and clinical trials, that our drug delivery technologies are safe and effective; and - establishment of a viable current good manufacturing process ("cGMP") capable of potential scale-up. The estimated required capital and time frames necessary to achieve these developmental milestones is subject to inherent risks, many of which are beyond our control. As such, we may not be able to achieve these or similar milestones for any of our proposed product candidates or other product candidates in the future. Our failure to meet these or other critical milestones would adversely affect our financial condition. Conducting and completing the clinical trials necessary for FDA approval is costly and subject to intense regulatory scrutiny as well as the risk of failing to meet the primary endpoint of such trials. We will not be able to commercialize and sell our proposed products and formulations without completing such trials. In order to conduct clinical trials that are necessary to obtain approval by the FDA to market a formulation or product, it is necessary to receive clearance from the FDA to conduct such clinical trials. The FDA can halt clinical trials at any time for safety reasons or because we or our clinical investigators did not follow the FDA's requirements for conducting clinical trials. If we are unable to receive clearance to conduct clinical trials or the trials are permanently halted by the FDA, we would not be able to achieve any revenue from such product as it is illegal to sell any drug or medical device for human consumption or use without FDA approval. Moreover, there is a risk that our clinical trials will fail to meet their primary endpoints, which would make them unacceptable in having the subject product approved by the FDA. If this were to occur, such event would materially and adversely affect our business, results of operations and financial condition.

Our ability to license, obtain, enforce and maintain patents, maintain trade secret protection and operate without infringing the proprietary rights of others is important to the commercialization of any formulations or products under development. The patent positions of biotechnology and pharmaceutical companies, including ours, are frequently uncertain and involve complex legal and factual questions. In addition, the coverage claimed in a patent application can be significantly reduced before the patent is issued. Consequently, our patents, patent applications and other intellectual property rights may not provide protection against competitive technologies or products or may be held invalid if challenged or could be circumvented. Our competitors may also independently develop products similar to ours or design around or otherwise circumvent patents issued to, or licensed by, us. In addition, the laws of some foreign countries may not protect our proprietary rights to the same extent as U.S. law. Any of these occurrences would have a material adverse effect on our business. Even if resolved in our favor, litigation or other legal proceedings relating to intellectual property claims may cause us to incur significant expenses, and could distract our technical and management personnel from their normal responsibilities. In addition, there could be public announcements of the results of hearings, motions or other interim proceedings or developments. Such litigation or proceedings could substantially increase our operating losses and reduce the resources available for development, sales, marketing or distribution activities. We may not have sufficient financial or other resources to adequately conduct such litigation or proceedings. Some of our competitors may be able to sustain the costs of such litigation or proceedings more effectively than we can because of their greater financial resources. Accordingly, costs and lost management time, as well as uncertainties resulting from the initiation and continuation of patent litigation or other proceedings, could have a material adverse effect on our ability to compete in the marketplace.

A third party may hold intellectual property, including patent rights, that is important or necessary to the development or commercialization of our products. It may be necessary for us to use the patented or proprietary technology of third parties to commercialize our products, in which case we would be required to obtain a license from these third parties on commercially reasonable terms, or our business could be harmed, possibly materially. Such licenses may not be available which could prevent us from commercializing our products. Further, if we are alleged to infringe third party intellectual property rights, we could face costly litigation, the outcome of which could negatively affect or prevent us from commercializing or developing our products. In the event of an adverse decision against us in a litigation, we could be required to: pay substantial damages and license fees, or even be prevented from using or commercializing our technologies and methods; and also be prevented from further research and development efforts. In such case, we may be unable to develop alternative non-infringing products or methods and unable to obtain one or more licenses from third parties.

Even if resolved in our favor, litigation or other legal proceedings relating to intellectual property claims, regardless of their merit, would cause us to incur significant expenses, and could distract our technical and management personnel from their normal responsibilities. In the event of a successful claim of infringement against us, we may have to pay substantial damages, including treble damages and attorneys' fees for willful infringement, in addition to paying royalties, redesign infringing products or obtain one or more licenses from third parties, which may be impossible or require substantial time and monetary expenditure. A court may also issue an injunction against us preventing us from manufacturing and bringing our products to market. In addition, there could be public announcements of the results of hearings, motions or other interim proceedings or developments and if securities analysts or investors perceive these results to be negative, it could have a substantial adverse effect on the price of our common stock. Such litigation or proceedings could substantially increase our operating losses and reduce the resources available for development activities or any future sales, marketing or distribution activities. We may not have sufficient financial or other resources to conduct such litigation or proceedings adequately. Some of our competitors may be able to sustain the costs of such litigation or proceedings more effectively than we can because of their greater financial resources. Uncertainties resulting from the initiation and continuation of patent litigation or other proceedings could compromise our ability to compete in the marketplace.

Legislative and regulatory actions affecting government prescription drug procurement and reimbursement programs occur relatively frequently. In the U.S., the Patient Protection and Affordable Care Act (the "ACA") was enacted in 2010 to expand healthcare coverage. Since then, numerous efforts have been made to repeal, amend or administratively limit the ACA in whole or in part. With regard to biopharmaceutical products, the ACA, among other things, addressed a new methodology by which rebates owed by manufacturers under the Medicaid Drug Rebate Program are calculated for drugs that are inhaled, infused, instilled, implanted or injected, increased the minimum Medicaid rebates owed by manufacturers under the Medicaid Drug Rebate Program and extended the rebate program to individuals enrolled in Medicaid managed care organizations, established annual fees on manufacturers of certain branded prescription drugs, and created a new Medicare Part D coverage gap discount program. We expect that future changes or additions to the ACA, the Medicare and Medicaid programs, and changes stemming from other healthcare reform measures, especially with regard to healthcare access, financing or other legislation in individual states, could have a material adverse effect on the healthcare industry in the United States. Complying with any new legislation or reversing changes implemented under the ACA could be time-intensive and expensive, resulting in a material adverse effect on our business. If we are slow or unable to adapt to changes in existing requirements or the adoption of new requirements or policies, or if we are not able to maintain regulatory compliance, we may lose any marketing approval that we otherwise may have obtained and we may not achieve or sustain profitability, which would adversely affect our business, prospects, financial condition and results of operations. Additionally, on December 20, 2019, the Further Consolidated Appropriations Act for 2020 was signed into law (P.L. 116-94) and includes a piece of bipartisan legislation called the Creating and Restoring Equal Access to Equivalent Samples Act of 2019 (the "CREATES Act"). The CREATES Act aims to address the concern articulated by both the FDA and others in the industry that some brand manufacturers have improperly restricted the distribution of their products, including by invoking the existence of a REMS for certain products, to deny generic product developers access to samples of brand products. Because generic product developers need samples of a reference listed drug, to conduct certain comparative testing required by the FDA, some have attributed the inability to timely obtain samples as a cause of delay in the entry of generic products. To remedy this concern, the CREATES Act establishes a private cause of action that permits a generic product developer to sue the brand manufacturer to compel it to furnish the necessary samples on "commercially reasonable, market-based terms." Whether and how generic product developments will use this new pathway, as well as the likely outcome of any legal challenges to provisions of the CREATES Act, remain highly uncertain and its potential effects on any of our future commercial products are unknown. For a drug product to receive federal reimbursement under the Medicaid or Medicare Part B programs or to be sold directly to U.S. government agencies, the manufacturer must extend discounts to entities eligible to participate in the 340B Drug Pricing Program. The maximum amount that a manufacturer may charge a 340B covered entity for a given product is the average manufacturer price ("AMP"), reduced by the rebate amount paid by the manufacturer to Medicaid for each unit of that product. As of 2010, the ACA expanded the types of entities eligible to receive discounted 340B pricing, although, under the current state of the law, with the exception of children's hospitals, these newly eligible entities will not be eligible to receive discounted 340B pricing on orphan drugs. In addition, as 340B drug pricing is determined based on AMP and Medicaid rebate data, the revisions to the Medicaid rebate formula and AMP definition described above could cause the required 340B discount to increase. Moreover, there has been heightened governmental scrutiny over the manner in which manufacturers set prices for their marketed products, which has resulted in several Congressional inquiries and proposed and enacted federal and state legislation designed to, among other things, bring more transparency to product pricing, review the relationship between pricing and manufacturer patient programs, and reform government program reimbursement methodologies for drug products. For example, the 2021 Consolidated Appropriations Act signed into law on December 27, 2020 incorporated extensive healthcare provisions and amendments to existing laws, including a requirement that all manufacturers of drug products covered under Medicare Part B report the product's average sales price to the Centers for Medicare and Medicaid Services ("CMS") beginning on January 1, 2022, subject to enforcement via civil money penalties. The U.S. Department of Health and Human Services ("DHHS") has also solicited feedback on various measures intended to lower drug prices and reduce the out-of-pocket costs of drugs and has implemented others under its existing authority. In August 2022, President Biden signed into the law the Inflation Reduction Act of 2022 (the "IRA"). The IRA has multiple provisions that may impact the prices of drug products that are both sold into the Medicare program and throughout the United States. Starting in 2023, a manufacturer of a drug or biological product covered by Medicare Parts B or D must pay a rebate to the federal government if the drug product's price increases faster than the rate of inflation. This calculation is made on a drug product by drug product basis and the amount of the rebate owed to the federal government is directly dependent on the volume of a drug product that is paid for by Medicare Parts B or D. Additionally, starting in payment year 2026, CMS will negotiate drug prices annually for a select number of single source Part D drugs without generic or biosimilar competition. CMS will also negotiate drug prices for a select number of Part B drugs starting for payment year 2028. If a drug product is selected by CMS for negotiation, it is expected that the revenue generated from such drug will decrease. CMS has begun to implement these new authorities and entered into the first set of agreements with pharmaceutical manufacturers to conduct price negotiations in October 2023. However, the IRA's impact on the pharmaceutical industry in the United States remains uncertain, in part because multiple large pharmaceutical companies and other stakeholders (e.g., the U.S. Chamber of Commerce) have initiated federal lawsuits against CMS arguing the program is unconstitutional for a variety of reasons, among other complaints. Those lawsuits are currently ongoing. In addition, many states have proposed or enacted legislation that seeks to indirectly or directly regulate pharmaceutical drug pricing, such as by requiring biopharmaceutical manufacturers to publicly report proprietary pricing information or to place a maximum price ceiling on pharmaceutical products purchased by state agencies. For example, in recent years, several states have formed prescription drug affordability boards ("PDABs"). Much like the IRA's drug price negotiation program, these PDABs have attempted to implement upper payment limits ("UPLs") on drugs sold in their respective states in both public and commercial health plans. In August 2023, Colorado's PDAB announced a list of five prescription drugs that would undergo an affordability review. The effects of these efforts remain uncertain pending the outcomes of several federal lawsuits challenging state authority to regulate prescription drug payment limits. In December 2020, the U.S. Supreme Court held unanimously that federal law does not preempt the states' ability to regulate pharmaceutical benefit managers ("PBMs") and other members of the healthcare and pharmaceutical supply chain, an important decision that may lead to further and more aggressive efforts by states in this area. The Federal Trade Commission ("FTC") in mid-2022 also launched sweeping investigations into the practices of the PBM industry that could lead to additional federal and state legislative or regulatory proposals targeting such entities' operations, pharmacy networks, or financial arrangements. Significant efforts to change the PBM industry as it currently exists in the U.S. may affect the entire pharmaceutical supply chain and the business of other stakeholders, including pharmaceutical product developers like us. Changes to the Medicaid program at the federal or state level could also have a material adverse effect on our business. Proposals that could impact coverage and reimbursement of our products, including giving states more flexibility to manage drugs covered under the Medicaid program and permitting the re-importation of prescription medications from Canada or other countries, could have a material adverse effect by limiting our products' use and coverage. Furthermore, state Medicaid programs could request additional supplemental rebates on our products as a result of an increase in the federal base Medicaid rebate. To the extent that private insurers or managed care programs follow Medicaid coverage and payment developments, they could use the enactment of these increased rebates to exert pricing pressure on our products, and the adverse effects may be magnified by their adoption of lower payment schedules. Other proposed regulatory actions affecting manufacturers could have a material adverse effect on our business. It is difficult to predict the impact, if any, of any such proposed legislative and regulatory actions or resulting state actions on the use and reimbursement of our products in the U.S., but our results of operations may be adversely affected.

Following any initial regulatory approval of any drugs we may develop, we will also be subject to continuing regulatory oversight, including the review of adverse drug experiences and safety data that are reported after our drug products are made commercially available. This would include results from any post-marketing studies or surveillance to monitor the safety and efficacy of the drug product required as a condition of approval or agreed to by us. Any regulatory approvals that we receive for our product candidates may also be subject to limitations on the approved uses for which the product may be marketed. Other ongoing regulatory requirements include, among other things, submissions of safety and other post-marketing information and reports, registration and listing, as well as continued maintenance of our marketing application, compliance with cGMP requirements and quality oversight, compliance with post-marketing commitments, and compliance with good clinical practice ("GCP") for any clinical trials that we conduct post-approval. Failure to comply with these requirements could result in warning or untitled letters, criminal or civil penalties, recalls, or product withdrawals. In addition, we are conducting our clinical trials and we intend to seek approval to market our product candidates in jurisdictions outside of the United States, and therefore will be subject to, and must comply with, regulatory requirements in those jurisdictions. The FDA has significant post-market authority, including, for example, the authority to require labeling changes based on new safety information and to require post-market studies or clinical trials for a variety of reasons. The FDA also has the authority to require a REMS plan after approval, which may impose further requirements or restrictions on the distribution or use of an approved drug. We, our CMOs, and the manufacturing facilities we use to make our product candidates will also be subject to ongoing assessment of product quality, compliance with cGMP, and periodic inspection by the FDA and potentially other regulatory agencies. We or our CMOs may not be able to comply with applicable cGMP regulations or similar regulatory requirements outside of the United States. Our failure, or the failure of our CMOs, to comply with applicable regulations could result in regulatory actions, such as the issuance of FDA Form 483 notices of observations, warning letters or sanctions being imposed on us, including clinical holds, fines, injunctions, civil penalties, delays, suspension or withdrawal of approvals, license revocation, seizures or recalls of product candidates or drugs, operating restrictions and criminal prosecutions, any of which could significantly and adversely affect supplies of our products. We may not have the ability or capacity to manufacture material at a broader commercial scale in the future. We and our CMOs currently manufacture a limited supply of clinical trial materials. Reliance on CMOs entails risks to which we would not be subject if we manufactured all of our material ourselves, including reliance on the CMO for regulatory compliance. Our product promotion and advertising will also be subject to regulatory requirements and continuing regulatory review. If we or our collaborators, manufacturers or service providers fail to comply with applicable continuing regulatory requirements in the United States or foreign jurisdictions in which we may seek to market our products, we or they may be subject to, among other things, fines, warning letters, holds on clinical trials, refusal by the FDA or comparable foreign regulatory authorities to approve pending applications or supplements to approved applications, suspension or withdrawal of regulatory approval, product recalls and seizures, refusal to permit the import or export of products, operating restrictions, injunction, consent decree, civil penalties and criminal prosecution.

As a Delaware corporation, we are subject to the United States Foreign Corrupt Practices Act, which generally prohibits U.S. companies from engaging in bribery or other prohibited payments to foreign officials for the purpose of obtaining or retaining business. Some foreign companies, including some that may compete with us, may not be subject to these prohibitions. Corruption, extortion, bribery, pay-offs, theft and other fraudulent practices may occur from time-to-time in countries in which we conduct our business. However, our employees or other agents may engage in conduct for which we might be held responsible. If our employees or other agents are found to have engaged in such practices, we could suffer severe penalties and other consequences that may have a material adverse effect on our business, financial condition and results of operations.

New privacy and data security laws have been proposed in more than half of the states in the U.S. and in the U.S. Congress, reflecting a trend toward more stringent privacy legislation in the U.S., which trend may accelerate with increasing concerns about individual privacy. The existence of comprehensive privacy laws in different states in the U.S. may make our compliance obligations more complex and costly, may require us to modify our data processing practices and policies, and may require us to incur substantial costs and potential liability in an effort to comply. In California, the California Consumer Privacy Act ("CCPA"), which became effective in 2020, broadly defines personal information, gives California residents expanded individual privacy rights and protections, provides for civil penalties for violations and gives California residents a private right of action for data breaches in certain cases. Further, the California Privacy Rights Act ("CPRA"), which became effective in 2023 and amends the CCPA, imposes additional obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It also created a new California Privacy Protection Agency authorized to issue substantive regulations and is expected to result in increased privacy and information security enforcement. The CPRA also extends the provisions of both the CCPA and the CPRA to the personal information of California-based employees. While there is an exception for certain health information, including protected health information that is subject to HIPAA, and clinical trial data, the CCPA may impact our business activities if we become a "Business" regulated by the CCPA. Further, there continues to be some uncertainly about how certain provisions of the CCPA will be interpreted and how some areas of the law will be enforced. We will continue to monitor developments related to the CCPA and anticipate additional costs and expenses associated with compliance. In addition to the CCPA, broad consumer privacy laws recently went into effect in Virginia on January 1, 2023, in Colorado and Connecticut on July 1, 2023, and in Utah on December 31, 2023. New privacy laws will also become effective in Florida, Montana, Oregon and Texas in 2024, in Delaware, Iowa, New Hampshire, New Jersey, and Tennessee in 2025, and in Indiana in 2026. In addition, numerous other states are considering new comprehensive privacy laws. Other U.S. states, such as New York and Massachusetts have enacted stringent data security laws and numerous other states have proposed similar laws. Additionally, various states, such as California and Massachusetts, have implemented similar privacy laws and regulations, such as the California Confidentiality of Medical Information Act, that impose restrictive requirements regulating the use and disclosure of health information and other personally identifiable information. These laws and regulations are not necessarily preempted by HIPAA, particularly if a state affords greater protection to individuals than HIPAA. Where state laws are more protective, we have to comply with the stricter provisions. In addition to fines and penalties imposed upon violators, some of these state laws also afford private rights of action to individuals who believe their personal information has been misused. California's patient privacy laws, for example, provide for penalties of up to $250,000 and permit injured parties to sue for damages. Similarly, as discussed above, the CCPA allows consumers a private right of action when certain personal information is subject to unauthorized access and exfiltration, theft or disclosure due to a business' failure to implement and maintain reasonable security procedures. Furthermore, over the past few years, the number of privacy-related enforcement actions in the U.S., and in many cases the fines, have steadily increased. Failure to comply with these current and future laws, policies, industry standards, or legal obligations. or any data breach involving personal information, may result in government enforcement actions, litigation, fines, and penalties, private litigation, or adverse publicity, and could cause our customers, business partners, and investors to lose trust in us which could have a material adverse impact on our business, results of our operations, and our financial condition. We continue to face uncertainty as to the exact interpretation of the new requirements on our clinical trials and we may be unsuccessful in implementing all measures required by data protection authorities or courts in interpretation of the new law. The interplay of federal and state laws may be subject to varying interpretations by courts and government agencies, creating complex compliance issues for us and data we receive, use and share, potentially exposing us to additional expense, adverse publicity and liability. Further, as regulatory focus on privacy issues continues to increase and laws and regulations concerning the protection of personal information expand and become more complex, these potential risks to our business could intensify. Changes in laws or regulations associated with the enhanced protection of certain types of sensitive data, for the treatment of genetic data, along with increased customer demands for enhanced data security infrastructure, could greatly increase our cost of providing our products, decrease demand for our products, reduce our revenues and/or subject us to additional liabilities. In the European Union ("EU") and the United Kingdom ("UK"), we may face particular privacy, data security, and data protection risks in connection with requirements of EU's General Data Protection Regulation ("GDPR"), the GDPR as it existed on December 31, 2020 but subject to certain UK specific amendments incorporated into UK law on January 1, 2021 under the UK GDPR and other data protection requirements. The regulatory framework for collecting, using, safeguarding, sharing, transferring and other processing of information worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future. The withdrawal of the UK from the EU and the subsequent separation of the data protection regimes of these territories means we are required to comply with separate data protection laws in the EU and the UK, which may lead to additional compliance costs and could increase our overall risk. Similar laws and regulations govern our processing of personal data, including the collection, access, use, analysis, modification, storage, transfer, security breach notification, destruction and disposal of personal data. For example, the collection, use, disclosure, transfer, or other processing of personal data regarding individuals in the EU, including personal health data, is subject to the GDPR, which took effect across all Member States of the European Economic Area ("EEA") on May 25, 2018, and as still in effect in the UK as the "UK GDPR". On June 28, 2021, the EU Commission adopted decisions on the UK's adequacy under the EU GDPR, and the UK continues to operate under this adequacy decision. The GDPR applies to any company established in the EU as well as to those outside the EU that process personal data in connection with the offering of goods or services to individuals in the EU or the monitoring of their behavior. The GDPR imposes a broad range of data protection obligations on controllers and/or processors, as applicable, that must be complied with when processing personal data subject to the GDPR, including, for example, providing expanded disclosures about how their personal data will be used; higher standards for organizations to demonstrate that they have obtained valid consent or have another legal basis in place to justify their data processing activities; the obligation to appoint data protection officers in certain circumstances; new rights for individuals to be "forgotten" and rights to data portability, as well as enhanced current rights (e.g., access requests); the principal of accountability and demonstrating compliance through policies, procedures, training and audit; limitations on retention of information; mandatory data breach notification requirements; safeguards to protect the security and confidentiality of personal data; restrictions on transfers of personal data outside of the EU to third countries deemed to lack adequate privacy protections (such as the U.S.), and onerous new obligations and liabilities on services providers or data processors. In particular, medical or health data, genetic data and biometric data are all classified as "special category" data under the GDPR and afford greater protection and require additional compliance obligations. Further, the UK and EU member states have a broad right to impose additional conditions-including restrictions-on these data categories. This is because the GDPR allows EU member states to derogate from the requirements of the GDPR mainly in regard to specific processing situations (including special category data and processing for scientific or statistical purposes). Non-compliance with the GDPR may result in monetary penalties of up to €20 million or 4% of worldwide revenue, whichever is greater. Moreover, data subjects can claim damages resulting from infringement of the GDPR. The GDPR further grants non-profit organizations and consumer organizations the right to bring claims on behalf of data subjects. The GDPR and other changes in laws or regulations associated with the enhanced protection of certain types of personal data, such as healthcare data or other sensitive information, could greatly increase our cost of providing our products and services or even prevent us from offering certain services in jurisdictions that we may operate in. The GDPR may increase our responsibility and liability in relation to personal data that we process where such processing is subject to the GDPR, and we may be required to put in place additional mechanisms to ensure compliance with the GDPR, including as implemented by individual EU Member States. Compliance with the GDPR is a rigorous and time-intensive process that may increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation, and reputational harm in connection with any activities in the EU. Further, as referenced above, following the UK's withdrawal from the EU (i.e., Brexit), and the expiry of the Brexit transition period, which ended on December 31, 2020, the EU GDPR has been implemented in the UK (as the UK GDPR). The UK GDPR sits alongside the UK Data Protection Act 2018 which implements certain derogations in the EU GDPR into UK law. Under the UK GDPR, companies not established in the UK but who process personal data in relation to the offering of goods or services to individuals in the UK, or to monitor their behavior will be subject to the UK GDPR – the requirements of which are (at this time) largely aligned with those under the EU GDPR and as such, may lead to similar compliance and operational costs. Non-compliance with the UK GDPR may result in monetary penalties of up to £17.5 million or 4% of worldwide revenue, whichever is higher. In addition, we may be unable to transfer personal data from the EU, UK, and other jurisdictions to U.S. or other countries due to limitations on cross-border data flows. In particular, the EEA and the UK have significantly regulated the transfer of personal data to the U.S. and other countries whose privacy laws it believes are inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and the UK to the U.S. in compliance with law, such as the EEA and UK's standard contractual clauses and the newly-adopted Data Privacy Framework, these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the U.S. If there is no lawful manner for us to transfer personal data from the EEA, the UK or other jurisdictions to the U.S., or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and the UK to other jurisdictions, particularly to the U.S., are subject to increased scrutiny from regulators, individual litigants, and activist groups. If we are investigated by an EEA or UK data protection authority, we may face fines and other penalties, which could have a negative effect on our existing business and on our ability to attract and retain new clients or pharmaceutical partners. We may also experience hesitancy, reluctance, or refusal by EEA, UK, or multi-national clients or pharmaceutical partners to continue to use our products due to the potential risk exposure because of the current (and future) data protection obligations imposed on them by certain data protection authorities in interpretation of current law, including the GDPR and UK GDPR. Such clients or pharmaceutical partners may also view any alternative approaches to compliance as being too costly, too burdensome, too legally uncertain, or otherwise objectionable and therefore decide not to do business with us. Any of the foregoing could materially harm our business, prospects, financial condition, and results of operations. In addition, many jurisdictions outside of the EEA and the UK are also considering and/or enacting comprehensive data protection legislation. For example, as of August 2020, the Brazilian General Data Protection Law imposes stringent requirements similar to GDPR with respect to personal information collected from individuals in Brazil. We also continue to see jurisdictions imposing data localization laws. These regulations may interfere with our intended business activities, inhibit our ability to expand into those markets or prohibit us from continuing to offer services in those markets without significant additional costs. Because the interpretation and application of many domestic and international privacy and data protection laws, commercial frameworks, and standards are uncertain, it is possible that these laws, frameworks, and standards may be interpreted and applied in a manner that is inconsistent with our existing data management practices and policies. It is also possible that by complying with one law, we may be violating another. In addition to the possibility of fines, lawsuits, breach of contract claims, and other claims and penalties, we could be required to fundamentally change our business activities and practices or modify our solutions, which could have an adverse effect on our business. Failure to comply with current and future privacy and data protection laws and regulations could result in government enforcement actions (including the imposition of significant penalties), criminal and civil liability for us and our officers and directors, private litigation and/or adverse publicity that negatively affects our business. Any inability to adequately respond to privacy and security concerns, even if unfounded, or to comply with applicable privacy and data protection laws, regulations, and policies, could result in additional cost and liability to us, damage our reputation, inhibit our ability to conduct trials, and adversely affect our business.

We do not have a sales or marketing infrastructure and have no experience in the sale or marketing of pharmaceutical products. To achieve commercial success for any approved product, we must either develop a sales and marketing organization or outsource these functions to third parties. If ibezapolstat receives marketing approval, we intend to commercialize it in the U.S. with our own focused, specialized sales force. We plan to evaluate the potential for utilizing additional collaboration, distribution and marketing arrangements with third parties to commercialize ibezapolstat in other jurisdictions where we retain commercialization rights. There are risks involved with establishing our own sales and marketing capabilities and entering into arrangements with third parties to perform these services. For example, recruiting and training a sales force is expensive and time-consuming and could delay any product launch. If the commercial launch of a product candidate for which we recruit a sales force and establish marketing capabilities is delayed or does not occur for any reason, we would have prematurely or unnecessarily incurred these commercialization expenses. This may be costly, and our investment would be lost if we cannot retain or reposition our sales and marketing personnel. Factors that may inhibit our efforts to commercialize our products on our own include: - our inability to recruit, train and retain adequate numbers of effective sales and marketing personnel;- the inability of sales personnel to obtain access to or persuade adequate numbers of physicians to prescribe any future products;- the lack of complementary products to be offered by sales personnel, which may put us at a competitive disadvantage relative to competitors with more extensive product lines; and - unforeseen costs and expenses associated with creating an independent sales and marketing organization. If we enter into arrangements with third parties to perform sales and marketing services, our product revenues or the profitability of these product revenues will likely be lower than if we were to market and sell any products that we develop ourselves. In addition, we may not be successful in entering into arrangements with third parties to sell and market our product candidates or may be unable to do so on terms that are acceptable to us. We likely will have little control over such third parties, and any of them may fail to devote the necessary resources and attention to sell and market our products effectively. If we do not establish sales and marketing capabilities successfully, either on our own or in collaboration with third parties, we will not be successful in commercializing our product candidates.