Dynatronics (DYNT) Risk Factors

The Affordable Care Act, as amended by the Health Care and Education Reconciliation Act, significantly expanded health insurance coverage to uninsured Americans and changed the way health care is financed by both governmental and private payers. These provisions may be modified, repealed, or otherwise invalidated, in whole or in part. Future rulemaking could affect rebates, prices or the rate of price increases for health care products and services, or required reporting and disclosure. We cannot predict the timing or impact of any future rulemaking or changes in the law.

We operate our business and market and sell products internationally, including in countries in Asia, Latin America, and the Middle East, which may be considered business environments that pose a relatively higher risk of corruption than the United States, and therefore present greater political, economic and operational risk to us, including an increased risk of trade sanction violations. In addition, there are numerous risks inherent in conducting our business internationally, including, but not limited to, potential instability in international markets, changes in regulatory requirements applicable to international operations, currency fluctuations in foreign countries, political, economic and social conditions in foreign countries and complex U.S. and foreign laws and treaties, including tax laws, the FCPA, and the Bribery Act of 2010 ("U.K. Anti-Bribery Act"). The FCPA prohibits U.S.-based companies and their intermediaries from making improper payments to government officials for the purpose of obtaining or retaining business. The FCPA also imposes recordkeeping and internal controls requirements on public companies in the U.S. The U.K. Anti-Bribery Act prohibits both domestic and international bribery as well as bribery across both public and private sectors. In recent years, the number of investigations and other enforcement activities under these laws has increased. As we expand our business to include pursuit of opportunities in certain parts of the world that experience government corruption, in certain circumstances compliance with anti-bribery laws may conflict with local customs and practices. Our policies mandate compliance with all applicable anti-bribery laws. Further, we require our partners, subcontractors, agents and others who work for us or on our behalf to comply with these and other anti-bribery laws. If we fail to enforce our policies and procedures properly or maintain adequate record-keeping and internal accounting practices to accurately record our transactions, we may be subject to regulatory sanctions. In the event that we believe or have reason to believe that our employees have or may have violated applicable anti-corruption laws, including the FCPA, trade sanctions or other laws or regulations, we are required to investigate or have outside counsel investigate the relevant facts and circumstances, and if violations are found or suspected, could face civil and criminal penalties, and significant costs for investigations, litigation, settlements and judgments, which in turn could have a material adverse effect on our business.

Our business exposes us to potential product liability risks that are inherent in the design, manufacture and marketing of medical devices. We maintain product liability insurance coverage which we deem to be adequate based on historical experience; however, there can be no assurance that coverage will be available for such risks in the future or that, if available, it would prove sufficient to cover potential claims or that the present amount of insurance can be maintained in force at an acceptable cost. In addition, we may incur significant legal expenses regardless of whether we are found to be liable. Furthermore, the assertion of such claims, regardless of their merit or eventual outcome, also may have a material adverse effect on our business reputation and results of operations.

Some of the data we store, process, and use, contains personal information, subjecting us to a variety of laws and regulations in the United States and other countries with respect to privacy, rights of publicity, data protection, content, protection of minors, and consumer protection. These laws can be particularly restrictive. Both in the United States and abroad, these laws and regulations are evolving and remain subject to change. Several proposals are pending before federal, state and foreign legislative and regulatory bodies that could significantly affect our business. A number of states have enacted laws or are considering the enactment of laws governing the release of credit card or other personal information received from consumers: - California has enacted legislation, the California Consumer Privacy Act ("CCPA") that, among other things, will require covered companies to provide new disclosures to California consumers, and afford such consumers new abilities to opt-out of certain sales of personal information. The CCPA went into effect on January 1, 2020. - The EU General Data Protection Regulation ("GDPR"), effective May, 2018, establishes new requirements applicable to the processing of personal data (i.e., data which identifies an individual or from which an individual is identifiable), affords new data protection rights to individuals, and imposes penalties for serious data breaches. Individuals also have a right to compensation under GDPR for financial or non-financial losses. GDPR has imposed additional responsibility and liability in relation to our processing of personal data in the EU. GDPR has also required us to change our various policies and procedures in the EU and, if we are not compliant, could materially adversely affect our business, results of operations and financial condition. - Canada's Personal Information and Protection of Electronic Documents Act provides Canadian residents with privacy protections in regard to transactions with businesses and organizations in the private sector and sets out ground rules for how private sector organizations may collect, use, and disclose personal information in the course of commercial activities. - In November 2016, the Standing Committee of China's National People's Congress passed its Cybersecurity Law ("CSL"), which took effect in June 2017. The CSL is the first Chinese law that systematically lays out regulatory requirements on cybersecurity and data protection, subjecting many previously under-regulated or unregulated activities in cyberspace to government scrutiny. The costs of compliance with, and other burdens imposed by, the GDPR, CSL and related laws may limit the use and adoption of our products and services and could have an adverse impact on our business, operating results and financial condition. Foreign governments also may attempt to apply such laws extraterritorially or through treaties or other arrangements with U.S. governmental entities. In addition, the application and interpretation of these laws and regulations are often uncertain and could result in investigations, claims, changes to our business practices, increased cost of operations and declines in sales, any of which could materially adversely affect our business, results of operations and financial condition. We cannot assure you that the privacy policies and other statements regarding our practices will be found sufficient to protect us from liability or adverse publicity relating to the privacy and security of personal information. Whether and how existing local and international privacy and consumer protection laws in various jurisdictions apply to the internet and other online technologies is still uncertain and may take years to resolve. Privacy laws and regulations, if drafted or interpreted broadly, could be deemed to apply to the technology we use and could restrict our information collection methods or decrease the amount and utility of the information that we would be permitted to collect. A determination by a court or government agency of a failure, or perceived failure, by us, the third parties with whom we work or our products and services to protect employee, applicant, vendor, website visitor or customer personal data (including as a result of a breach by or of a third-party provider) or to comply with any privacy-related laws, government regulations or directives or industry self-regulatory principles or our posted privacy policies could result in damage to our reputation, legal proceedings or actions against us by governmental entities or otherwise, which could have an adverse effect on our business. In addition, concerns about our practices with regard to the collection, use, disclosure, or security of personally identifiable information or other privacy-related matters, even if unfounded and even if we are in compliance with applicable laws, could damage our reputation and harm our business. We have and post on our website our own privacy policy and cookie statement concerning the collection, use and disclosure of user personal data.

Approximately 22% of our workforce is subject to a collective bargaining agreement, which is subject to negotiation and renewal every three years. The current agreement is scheduled to expire in February 2022. Our inability to negotiate the renewal of this collective bargaining agreement, or any prolonged work stoppages, could have a material adverse effect on our business, results of operations, financial condition and cash flows. We cannot ensure that we will be successful in negotiating new collective bargaining agreements, that such negotiations will not result in significant increases in the cost of labor, or that a breakdown in such negotiations will not result in the disruption of our operations. In addition, employees who are not currently represented by labor unions may seek representation in the future. Although we have generally enjoyed good relations with both our union and non-union employees, if we are subject to labor actions, we may experience an adverse impact on our operating results.

These conditions could result in greater pricing pressures and limitations on our ability to sell to important market segments, such as group purchasing organizations, integrated delivery networks and large single accounts. We expect that market demand, government regulation, third-party reimbursement policies and societal pressures will continue to change the worldwide healthcare industry, resulting in further business consolidations and alliances which may exert further downward pressure on the prices of our products and adversely impact our business, financial condition and results of operations.

We depend increasingly on our information technology systems in the conduct of our business. For example, we own, license or otherwise contract for sophisticated technology and systems to do business online with customers, including for order entry and fulfillment, processing and payment, product shipping and product returns. We also maintain internal and external communications, product inventory, supply, production and enterprise management, and personnel information on information systems. Our information systems are subject to damage or interruption from power outages, computer and telecommunications failures, computer viruses, security breaches and natural and man-made disasters. In particular, from time to time we and third parties who provide services for us experience cyber-attacks, attempted breaches of our or their information technology systems and networks or similar events, which could result in a loss of sensitive business or customer information, systems interruption or the disruption of our operations. The techniques used to obtain unauthorized access, disable or degrade service or sabotage systems change frequently and may be difficult to detect for long periods of time, and accordingly we may be unable to anticipate and prevent all data security incidents. Like many businesses, our systems come under frequent attack from third parties. We are required to expend capital and other resources to protect against such cyber-attacks and potential security breaches or to alleviate problems caused by such potential breaches or attacks. Despite the constant monitoring of our technology systems and hiring of specialized third parties to identify and address any vulnerabilities through implementation of multi-tiered network security measures, it is possible that computer programmers and hackers, or even internal users, may be able to penetrate, create systems disruptions or cause shutdowns of our network security or that of third-party companies with which we have contracted. As a result, we could experience significant disruptions of our operations and incur significant expenses addressing problems created by these breaches. Such unauthorized access could disrupt our business and could result in a loss of revenue or assets and any compromise of customer information could subject us to customer or government litigation and harm our reputation, which could adversely affect our business and growth. Although we maintain cyber liability insurance that provides liability and insurance coverages, subject to limitations and conditions of the policies, our insurance may not be sufficient to protect against all losses or costs related to any future breaches of our systems.