GlycoMimetics (GLYC) Risk Analysis

Even if we resume our drug development activities, we would have limited financial and management resources and as a result would need to focus on a limited number of research programs and drug candidates. As a result, we may forego or delay pursuit of opportunities with other drug candidates or for other indications that later prove to have greater commercial potential. Our resource allocation decisions could cause us to fail to capitalize on viable commercial drugs or profitable market opportunities. Our spending on research and development programs and drug candidates for specific indications may not yield any commercially viable drugs. If we do not accurately evaluate the commercial potential or target market for a particular drug candidate, we may relinquish valuable rights to that drug candidate through collaboration, licensing or other arrangements in cases in which it would have been more advantageous for us to retain sole development and commercialization rights.

In addition to seeking patents for our drug candidates, we have also relied on trade secrets, including unpatented know-how, technology and other proprietary information, to maintain our historical competitive position. For example, our platform was based on trade secrets that consist largely of expertise in carbohydrate chemistry and knowledge of carbohydrate biology. We do not believe that we can obtain patent protection for our platform. Thus, our competitors may use our methods, or acquire similar expertise, in order to develop glycomimetic drug candidates and progress these drug candidates through clinical development and commercialization, which could impair our ability to successfully commercialize our drug candidates. We have sought to protect our trade secrets, in part, by entering into non-disclosure and confidentiality agreements with parties who have access to them, such as our employees, corporate collaborators, outside scientific collaborators, contract manufacturers, consultants, advisors and other third parties. We have also entered into confidentiality and invention or patent assignment agreements with our current and former employees and consultants. Despite these efforts, any of these parties may breach the agreements and disclose our proprietary information, including our trade secrets, and we may not be able to obtain adequate remedies for such breaches. Enforcing a claim that a party illegally disclosed or misappropriated a trade secret is difficult, expensive and time consuming, and the outcome is unpredictable. In addition, some courts inside and outside the United States are less willing or unwilling to protect trade secrets. If any of our trade secrets were to be lawfully obtained or independently developed by a competitor, we would have no right to prevent them, or those to whom they communicate it, from using that technology or information to compete with us. If any of our trade secrets were to be disclosed to or independently developed by a competitor, our competitive position would be harmed.

In the ordinary course of our business, we have processed personal data and other sensitive data, including proprietary and confidential business data, trade secrets, intellectual property, clinical trial participant data, and other sensitive third-party data. The data processing activities related to our work subject us and the third parties with whom we have worked to numerous data privacy and security obligations, such as federal, state, local and foreign laws, regulations, guidance, industry standards, external and internal privacy and security policies, contracts, and other obligations governing the processing and security of personal data. These obligations may change, are subject to differing interpretations and may be inconsistent among jurisdictions or conflict. The global data protection landscape is rapidly evolving, and implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. This evolution may create uncertainty in our business; affect our (or the third parties upon which we rely) ability to operate in certain jurisdictions or to collect, store, transfer, use and share personal data; necessitate the acceptance of more onerous obligations in our contracts; result in liability; or impose additional costs on us. These obligations may necessitate changes to our information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. Outside the U.S., an increasing number of laws, regulations, and industry standards apply to data privacy and security. For example, the European Union's General Data Protection Regulation (GDPR) (EU) 2016/679, or the EU GDPR and the United Kingdom's GDPR (UK GDPR), or collectively GDPR, impose strict requirements on the processing of personal data. Under the GDPR, government regulators may impose temporary or definitive bans on data processing, as well as fines in the event of violations. Under the GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros under the EU GDPR, 17.5 million pounds sterling under the UK GDPR or, in each case, 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. We may transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area (EEA) and the UK have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it generally believes are inadequate. Other jurisdictions have adopted or may adopt similarly stringent data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the U.S. in compliance with law, such as the EEA standard contractual clauses, the UK's International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the U.S. If there is no lawful manner for us to transfer personal data from the EEA, the UK, or other jurisdictions to the U.S., or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Some EEA regulators have prevented companies from transferring personal data out of the EEA for allegedly violating the GDPR's cross-border data transfer limitations. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, HIPAA, as amended by HITECH, imposes specific requirements relating to the privacy, security, and transmission of individually identifiable health data. See the risk factor captioned "Our business and relationships with customers and third-party payors in the United States and elsewhere may be subject, directly or indirectly, to applicable anti-kickback, fraud and abuse, false claims, transparency, health information privacy and security and other healthcare laws and regulations, which could expose us to significant penalties, including criminal sanctions, civil penalties, contractual damages, reputational harm, administrative burdens and diminished profits and future earnings." Numerous U.S. states have also enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, or CPRA, collectively CCPA, applies to personal data of consumers, business representatives, and employees who are California residents. These obligations include, but are not limited to, providing specific disclosures in privacy notices and honoring requests of such individuals certain rights related to their personal data. The CCPA provide for fines of up to $7,500 per intentional violation and allows private litigants affected by certain data breaches to recover significant statutory damages. While the CCPA and other comprehensive state privacy laws contain limited exceptions for clinical trial data, these developments may further complicate compliance efforts, and increase legal risk and compliance costs for us and the third parties upon whom we rely. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. In addition to data privacy and security laws, we may be contractually subject to industry standards adopted by industry groups and may become subject to such obligations in the future. We are also bound by other contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. For example, clinical trial participants or research subjects about whom we or our vendors obtain information, as well as the providers who share this information with us, may contractually limit our ability to use and disclose the information. We have published privacy policies, marketing materials, and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and security. If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators, or other adverse consequences. Obligations related to data privacy and security (and consumers' data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. It is possible that, in the future, we may fail or be perceived to have failed to comply with applicable data privacy and security obligations. Moreover, despite our best compliance efforts, our personnel or third parties whom we rely on could fail to comply with such obligations, which could negatively impact our business operations and compliance posture. If we or the third parties on which we rely fail, or are perceived to have failed, to address or comply with data privacy and security obligations, we could face significant consequences. These consequences may include, but are not limited to, government enforcement actions; litigation (including class claims) and mass arbitration demands; additional reporting requirements and/or oversight; bans on processing personal data; orders to destroy or not use personal data; and imprisonment of company officials. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: interruptions or stoppages in our business operations including, as relevant, clinical trials; inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize uproleselan; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or revision or restructuring of our operations.

In the past, litigation, including securities class action litigation, has often followed certain significant business transactions, such as the sale of a company or announcement of any other strategic transaction, or the announcement of negative events, such as negative results from clinical trials. These events may also result in investigations by the SEC. We may be exposed to such litigation, even if no wrongdoing occurred. Litigation is usually expensive, uncertain, and diverts management's attention and resources, which could adversely affect our business and cash resources and our ability to consummate the Merger with Crescent.

We previously engaged a third-party contract research organization, or CRO, to conduct our clinical trials for uproleselan. If we were to resume clinical development, we would expect to engage CROs with respect to any further clinical trials of uproleselan or any of our other drug candidates that may progress to clinical development. We would also expect to rely on third parties, such as CROs, clinical data management organizations, medical institutions and clinical investigators, to conduct those clinical trials. Agreements with such third parties might terminate for a variety of reasons, including a failure to perform by the third parties. If we need to enter into alternative arrangements, that would delay our drug development activities. Our reliance on these third parties for research and development activities would reduce our control over these activities, but would not relieve us of our responsibilities. For example, we would remain responsible for ensuring that each of our clinical trials is conducted in accordance with the general investigational plan and protocols for the trial. Moreover, the FDA requires us to comply with standards, commonly referred to as good clinical practices, or GCPs, for conducting, recording and reporting the results of clinical trials to assure that data and reported results are credible and accurate and that the rights, integrity and confidentiality of trial participants are protected. We also are required to register ongoing clinical trials and post the results of completed clinical trials on a government-sponsored database, ClinicalTrials.gov, within specified timeframes. Failure to do so can result in fines, adverse publicity and significant civil and criminal sanctions. Furthermore, these third parties may also have relationships with other entities, some of which may be our competitors. If these third parties do not successfully carry out their contractual duties, meet expected deadlines or conduct our clinical trials in accordance with regulatory requirements or our stated protocols, we will not be able to obtain, or may be delayed in obtaining, marketing approvals for our drug candidates and will not be able to, or may be delayed in our efforts to, successfully commercialize our drug candidates. We also expect to rely on other third parties to store and distribute drug supplies for any further clinical trials that we were to conduct. Any performance failure on the part of our distributors could delay clinical development or marketing approval of our drug candidates or commercialization of our drugs, producing additional losses and depriving us of potential revenue.