Harvard Apparatus Regenerative Technology (HRGN) Risk Analysis

In the ordinary course of business, we and the third parties upon which we rely and may process proprietary, confidential, and sensitive data, including personal data (such as health-related data), intellectual property, and trade secrets (collectively, sensitive information). Cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties upon which we rely. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties upon which we rely may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability conduct our research and development programs and our clinical trials. We and the third parties upon which we rely may be subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through phishing attacks and deep fakes, which may be increasingly more difficult to identify as fake), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, and other similar threats. In particular, severe ransomware attacks are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, disruption of clinical trials, loss of sensitive data (including data related to clinical trials), loss of income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Remote work has become more common and has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers, and devices outside of our premises or network, including working at home, while in transit and in public locations. Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. In addition, our reliance on third-party service providers could introduce new cybersecurity risks and vulnerabilities, including supply-chain attacks, and other threats to our business operations. We may rely on third- party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, third-party providers of information technology infrastructure, cloud-based infrastructure, encryption and authentication technology, employee email, content delivery to customers, CROs for managing clinical trial data, and other functions. We may also rely on third-party service providers to provide other products, services, parts, or otherwise operate our business. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, the liability of such third party may be limited such that any award may be insufficient to cover our damages, or we may be unable to recover any such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties' infrastructure in our supply chain or our third-party partners' supply chains have not been compromised. We may expend significant resources or modify certain of our business activities (which could include our clinical trial activities) to try to protect against security incidents. Certain data privacy and security obligations may require us to implement and maintain specific security measures, industry-standard or reasonable security measures to protect our information technology systems and sensitive information. While we have established physical, electronic and organizational security measures designed to safeguard and secure our systems against security incidents, there can be no assurance that these measures will be effective. We take steps designed to detect, mitigate and remediate vulnerabilities in our information technology systems (such as our hardware and/or software, including that of third parties upon which we rely). We may not, however, detect and remediate all such vulnerabilities including on a timely basis. Further, we may experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities. Vulnerabilities could be exploited and result in a security incident. Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our products. For example, the loss of clinical trial data from completed or ongoing or planned clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. Applicable data privacy and security obligations may require us to notify relevant stakeholders of security incidents. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences. These consequences may include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class-action claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss; and other similar harms. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

Our success is highly dependent on the continued services of key management, technical and scientific personnel and collaborators. Our management and other employees may voluntarily terminate their employment at any time upon short notice. The loss of the services of any member of our senior management team, including our Chief Executive Officer Jerry He, our President Hong Yu, our Chief Scientific Officer Dr. William Fodor, and our Chief Financial Officer Joseph Damasio, and our other key scientific, technical and management personnel, may significantly delay or prevent the achievement of product development and other business objectives. We can give no assurance that we could find satisfactory replacements for our current and future key scientific and management employees, including recently terminated executives, on terms that would not be unduly expensive or burdensome to us.

We currently have the majority of our cash and cash equivalents held in deposit at East West Bank. While the amounts held in the deposit accounts as of December 31, 2023 were less than the insurance coverage offered by the FDIC, in the future, we will likely maintain our cash assets at financial institutions in the U.S. in amounts that may be in excess of the FDIC insurance limit of $250,000. Actual events involving limited liquidity, defaults, non-performance or other adverse developments that affect financial institutions, transactional counterparties or other companies in the financial services industry or the financial services industry generally, or concerns or rumors about any events of these kinds or other similar risks, have in the past and may in the future lead to market-wide liquidity problems. For example, on March 10, 2023, Silicon Valley Bank, or SVB, was closed by the California Department of Financial Protection and Innovation, which appointed the FDIC as receiver. In the event of a failure or liquidity issue of or at any of these financial institutions where we maintain our deposits or other assets, we may incur a loss, and to the extent such loss exceeds the FDIC insurance limitation it could have a material adverse effect upon our liquidity, financial condition and our results of operations.

We expect to compete with multiple pharmaceutical, biotechnology, medical device and scientific research product companies. In addition, there are many academic and clinical centers that are developing bioengineered or regenerative organ technologies that may one day become competitors for us. Many of our competitors and potential competitors have substantially greater financial, technological, research and development, marketing, and personnel resources than we do. We cannot, with any accuracy, forecast when or if these companies are likely to bring bioengineered organ or regenerative medicine products to market for indications that we are also pursuing. Many of these potential competitors may be further along in the process of product development and also operate large, company-funded research and development programs. We expect that other products will compete with our current and future products based on efficacy, safety, cost, and intellectual property positions. While we believe that these will be the primary competitive factors, other factors include obtaining marketing exclusivity under certain regulations, availability of supply, manufacturing, marketing and sales expertise and capability, and reimbursement coverage. Our competitors may develop or market products that are more effective or commercially attractive than our current or future products and may also develop competing relationships with our key collaborators. In addition, we may face competition from new entrants into the field. We may not have the financial resources, technical expertise or marketing, distribution or support capabilities to compete successfully in the future. The effects of any such actions of our competitors may have a materially adverse effect on our business, operating results and financial condition.

Even if we receive regulatory approvals for the commercial use of our product candidates, their commercial success will depend upon acceptance by physicians, patients, third party payers such as health insurance companies and other members of the medical community. Market acceptance of our products is also dependent upon our ability to provide acceptable evidence and the perception of the positive characteristics of our products relative to existing or future treatment methods, including their safety, efficacy and/or other positive advantages. If our products fail to gain market acceptance, we may be unable to earn sufficient revenue to continue our business. Market acceptance of, and demand for, any product that we may develop and commercialize will depend on many factors, both within and outside of our control. If our products receive only limited market acceptance, our business, financial condition and results of operations would be materially and adversely affected.

Our success will depend in part upon our and our collaborators' ability to develop therapeutic approaches incorporating, or discovered through, the use of cells. If bioengineered organ implant technology is perceived negatively by the public for social, ethical, medical or other reasons, governmental authorities in the U.S. and other countries may call for prohibition of, or limits on, cell-based technologies and other approaches to bioengineering and tissue engineering. Although our product candidates have not, to date, used the more controversial stem cells derived from human embryos or fetuses in the human transplant surgeries using our product candidates, claims that human-derived stem cell technologies are ineffective or unethical may influence public attitudes. The subject of cell and stem cell technologies in general has at times received negative publicity and aroused public debate in the U.S. and some other countries. Ethical and other concerns about such cells could materially harm the market acceptance of our product candidates.

We intend to generate significant revenues outside the U.S. in multiple foreign currencies including Chinese Renminbi, Euros, British pounds, and in U.S. dollar-denominated transactions conducted with customers who generate revenue in currencies other than the U.S. dollar. In such instances, for those foreign customers who purchase our products in U.S. dollars, currency fluctuations between the U.S. dollar and the currencies in which those customers do business may have a negative impact on the demand for our products in foreign countries where the U.S. dollar has increased in value compared to the local currency. Since we may have vendors and customers outside the U.S. and we may generate revenues and incur operating expenses in multiple foreign currencies, we will experience currency exchange risk with respect to any foreign currency-denominated revenues and expenses. We cannot predict the consolidated effects of exchange rate fluctuations upon our future operating results because of the number of currencies involved, the variability of currency exposure and the potential volatility of currency exchange rates. Our international activities subject us to laws regarding sanctioned countries, entities and persons, customs, import-export, laws regarding transactions in foreign countries, the U.S. Foreign Corrupt Practices Act and local anti-bribery and other laws regarding interactions with healthcare professionals. Among other things, these laws restrict, and in some cases prohibit, U.S. companies from directly or indirectly selling goods, technology or services to people or entities in certain countries. In addition, these laws require that we exercise care in structuring our sales and marketing practices in foreign countries. Local economic conditions, legal, regulatory or political considerations, disruptions from strikes, the effectiveness of our sales representatives and distributors, local competition and changes in local medical practice could also affect our sales to foreign markets. Relationships with customers and effective terms of sale frequently vary by country, often with longer-term receivables than are typical in the U.S.

The impact of the COVID-19 outbreak has subsided substantially in the U.S. but continues to result in reduced activity levels outside of the U.S., such as continued restrictions on travel and business operations and advising or requiring individuals to limit or forego their time outside of their homes or places of business. In response to the global supply chain instability and inflationary cost increases, we have taken action to minimize, as much as possible, any potential adverse impacts by working with our suppliers to monitor the availability of raw material components (e.g., polymers and organic solvents), lead times, and freight carrier availability. We expect global supply chain instability will continue to have an impact on our business, but to date that has not been material to our financial performance or the development of our products. The consequences of the pandemic, global supply chain instability and inflationary cost increases and their adverse impact to the global economy, continue to evolve. Accordingly, the significance of the future impact to our business, financial condition and results of operations remains subject to significant uncertainty.

There is currently significant uncertainty about the future relationship between the United States and China, including with respect to trade policies, treaties, government regulations and tariffs. The current United States administration has called for substantial changes to U.S. foreign trade policy including greater restrictions on international trade and significant increases in tariffs on goods imported into the U.S. Under the current status, we do not expect that this tariff will significantly impact any Harvard Apparatus Regenerative Technology products and thus the tariff should not have a materially adverse effect on our business, financial condition or results of operations. We are unable to predict whether or when additional tariffs will be imposed or the impact of any such future tariff increases.