Hyrecar (HYREQ) Risk Analysis

We are highly dependent upon the retention of the services of our current executive management team, specifically Joseph Furnari, Kenneth Grimes, Serge De Bock and Brian Allan. The loss of any one of these individuals could adversely affect our operations and financial results. Our business also depends on our ability to attract and retain additional highly qualified management, technical, operating, and sales and marketing personnel. We do not currently maintain key person life insurance policies on any of our employees. We do not have fixed term employment agreements with any of our management employees, all of whom could terminate their relationship with us at any time.

We establish insurance reserves for claims incurred but not yet paid and claims incurred but not yet reported and any related estimable expenses, and we periodically evaluate and, as necessary, adjust our insurance reserves as our experience develops or new information is learned. We employ various predictive modeling actuarial techniques and make numerous assumptions based on limited historical experience and industry statistics to estimate our insurance reserves. Estimating the frequency and severity of claims, as well as related judgment or settlement amounts, is inherently difficult, subjective, and speculative. A number of external factors can affect the actual losses incurred for any given claim, including the length of time the claim remains open, fluctuations in healthcare costs, legislative and regulatory developments, jurisdiction and judicial developments. Additionally, we may encounter in the future, instances of insurance fraud, which could increase our actual insurance-related costs. For any of the foregoing reasons, our actual losses for claims and related expenses may deviate, individually or in the aggregate, from the insurance reserves reflected in our consolidated financial statements. If we determine that our estimated insurance reserves are inadequate, we may be required to increase such reserves at the time of the determination, which could result in an increase to our net loss in the period in which the deficiency is determined and negatively impact our financial condition and results of operations.

Our business involves the storage and transmission of a significant amount of personal and/or confidential information, including the personal information of our users, the personal information of our drivers and employees, information relating to user preferences, confidential information of our partners, and our own proprietary financial, operational and strategic information. The protection of our information, as well as information relating to our users, drivers, partners, and employees, is vitally important to us as the loss, theft, misuse, or unauthorized disclosure of such information could lead to significant reputational or competitive harm, result in litigation involving us or our business partners, expose us to regulatory proceedings, and cause us to incur substantial liability or expenses. As has been well documented in the media, the frequency, intensity, and sophistication of cyber-attacks and data security incidents has significantly increased in recent years. As with many businesses, we are subject to numerous data privacy and security risks, which may prevent us from maintaining the privacy of personal, confidential, and sensitive information, result in the disruption of our business, and require us to expend significant resources attempting to secure and protect such information and respond to incidents, any of which could seriously harm our business. Due to the increased risk of these types of attacks and incidents, we expend significant resources on information technology and data security tools, measures, and processes designed to protect personal, confidential or sensitive information and to ensure an effective response to any cyber-attack or data security incident. Whether or not these measures are ultimately successful, the expenditures could have an adverse impact on our financial condition and results of operations and divert management's attention from pursuing our strategic objectives. In addition, although we take the security of our information technology systems and platform seriously, our efforts to protect the personal and confidential information of our users, drivers, partners, employees, and company may be unsuccessful due to the actions of third parties, malicious code, software bugs, or other technical malfunctions. Despite our security efforts, because the techniques used to obtain unauthorized access to information technology systems and our platform are constantly evolving and, in some cases, becoming more sophisticated and harder to detect, we may be unable to anticipate these techniques or implement adequate preventive measures in response, and cyber-attacks or data incidents could remain undetected for some period, which could potentially result in greater harm to our systems, our platform, and the information stored and transmitted by our systems. In addition, and despite our security efforts and training, our employees may also inadvertently or intentionally cause security incidents that could result in the unauthorized disclosure of personal or confidential information, and third parties may attempt to fraudulently induce employees or users to disclose information to gain access to our data or our users' data. If any of these events occur, our confidential information or our users' personal information could be accessed, acquired, disclosed, or used without authorization, which could harm our relationships with users, put us at a competitive disadvantage, result in the deterioration of our users' confidence in us, cause our partners to reconsider their relationship with our company or impose more onerous contractual provisions, and subject us to potential litigation, liability, fines, and penalties. For example, we could be subject to regulatory or other actions pursuant to domestic privacy laws, including newer regulations such as the California Consumer Privacy Act. This could result in costly investigations and litigation, civil or criminal penalties, operational changes, and negative publicity that could adversely affect our reputation. Further, some of our partners may store personal or confidential information that we share with them. If these third parties fail to implement adequate data-security practices or fail to comply with our terms and policies, our users' data may be improperly accessed, acquired, or disclosed. And even if these third parties take all these steps, their networks and information technology systems may still suffer a security breach, which could compromise our users' data or our company data. Any incidents where our users' information or confidential company information is accessed without authorization, improperly disclosed, or misused, or incidents that violate our terms of service or policies, could damage our reputation and our brand and diminish our competitive position. Maintaining the trust of our users is important to sustain our growth, retention, and user engagement. Concerns over our privacy practices, whether actual or unfounded, could damage our reputation and brand and deter users, advertisers, and partners from using our products and services. Any of these occurrences could seriously harm our business.

Our ability to, among other things, operate our platform, process rental transactions, manage our pricing, account for our activities and otherwise conduct our business is dependent on the performance and availability of our networks and systems, as well as those of third-party cloud providers. We have experienced, and from time to time in the future may experience, a failure or interruption that results in the unavailability of certain information systems. Additionally, our major information technology systems and accounting functions are centralized in a few locations. Any disruption, termination or substandard provision of services, including by third-party cloud providers, whether as the result of localized conditions (e.g., fire, explosion or hacking), failure of our systems to function as designed, or as the result of events or circumstances of broader geographic impact (e.g., earthquake, storm, flood, epidemic, strike, act of war, civil unrest or terrorist act), could materially adversely affect our business by disrupting normal operations, customer service, accounting and technology functions; interfering with our ability to manage vehicle supply; delaying or disrupting rental processes; and otherwise impacting our ability to manage our business. These events could, individually or in the aggregate, lead to lower revenues, increased costs or other effects on our results of operations, financial condition, liquidity and cash flows, which may be material.

We are subject to a wide variety of laws in the United States and other jurisdictions. Laws, regulations and standards governing issues such as TNCs, ridesharing, food and package delivery, worker classification, labor and employment, anti-discrimination, payments, gift cards, whistleblowing and worker confidentiality obligations, product liability, defects, maintenance and repairs, personal injury, text messaging, subscription services, intellectual property, consumer protection, taxation, privacy, data security, competition, unionizing and collective action, arbitration agreements and action waiver provisions, terms of service, mobile application accessibility, autonomous vehicles, bike and scooter sharing, insurance, vehicle rentals, money transmittal, non-emergency medical transportation, environmental health and safety, background checks, public health, anti-corruption, anti-bribery, and delivery of goods including (but not limited to) medical supplies, perishable foods and prescription drugs are often complex and subject to varying interpretations, in many cases due to their lack of specificity. As a result, their application in practice may change or develop over time through judicial decisions or as new guidance or interpretations are provided by regulatory and governing bodies, such as federal, state and local administrative agencies. Recent financial, political and other events have increased the level of regulatory scrutiny on larger companies, technology companies in general and companies engaged in dealings with independent contractors, such as ridesharing and delivery companies. Regulatory bodies may enact new laws or promulgate new regulations that are adverse to our business, or, due to changes in our operations and structure or partner relationships as a result of changes in the market or otherwise, they may view matters or interpret laws and regulations differently than they have in the past or in a manner adverse to our business. For example, Assembly Bill 5 (as codified in part at Cal. Labor Code sec. 2750.3) codified and extended an employment classification test in Dynamex Operations West, Inc. v. Superior Court, which established a new standard for determining employee or independent contractor status. The passage of this bill led to additional challenges to the independent contractor classification of drivers using the Lyft and Uber platforms. In November 2020, California voters approved Proposition 22, a California state ballot initiative that provides a framework for drivers that use platforms like Uber and Lyft for independent work. Proposition 22 went into effect in December 2020 and we expect that drivers will be able to maintain their status as independent contractors under California law and that TNCs will be required to comply with the provisions of Proposition 22. Legal challenges to Proposition 22 have been and may continue to be filed.

The ridesharing market has grown rapidly since we launched our car-sharing marketplace in 2014, but it is still relatively new, and it is uncertain to what extent market acceptance will continue to grow. Our success will depend to a substantial extent on the willingness of people to widely-adopt car-sharing and ride-sharing generally. We cannot be certain whether the on-going COVID-19 pandemic will from time to time negatively impact the willingness of drivers or passengers to participate in ridesharing or otherwise adversely affect demand for our services. If the public does not perceive ridesharing as beneficial, or chooses not to adopt it as a result of concerns regarding public health or safety, affordability or for other reasons, whether as a result of incidents on Lyft or Uber or similar platforms, the on-going COVID-19 pandemic, or otherwise, then the market for our services may not further develop, may develop more slowly than we expect or may not achieve the growth potential we expect. Additionally, from time to time we may re-evaluate the markets in which we operate, and we have discontinued and may in the future discontinue operations in certain markets as a result of such evaluations. Any of the foregoing risks and challenges could adversely affect our business, financial condition and results of operations.