Ovid Therapeutics (OVID) Risk Factors

We are increasingly dependent on information technology systems and infrastructure, including mobile technologies, to operate our business. In the ordinary course of our business, we collect, store, process and transmit large amounts of sensitive data, and, as a result, we and the third parties upon which we rely face a variety of evolving threats that could cause security incidents. We have also outsourced elements of our operations (including elements of our information technology infrastructure) to third parties, and as a result, we manage a number of third-party vendors who may or could have access to our computer networks or our sensitive data. In addition, many of those third parties in turn subcontract or outsource some of their responsibilities to other third parties. While all information technology operations are inherently vulnerable to inadvertent or intentional security breaches, incidents, attacks and exposures, the accessibility and distributed nature of our information technology systems, and the sensitive data stored on those systems, make such systems vulnerable to unintentional or malicious, internal and external attacks on our technology environment. Furthermore, our ability to monitor the aforementioned third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties' infrastructure in our supply chain or our third-party partners' supply chains have not been compromised. Increasing global tensions, including the ongoing war between Russia and Ukraine and the war involving Israel, among others, are likely to increase the frequency of cybersecurity incidents. In addition, due to our hybrid-work environment, we may be more vulnerable to cyberattacks as more of our employees utilize network connections, computers, and devices outside our premises or network, including working at home, while in transit and in public locations. Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program. Potential vulnerabilities can be exploited from inadvertent or intentional actions of our employees, third-party vendors, business partners, or by malicious third parties. We take steps designed to detect, mitigate, and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties upon which we rely); however, we may not detect and remediate all such vulnerabilities on a timely basis. Further, we may experience delays in deploying remedial measures and patches designed to address identified vulnerabilities. Vulnerabilities could be exploited and result in a security incident. Cyberattacks, malicious internet-based activity, online and offline fraud, and other similar activities are increasing in their frequency, levels of persistence, sophistication and intensity, and are also being conducted by sophisticated and organized groups and individuals with a wide range of motives (including, but not limited to, industrial espionage) and expertise, including organized criminal groups, "hacktivists," nation states and others. Such attacks could include the deployment of harmful malware (including as a result of advanced persistent threat intrusions), ransomware attacks, denial-of-service attacks, credential stuffing and/or harvesting, social engineering (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of sensitive data or other information technology assets, adware, attacks enhanced or facilitated by artificial intelligence, telecommunications failures, earthquakes, fires, floods and other means to affect service reliability and threaten the confidentiality, integrity and availability of our information systems and sensitive data. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, ability to provide our products or services, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Significant disruptions of our, our third-party vendors' and/or business partners' information technology systems or other similar data security incidents could adversely affect our business operations and/or result in the loss, misappropriation, and/or unauthorized access, use or disclosure of, or the prevention of access to, sensitive data, which could result in financial, legal, regulatory, business and reputational harm to us. In addition, information technology system disruptions, whether from attacks on our technology environment or from computer viruses, natural disasters, terrorism, war and telecommunication and electrical failures, could result in a material disruption of our development programs and our business operations. For example, the loss of clinical trial data from completed or future clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. We may expend significant resources or modify our business activities to try to protect against security incidents. Additionally, certain data privacy and security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive data. Applicable data privacy and security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, including but not limited to a security incident involving personal information regarding our patients or employees, we may experience adverse consequences, such as disruptions to our business, harm to our reputation, government enforcement actions (for example, investigations, fines, penalties, audits, and inspections), additional reporting requirements, and/or oversight, or we may otherwise be subject to liability under laws, regulations and contractual obligations, including those that protect the privacy and security of personal information. This could result in increased costs to us, and result in significant legal and financial exposure and/or reputational harm. In addition, any failure or perceived failure by us or our vendors or business partners to comply with our privacy, confidentiality or data security-related legal or other obligations to third parties, or any further security incidents or other inappropriate access events that result in the unauthorized access, release or transfer of sensitive data, may result in governmental investigations, enforcement actions, regulatory fines, litigation, or public statements against us by advocacy groups or others, and could cause third parties, including clinical sites, regulators or current and potential partners, to lose trust in us or we could be subject to claims by third parties that we have breached our privacy- or confidentiality-related obligations, which could materially and adversely affect our business and prospects. Moreover, data security incidents and other inappropriate access can be difficult to detect, and any delay in identifying them may lead to increased harm of the type described above. While we have implemented security measures intended to protect our information technology systems and infrastructure, there can be no assurance that such measures will be effective. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations.