Prophase Labs (PRPH) Risk Factors

Future sales of substantial amounts of shares of our common stock in the public market, or the perception that such sales are likely to occur, could adversely affect the prevailing trading prices of our common stock. Moreover, the perceived risk of potential dilution could cause stockholders to attempt to sell their shares and investors to "short" our stock, a practice in which an investor sells shares that he or she does not own at prevailing market prices, hoping to purchase shares later at a lower price to cover the sale. All of these events could combine to make it difficult for us to sell equity or equity-related securities in the future at a time and price that we deem appropriate.

We have had limited history of profitability. While we were profitable for years ended December 31, 2022 and 2021 due to the diagnostic services that we provided, there is no certainty that we will be profitable in future years. We incurred net losses of approximately $16.8 million as of December 31, 2023 and expect to continue to incur significant operating and capital expenditures. We anticipate that our expenses will increase substantially if, and as we: - continue our current research programs and our preclinical and clinical development of product candidates;- initiate preclinical studies and clinical trials for any other product candidates we identify and choose to develop;- expand, maintain, enforce and/or defend our intellectual property;- seek marketing approvals for any of our product candidates that successfully complete clinical trials;- hire additional clinical, quality control and scientific personnel;- establish, expand or contract for manufacturing capabilities;- add operational, financial and management information systems and personnel, including personnel to support our product candidate development; and - acquire or in-license other technologies. Because of the numerous risks and uncertainties associated with our business, we are unable to predict the extent of any future losses or when we will become profitable, if at all. Even if we do become profitable, we may not be able to sustain or increase our profitability on a quarterly or annual basis. With the significant reduction of our diagnostic services and as we fund capital expenditures, we also expect to experience limited cash flow for the foreseeable future. We cannot guarantee that revenues from the genomics business and the contract manufacturing business will be sufficient to supplant the reduction in the diagnostic services revenues. If these revenues are not sufficient to replace the revenues from our diagnostic services, then the Company may continue to suffer yearly losses. As a result, we will need to generate significant revenues in order to achieve profitability or raise significant capital. We may not be able to generate these revenues or raise capital in the future. Our failure to achieve or maintain profitability could negatively impact the value of our common stock. Refer to risk factors under the section titled "Risks Related to Our Diagnostic Business" for more information relating to risks associated with our diagnostic services and the significant reduction of such services.

Our ability to make scheduled payments of the principal of, to pay interest on or to refinance our indebtedness depends on our future performance, which is subject to economic, financial, competitive and other factors beyond our control. We had, as of September 30, 2024, approximately $17.2 million of outstanding indebtedness, net of discounts and approximately $0.5 million in cash and cash equivalents. In addition, on August 15, 2024, we entered into the Amended JXVII Note that increased the principal amount from $7.6 million to $10.0 million; and on October 22, 2024, we entered into the Term Note for cash proceeds of $500,000. Our business may not generate cash flow from operations in the future sufficient to service our debt obligations and make necessary capital expenditures. If we are unable to generate such cash flow, we may be required to adopt one or more alternatives, such as selling assets, restructuring debt or obtaining additional equity capital on terms that may be onerous or highly dilutive. Our ability to refinance our indebtedness will depend on the capital markets and our financial condition at such time. We may not be able to engage in any of these activities or engage in these activities on desirable terms, which could result in a default on our debt obligations.

Since our sale of the Cold-EEZE™ business in March 2017, we have actively explored and pursued new product technologies, applications, product line extensions and other new product and business opportunities. In October 2020, we purchased our first CLIA licensed laboratory in Old Bridge, New Jersey, where we offered a variety of important medical tests, including, among others, COVID-19 diagnostic testing and Influenza A and B. In December 2020, we expanded our diagnostic services to a second location in Garden City, New York. In August 2021, we acquired Nebula, a privately-owned personal genomics company. We have transitioned Nebula's whole genome sequencing services into the area where clinical diagnostic services were offered at our CLIA-certified molecular testing laboratories. In March 2022, we formed ProPhase Biopharma, Inc. for the licensing, development and commercialization of novel drugs, dietary supplements, and compounds. We may in the future consider and pursue investments and acquisitions in other sectors and industries. We have and will continue to incur significant expenses as we grow our new businesses. In order for us to be profitable, we must generate sufficient revenue to cover our expenses. There can be no assurance that our different business lines will succeed or that we will be successful in initiating or acquiring any new lines of business in the future, or that any such new business lines will achieve profitability.

Although the FDA has found substantial evidence to support approval outside of the traditional phase 1, phase 2, and phase 3 framework for certain therapies, the general approach for FDA approval of a new drug is for the sponsor to provide dispositive data from at least two adequate and well-controlled clinical trials of the relevant biologic in the applicable patient population. Such clinical trials typically involve hundreds of patients, have significant costs, and take years to complete. We do not have agreement or guidance from the FDA that our regulatory development plans will be sufficient for submission of a NDA. In addition, the standard of care may change with the approval of new products in the same indications to which our product candidates are directed. This may result in the FDA or other regulatory authorities requesting additional studies to show that our product candidate is comparable or superior to the new products. Our clinical trial results may also not support marketing approval. In addition, our product candidates could fail to receive regulatory approval for many reasons, including: - the FDA or other regulatory authorities may disagree with the design or implementation of our clinical trials;- we may be unable to demonstrate to the satisfaction of the FDA or other regulatory authorities that our product candidates are safe and effective for their proposed indications;- the results of clinical trials may not meet the level of statistical significance required by the FDA or other regulatory authorities for approval, including due to heterogeneity of patient populations;- we may be unable to demonstrate that the clinical and other benefits of our product candidates outweigh the safety risks;- the data collected from clinical trials of our product candidates may not be sufficient to the satisfaction of the FDA or other regulatory authorities to support the submission of a NDA or a similar filing in a foreign jurisdiction or to support commercial reimbursement;- the FDA or other authorities will review our manufacturing processes and inspect our CMOs' facilities and may not approve our manufacturing processes or CMOs' facilities; and - the approval policies or regulations of the FDA or other regulatory authorities may significantly change in a manner rendering our clinical data insufficient for approval. Even if we comply with all FDA requests, we may still fail to obtain regulatory approval. We cannot be sure that we will ever obtain regulatory clearance for our product candidates.

As a direct marketer and manufacturer of products designed for human consumption, we are subject to product liability claims if the use of our products or the products that we manufacture for third parties are alleged to have resulted in injury or to include inadequate instructions for use or inadequate warnings concerning possible side effects and interactions with other substances. Our current products and the products that we currently manufacture for third parties are not subject to pre-market regulatory approval in the United States and could contain contaminated substances. While we currently maintain product liability insurance, a successful claim brought against us related to our branded products or products that we manufacture for third parties in excess of, or outside of, our existing insurance coverage, could result in increased costs and could adversely affect our reputation with customers, which could in turn materially adversely affect our business, financial condition and results of operations.

There are a number of state, federal and international laws protecting the privacy and security of health information and personal data. Under the administrative simplification provisions of HIPAA, HHS has issued regulations which establish uniform standards governing the conduct of certain electronic health care transactions and protecting the privacy and security of PHI used or disclosed by health care providers and other covered entities. The privacy regulations regulate the use and disclosure of PHI by health care providers engaging in certain electronic transactions or "standard transactions." They also set forth certain rights that an individual has with respect to his or her PHI maintained by a covered health care provider, including the right to access or amend certain records containing PHI or to request restrictions on the use or disclosure of PHI. The HIPAA security regulations establish administrative, physical, and technical standards for maintaining the integrity and availability of PHI in electronic form. These standards apply to covered health care providers and also to "business associates" or third parties providing services involving the use or disclosure of PHI. The HIPAA privacy and security regulations establish a uniform federal "floor" and do not supersede state laws that are more stringent or provide individuals with greater rights with respect to the privacy or security of, and access to, their records containing PHI. As a result, we may be required to comply with both HIPAA privacy regulations and varying state privacy and security laws. Moreover, HITECH, among other things, established certain health information security breach notification requirements. In the event of a breach of unsecured PHI, a covered entity must notify each individual whose PHI is breached, federal regulators and in some cases, must publicize the breach in local or national media. Breaches affecting 500 individuals or more are publicized by federal regulators who publicly identify the breaching entity, the circumstances of the breach and the number of individuals affected. These laws contain significant fines and other penalties for wrongful use or disclosure of PHI. Given the complexity of HIPAA and HITECH and their overlap with state privacy and security laws, and the fact that these laws are rapidly evolving and are subject to changing and potentially conflicting interpretation, our ability to comply with the HIPAA, HITECH and state privacy requirements is uncertain and the costs of compliance are significant. Adding to the complexity is that our planned operations are currently evolving, and the requirements of these laws will apply differently depending on such things as whether or not we bill electronically for our services or provide services involving the use or disclosure of PHI and incur compliance obligations as a business associate. The costs of complying with any changes to the HIPAA, HITECH and state privacy restrictions may have a negative impact on our operations. Noncompliance could subject us to criminal penalties, civil sanctions and significant monetary penalties as well as reputational damage. We are also required to collect and maintain personal information about our employees as well as receive and transfer certain payment information, to accept payments from our customers, including credit card information. Most states have adopted laws requiring notification of affected individuals and state regulators in the event of a breach of personal information, which is a broader class of information than the health information protected by HIPAA. Many state laws impose significant data security requirements, such as encryption or mandatory contractual terms to ensure ongoing protection of personal information. Activities outside of the United States implicate local and national data protection standards, impose additional compliance requirements, and generate additional risks of enforcement for non-compliance. The collection and use of such information may be subject to contractual obligations as well. If the security and information systems that we or our outsourced third-party providers use to store or process such information are compromised or if we, or such third parties, otherwise fail to comply with these laws, regulations, and contractual obligations, we could face litigation and the imposition of penalties that could adversely affect our financial performance. Numerous additional local, municipal, state, federal, and international laws and regulations address privacy and the collection, storing, sharing, use, disclosure, and protection of certain types of data, including the California Online Privacy Protection Act, the Personal Information Protection and Electronic Documents Act, the Telephone Consumer Protection Act of 1991, Section 5 of the Federal Trade Commission Act, and effective as of January 1, 2020, the CCPA. These laws, rules, and regulations evolve frequently, and their scope may continually change, through new legislation, amendments to existing legislation, and changes in enforcement, and may be inconsistent from one jurisdiction to another. For example, the CCPA, which went into effect on January 1, 2020, among other things, requires new disclosures to California consumers and affords such consumers new abilities to opt out of certain sales of personal information. The CCPA provides for fines of up to $7,500 per violation. Aspects of the CCPA and its interpretation and enforcement remain uncertain. The effects of this legislation potentially are far-reaching and may require us to modify our data processing practices and policies and incur substantial compliance-related costs and expenses. The CCPA has been amended on multiple occasions, resulting in further uncertainty and requiring us to incur additional costs and expenses in an effort to comply. The CPRA became operative on January 1, 2023 (and applies to consumer data collected on or after January 1, 2022, (the "lookback period"), with enforcement beginning July 1, 2023. While the CCPA will remain operative and enforceable from now until July 1, 2023, we will continue to monitor developments related to the CPRA. The effects of this legislation potentially are far-reaching, however, and may require us to modify our data processing practices and policies and incur substantial compliance-related costs and expenses. Additionally, many laws and regulations relating to privacy and the collection, storing, sharing, use, disclosure, and protection of certain types of data are subject to varying degrees of enforcement and new and changing interpretations by courts. New laws governing the privacy of consumer health data, including information concerning genetic information, individual health conditions, and treatment have also passed in the United States. For example, Washington's My Health My Data Act which broadly defines consumer health data, places restrictions on processing consumer health data (including imposing stringent requirements for obtaining consumer consent), provides consumers certain rights with respect to their health data, and creates a private right of action to allow individuals to sue for violations of the law. Other states, including California, could adopt similar laws. Additionally, the General Data Protection Regulation ('GDPR") imposes stringent requirements on the processing of "personal data", including health and sensitive data, by business who target EU consumers or operate in the EU. The GDPR is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including requirements relating to certain health data, obtaining consent of the individuals to whom the personal data relates, providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of the personal data, providing notification of data breaches, and taking specific measures when disclosing the personal data to third parties. Penalties for businesses who are not compliant with the GDPR can reach up to 4% of global revenues. Additionally, post-Brexit, the UK has adopted its version of the GDPR (UK GDPR) alongside amendments to its Data Protection Act 2018, creating a separate regulatory environment that may impact global economic conditions and market operations. Changes in laws or regulations relating to privacy, data protection, breach notifications, and information security, particularly any new or modified laws or regulations, or changes to the interpretation or enforcement of such laws or regulations, that require enhanced protection of certain types of data or new obligations with regard to data retention, transfer, or disclosure, could greatly increase the cost of providing our platform, require significant changes to our operations, or even prevent us from providing our platform in jurisdictions in which we currently operate and in which we may operate in the future. We may face audits or investigations by one or more domestic government agencies or our customers pursuant to our contractual obligations relating to our compliance with these regulations. Complying with changing regulatory requirements requires us to incur substantial costs, exposes us to potential regulatory action or litigation, and may require changes to our business practices in certain jurisdictions, any of which could materially adversely affect our business operations and operating results. Despite our efforts to comply with applicable laws, regulations, and other obligations relating to privacy, data protection, and information security, it is possible that our interpretations of the law, practices, or platform could be inconsistent with, or fail or be alleged to fail to meet all requirements of, such laws, regulations, or obligations.

Any significant disruption at our manufacturing facility for any reason, including regulatory requirements, an FDA determination that the facility is not in compliance with the applicable cGMP regulations, the loss of certifications, power interruptions, destruction or damage to the facility or disruptions related to the COVID-19 pandemic or another pandemic, epidemic or infectious disease outbreak, could disrupt our ability to manufacture products for our contract manufacturing customers and any of our own branded products. Any such disruption could have a material adverse effect on our business, financial condition and results of operations.

We depend on third parties to provide services critical to our businesses, including laboratory service providers, raw material and equipment suppliers, ground and air transport of clinical and diagnostic services supplies and specimens, research services (including ancestry report generation), and people, among other services. Third parties that provide services to us are subject to similar risks related to security of customer-related information and compliance with U.S., state, local, or international environmental, health and safety, and privacy and security laws and regulations as we are. Any failure by third parties to comply with applicable laws, or any failure of third parties to provide services more generally, could have a material impact on us, whether because of the loss of the ability to receive services from the third parties, our legal liability for the actions or inactions of third parties, or otherwise.

Because the majority of sales from our PMI manufacturing facility are from cold remedy products, our sales are subject to seasonal fluctuations and influenced by the timing, length and severity of each cold season. Our revenues tend to be higher in the first, third and fourth quarters during the cold season. Generally, a cold season is defined as the period of September to March, when the incidence of the common cold rises as a consequence of the change in weather and other factors.

During years end December 31, 2023 and 2022, the net revenue from diagnostic services was $24.8 million and $108.3 million, respectively, which were 54.9% and 88.3% of our net revenue, respectively. By significantly decreasing our diagnostic services in 2023 and beyond, we will no longer generate the same level of revenues as we did in previous years for this business segment. Unless we are able to increase our revenues from existing or new line of businesses, our overall revenue will be lower than they have been for these historical periods and could adversely impact our business.