Tango Therapeutics (TNGX) Risk Analysis

Our success depends in part on our ability to obtain and maintain patent and regulatory protections for our products candidates, to preserve our trade secrets and other proprietary rights and to prevent third parties from infringing on our rights and our proprietary technology. We have procured patent rights, through both ownership and license, that cover our product candidates, and expect to apply for additional patent protections in the future. However, our patent applications may not result in the issuance of patents in the U.S. or other countries. In addition, a patent may be issued in one country, but a counterpart patent may not be issued in another country, which is not uncommon in the biopharmaceutical industry. Periodic maintenance fees on any issued patent that are due to be paid to the United States Patent and Trademark Office, or USPTO, and foreign countries may require the payment of maintenance fees or patent annuities during the lifetime of a patent application and/or any subsequent patent that issues from the application. The USPTO and various foreign governmental patent agencies require compliance with a number of procedural, documentary, fee payment and other similar provisions during the patent application process and following the issuance of a patent. While an inadvertent lapse can in many cases be cured by payment of a late fee or by other means in accordance with the applicable rules, there are situations in which noncompliance can result in abandonment or lapse of the patent or patent application. Such noncompliance can result in partial or complete loss of patent rights in the relevant jurisdiction. Noncompliance events that could result in abandonment or lapse of a patent or patent application include, but are not limited to, failure to respond to official actions within prescribed time limits, non-payment of fees and failure to properly legalize and submit formal documents. Such an event could have a material adverse effect on our business. Even if a patent is issued, that is not conclusive as to its inventorship, scope, validity or enforceability and therefore that patent may not afford adequate (or any) protection for our product candidates or future approved products or technology. On the basis of such inconclusiveness, third parties may challenge our patents. Furthermore, patents have a limited lifespan. In the United States and most other jurisdictions in which we have undertaken patent filings, the natural expiration of a patent is generally twenty years after it is filed, assuming all maintenance fees are paid. Given the amount of time required for the development, testing and regulatory review of new product candidates, patents protecting such candidates might expire before or shortly after such candidates are commercialized. As a result, patents we may own or in-license may not provide us with adequate and continuing patent protection sufficient to exclude others from commercializing drugs similar or identical to our current or future product candidates, including generic versions of our drugs. Nor can we be certain that we will obtain any patent term extension as permitted under the "Hatch-Waxman Amendments" which permit a patent restoration term of up to five years as compensation for patent term lost during product development and the FDA regulatory review process. If any of our patents are narrowed, invalidated, revoked or become unenforceable, competitors may develop and market products similar or identical to ours that do not conflict with or infringe our patents rights, which could have a material adverse effect on our financial condition. Even if we obtain and maintain patents, our business may be significantly harmed if the patents are not broad enough to protect our products from copycat, generic or similar products. In addition, if there are challenges to our intellectual property by third parties, we may in the future enter into agreements with those parties that provide certain intellectual property rights to our future marketed products or products in our pipeline. If we do enter into such agreements, we may not be the exclusive provider of a therapy and, as a result, we expect that any potential revenue from the sales of such therapies would be materially and negatively impacted. We may in the future be subject to claims by our former employees or consultants asserting an ownership right in our patents or patent applications, as a result of the work they performed on our behalf. Although we generally require all of our employees, consultants and advisors and any other third parties who have access to or were involved in generating our proprietary know-how, information or technology to assign or grant similar rights to the inventions they make in the course of their work to us, we cannot be certain that we have executed such agreements with all parties who may have contributed to our intellectual property, nor can we be certain that our agreements with such parties will be upheld in the face of a potential challenge, or that they will not be breached, for which we may not have an adequate remedy. We have, and expect that we will continue, to finance or collaborate in research and development projects conducted by third parties, including government organizations, hospitals, universities or other educational or research institutions, or other for-profit companies. Such third parties may be unwilling to grant us certain rights to technology or products developed through such projects. Certain collaborators may only grant us a right to obtain a license to technology developed in a collaboration, and we may not be able to negotiate a license or the license may require an upfront or royalty payment on terms that are acceptable to us, or at all. Disputes may also arise as to the rights to technology or products developed in collaboration with such third parties and we may not be able to secure the proprietary rights to any technology generated in such collaboration. Significant legal questions exist concerning the extent and scope of patent protection for biopharmaceutical products and processes in the U.S. and elsewhere. Accordingly, there is no certainty that patent applications owned or licensed by us will issue as patents, or that our issued patents will afford meaningful protection against competitors. Once issued, patents are subject to challenge through both administrative and judicial proceedings in the U.S. and certain other countries. Such proceedings include re-examinations, inter partes reviews, post-grant reviews and interference proceedings before the USPTO, as well as opposition proceedings before the European Patent Office and other non-U.S. patent offices. Certain countries have laws that provide stronger bases for challenging third party patent rights than are available to challenge patents in other countries. Therefore, we may be able to defend our patents against a third-party claim in one country but counterpart patents may be invalidated in other countries and we may be able to invalidate a third-party patent in one country but not invalidate its counterpart patents in other countries. Further, in jurisdictions outside the United States, a license may not be enforceable unless all the owners of the intellectual property agree or consent to the license. Accordingly, any actual or purported co-owner of our patent rights could seek monetary or equitable relief requiring us to pay it compensation for, or refrain from, exploiting these patents due to such co-ownership. Litigation may be required to enforce, defend or obtain our patent and other intellectual property rights. Any administrative proceeding or litigation could require a significant commitment of our resources and, depending on outcome, could adversely affect the scope, validity or enforceability of certain of our patent or other proprietary rights. Other parties have developed technologies that may be related or competitive to our own, and such parties may have filed or may file patent applications, or may have received or may receive patents, claiming inventions that may overlap or conflict with those claimed in our own patent applications or issued patents, with respect to either the same compounds, methods, formulations or other subject matter, in either case that we may rely upon to dominate our patent position in the market. Publications of discoveries in the scientific literature often lag behind the actual discoveries, and patent applications in the United States and other jurisdictions are typically not published until at least 18 months after the earliest priority date of patent filing, or, in some cases, not at all. Therefore, we cannot know with certainty whether we were the first to make the inventions claimed in patents we may own or in-license patents or pending patent applications, or that we were the first to file for patent protection of such inventions. As a result, the issuance, scope, validity, enforceability and commercial value of our patent rights cannot be predicted with any certainty. Some of the sensitive technology, techniques and proprietary compounds used in our business are protected as trade secrets. Among other things, we enter into confidentiality agreements and license agreements to protect proprietary know-how that may not be patentable, processes for which patents are difficult to enforce and any other elements of our product discovery and development processes that involve proprietary know-how, information, or technology that may not be covered by patents (or for which we determine we will not seek patent protection). Although we seek to require all of our employees, consultants, advisors, and any third parties who have access to our proprietary know-how, information, or technology to enter into confidentiality agreements, trade secrets can be difficult to protect and we have limited control over the protection of trade secrets used by our collaborators and suppliers. We cannot be certain that we have or will obtain these agreements in all circumstances and we cannot guarantee that we have entered into such agreements with each party that may have or have had access to our trade secrets or proprietary information (or that the terms of such agreements are enforceable). In our business, we rely on collaboration with, or discuss the potential for collaboration with, suppliers, outside scientists, research organizations and other biopharmaceutical companies. Collaboration and discussion of potential collaboration or inadvertent disclosure of a trade secret present a strong risk of exposing our trade secrets. If our trade secrets were exposed, we may lose the protection and potential exclusive rights afforded by trade secret law, and such exposure may likely help our competitors and allow them to access technology without restriction and adversely affect our business prospects. In addition, the patent prosecution process is expensive and time-consuming, and we may not be able to file and prosecute all necessary or desirable patent applications at a reasonable cost or in a timely manner. In some instances, a delay in filing patent applications could adversely impact patentability, for example if certain information is disclosed prior to the filing of a patent application. Under certain circumstances, use of the compounds in clinical trials could be interpreted as a public use and negatively impact our ability to obtain patent protection for certain inventions. Due to expense of patent filings, we also may not file in every jurisdiction in which patents may be issued (and, therefore, we may not be able to assert patents rights in every country in the future). Further, with respect to certain pending patent applications covering our current or future product candidates, prosecution has yet to commence. Patent prosecution is a lengthy process, during which the scope of the claims initially submitted for examination by the relevant patent office(s) may be significantly narrowed by the time they issue, if they ever do. It is also possible that we will fail to identify patentable aspects of our research and development output before it is too late to obtain patent protection. Moreover, in some circumstances, we may not have the right to control the preparation, filing and prosecution of patent applications, or to maintain the patents, covering technology that we license or access from or to third parties. Therefore, these patents and applications may not be prosecuted and enforced in a manner consistent with the best interests of our business. Similarly, trademarks and trade names we utilize in our business may be challenged, infringed, diluted or declared generic or determined to be infringing on other marks. These marks can be important for name recognition in markets. If we are unable to secure and protect our trademarks and trade names, our business could be harmed.

We rely on information technology systems that we or our third-party providers operate to process, transmit and store electronic health information in our day-to-day operations. In connection with our clinical trials, we (and our third party processors assisting with the clinical trials) may have access to or store clinical and health information of the patients participating in the trials and such information may be accessed as result of a cyberattack, cyber intrusion or otherwise. A security breach, incident or compromise, whether through a successful cyberattack, cyber intrusion or otherwise, could result in the theft or destruction of intellectual property, data, or other misappropriation of assets, or otherwise compromise our confidential or proprietary information and disrupt our operations. Cyberattacks are increasing in their frequency, sophistication and intensity, and have become increasingly difficult to detect. Cyberattacks could include wrongful conduct by hostile foreign governments, industrial espionage, wire fraud and other forms of cyber fraud, the deployment of harmful malware, computer viruses, denial-of-service, social engineering tactics or other means to threaten the security, confidentiality, integrity and availability of our information technology systems and data. A security breach, incident or compromise, whether through a successful cyberattack or otherwise, could cause serious negative consequences for us, including, without limitation, the disruption of operations, the misappropriation of confidential business information, including the compounds we are developing, our screening platform technology, financial information, trade secrets, financial loss and the disclosure of corporate strategic plans. Although we have implemented various measures designed to protect our information technology systems, there can be no assurance that our efforts will prevent security breaches, incidents or other compromises that would result in business, legal, financial or reputational harm to us, or would have a material adverse effect on our results of operations and financial condition. Any failure to prevent or mitigate security breaches, incidents or compromises could lead to improper access to, use of, or disclosure of our proprietary or confidential information (including clinical data or patients' personal data) and could result in significant liability under various data protection laws, including state (e.g., state breach notification laws), federal (e.g., HIPAA, as amended by HITECH), and international laws (e.g., the GDPR) and may cause a material adverse impact to our reputation, affect our ability to continue existing clinical trials and conduct new clinical trials and potentially disrupt our business. We rely on our third-party providers to implement effective security measures and identify and correct for any such failures, deficiencies or breaches of our systems. If we or our third-party providers fail to maintain or protect our information technology systems and data integrity effectively or fail to anticipate, plan for or manage significant disruptions to our information technology systems, we or our third-party providers could have difficulty preventing, detecting and controlling cyber-attacks and any such attacks could result in the losses described above as well as disputes with physicians, patients and our partners and collaborators, regulatory sanctions or penalties, increases in operating and other expenses or lost revenue or other adverse consequences, any of which could have a material adverse effect on our business, results of operations, financial condition, prospects and cash flows. Any failure by such third parties to prevent or mitigate security breaches, incidents or compromises, or any improper access to or disclosure of proprietary or confidential information, could have adverse consequences for our business and our reputation. If we are unable to prevent or mitigate the impact of such security breaches, incidents, or other compromises, we could be exposed to litigation and governmental investigations and related fines and penalties. Several U.S. states have enacted comprehensive privacy laws. In California, the California Consumer Privacy Act, or CCPA (and its amendments), requires covered businesses to comply with specific privacy and security obligations regarding their handling of personal information of California residents, such as providing the ability to opt-out of certain sales or transfers of their personal information to third parties. The CCPA provides for civil penalties for violations, as well as a private right of action for certain types of data breaches. Various other U.S. states have passed privacy laws that are similar to the CCPA, but contain several key differences in their scope, application and enforcement. Such laws add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in our business practices and policies. There are also states that are specifically regulating health information. For example, in 2023, Washington State's My Health My Data Act, which entered into force on March 31, 2024, expands the definition of consumer health data, affords consumers with privacy rights and creates a private right of action, which could increase the risk of litigation. These various privacy and security laws may impact our business activities, including our identification of patients who meet the inclusion criteria for our clinical trials, relationships with business partners and ultimately the marketing and distribution of our products (if approved by regulatory authorities). As we expand our operations, these and similar laws may increase our compliance costs and potential liability. If we, third-party CMOs, CROs or other contractors or consultants fail to comply with U.S. and international data protection laws and regulations, we could face government enforcement actions (which could include civil or criminal penalties) or private litigation, which would require additional investment of resources, limit our ability to use personal data, and result in adverse publicity which could negatively affect our operating results and business. Claims that we or our third-party service providers have violated individuals' privacy rights, failed to comply with data protection laws, or breached our contractual obligations, even if we are not found liable, could result in adverse publicity that could harm our business, increase our costs and negatively affect our reputation. Additionally in the EU, the NIS 2 Directive, or NIS 2, is replacing the cybersecurity legal framework under the current NIS framework, aiming to ensure a high level of cybersecurity in the region. NIS 2 brings new medium and large organizations providing services in the EU within scope of the legal framework. It extends to additional sectors and expands the list of in-scope healthcare organizations, including to certain providers engaged in research and development of medicinal products. The new regime imposes direct obligations on management in respect of an in-scope organization's compliance with NIS 2, requires covered organizations to put in place certain cyber risk management measures, strengthens incident reporting requirements and provides supervisory authorities with greater oversight. The majority of obligations will come into force when national legislation implementing NIS 2 becomes effective in the relevant EU Member State. EU Member States had until 17 October 2024 to transpose NIS 2 into national legislation, although many countries have still not completed the transposition. As such, the cybersecurity regulatory landscape in the EU is currently fragmented and uncertain. To the extent we are subject to NIS 2, we will require additional investment of our resources in compliance programs and will potentially come under greater regulatory scrutiny. Under NIS 2 companies may be subject to administrative fines of up to the higher amount of €10 million or 2% of worldwide turnover.