Tyra Bioscience (TYRA) Risk Analysis

We, our future collaborators and our service providers may be subject to a variety of privacy and data security laws and contractual obligations, which could increase compliance costs and our failure to comply with them could subject us to potentially significant fines or penalties and otherwise harm our business. We are subject to laws and regulations governing the privacy and security of sensitive information, including confidential business and health-related information. The global data protection landscape is rapidly evolving, and we may be affected by or subject to new, amended or existing laws and regulations in the future, including as our operations continue to expand or if we operate in foreign jurisdictions. These laws and regulations may be subject to differing interpretations, which adds to the complexity of processing personal information. Guidance on implementation and compliance practices are often updated or otherwise revised. In the United States, there are numerous federal and state privacy and data security laws and regulations governing the collection, use, disclosure and protection of personal information, including health information privacy laws, security breach notification laws and consumer protection laws. Each of these laws is subject to varying interpretations and constantly evolving. By way of example, HIPAA imposes privacy and security requirements and breach reporting obligations with respect to individually identifiable health information upon "covered entities" (health plans, health care clearinghouses and certain health care providers), and their respective business associates, individuals or entities that create, received, maintain or transmit protected health information in connection with providing a service for or on behalf of a covered entity, as well as their covered subcontractors. While we do not believe that we are currently acting as a covered entity or business associate under HIPAA and thus are not directly regulated under HIPAA, any person may be prosecuted under HIPAA's criminal provisions either directly or under aiding-and-abetting or conspiracy principles. Consequently, depending on the facts and circumstances, we could be subject to significant penalties if we knowingly receive individually identifiable health information from a HIPAA-covered healthcare provider or research institution that has not satisfied HIPAA's requirements for disclosure of individually identifiable health information. In addition, certain state laws and regulations govern the privacy, processing and security of health-related and other personal information in certain circumstances, some of which are more stringent than HIPAA and many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. By way of example, the California Consumer Privacy Act (CCPA) which went into effect on January 1, 2020, gives California residents certain rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that has increased the likelihood of, and risks associated with data breach litigation. The CCPA may increase our compliance costs and potential liability. Further, the California Privacy Rights Act (CPRA) generally went into effect on January 1, 2023 and significantly amends the CCPA. It imposes further obligations on businesses processing the personal information of California residents, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It also created a new California data protection agency authorized to issue substantive regulations, which could result in increased privacy and information security enforcement. Additional compliance investment and potential business process changes may be required. Similar laws have passed in other states and are continuing to be proposed at the state and federal level, reflecting a trend toward more stringent privacy legislation in the United States. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging. In the event that we are subject to or affected by HIPAA, the CCPA, the CPRA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition. Our operations abroad may also be subject to increased scrutiny or attention from data protection authorities. For example, in Europe, the European Union General Data Protection Regulation, (GDPR) went into effect in May 2018 and imposes strict requirements for processing the personal data of individuals within the European Economic Area (EEA). Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance of up to €20 million or 4% of the annual global revenues of the noncompliant company, whichever is greater. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the EEA, and the United States remains uncertain. Case law from the Court of Justice of the European Union (CJEU) states that reliance on the standard contractual clauses - a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism alone may not necessarily be sufficient in all circumstances and that transfers must be assessed on a case-by-case basis. On July 10, 2023, the European Commission adopted its Adequacy Decision in relation to the new EU-US Data Privacy Framework (DPF), rendering the DPF effective as a GDPR transfer mechanism to U.S. entities self-certified under the DPF. We expect the existing legal complexity and uncertainty regarding international personal data transfers to continue. In particular, we expect the DPF Adequacy Decision to be challenged and international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As a result, we may have to make certain operational changes and we will have to implement revised standard contractual clauses and other relevant documentation for existing data transfers within required time frames. As supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the SCCs cannot be used, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results. Further, from January 1, 2021, companies have had to comply with the GDPR and also the UK GDPR, which, together with the amended UK Data Protection Act 2018, retains the GDPR in UK national law. The UK GDPR mirrors the fines under the GDPR, i.e., fines up to the greater of €20 million (£17.5 million) or 4% of global turnover. On October 12, 2023, the UK Extension to the DPF came into effect (as approved by the UK Government), as a data transfer mechanism from the UK to U.S. entities self-certified under the DPF. As we continue to expand into other foreign countries and jurisdictions, we may be subject to additional laws and regulations that may affect how we conduct business. Although we work to comply with applicable laws, regulations and standards, our contractual obligations and other legal obligations, these requirements are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another or other legal obligations with which we must comply. Any failure or perceived failure by us or our employees, representatives, contractors, consultants, collaborators, or other third parties to comply with such requirements or adequately address privacy and security concerns, even if unfounded, could result in additional cost and liability to us, damage our reputation, and adversely affect our business and results of operations.

The biotechnology and biopharmaceutical industries are characterized by rapidly advancing technologies, intense competition and a strong emphasis on proprietary and novel products and product candidates. Our competitors have developed, are developing or may develop products or product candidates competitive with our product candidates. Any product candidates that we successfully develop and commercialize will compete with existing therapies and new therapies that may become available in the future. We believe that a significant number of products are currently under development, and may become commercially available in the future, for the treatment of conditions for which we may attempt to develop product candidates. In particular, there is intense competition in the precision oncology field. Our competitors include larger and better-funded pharmaceutical, biopharmaceutical, biotechnological and therapeutics companies. Moreover, we may also compete with universities and other research institutions who may be active in the indications we are targeting and could be in direct competition with us. We also compete with these organizations to recruit management, scientists and clinical development personnel, which could negatively affect our level of expertise and our ability to execute our business plan. We will also face competition in establishing clinical trial sites, enrolling patients for clinical trials and in identifying and in-licensing new product candidates. Smaller or early stage companies may also prove to be significant competitors, particularly through collaborative arrangements with large and established companies. We expect to face competition from existing products and products in development for each of our product candidates. There are four currently approved pan-FGFR inhibitors: Incyte Corporation's Pemazyre (pemigatinib), Taiho's Lytgobi (futibatinib) and QED Therapeutics' Truseltiq (infigratinib), approved in FGFR2 gene rearrangements in cholangiocarcinoma, and Janssen Biotech, Inc.'s Balversa (erdafitinib), approved in specific FGFR3 gene alterations. There are a number of other isoform-specific FGFR inhibitors such as Relay Therapeutics, Inc.'s lirafugatinib (RLY-4008), Kinnate Biopharma Inc.'s KIN-3248, TransThera's tinengotinib and Lilly's Loxo Oncology's isoform-selective FGFR3 inhibitor compound, LOXO-435 (LOX-24350). BioMarin Pharmaceutical's Voxzogo, a once daily injectable C-natriuretic peptide (CNP)analog is approved in the United States for children with achondroplasia. There are a number of other experimental therapies in development for achondroplasia, including Ascendis' CNP pro-drug (TransCon CNP), QED Therapeutics' low dose pan-FGFR inhibitor (infigratinib) and Sanofi's anti-FGFR3 antibody (SAR-442501). There are currently no approved FGFR4 inhibitors, but there remain a number of FGFR4 programs in clinical development in China, including Abbisko's ABSK011. Many of our competitors have significantly greater financial, technical, manufacturing, marketing, sales and supply resources or experience than we do. If we successfully obtain marketing approval for any product candidate, we will face competition based on many different factors, including the safety and effectiveness of our products, the ease with which our products can be administered and the extent to which patients accept relatively new routes of administration, the timing and scope of marketing approvals for these products, the availability and cost of manufacturing, marketing and sales capabilities, price, reimbursement coverage and patent position. Competing products could present superior treatment alternatives, including by being more effective, safer, more convenient, less expensive or marketed and sold more effectively than any products we may develop. Competitive products or technological approaches may make any products we develop obsolete or noncompetitive before we recover the expense of developing and commercializing our product candidates. If we are unable to compete effectively, our opportunity to generate revenue from the sale of our products we may develop, if approved, could be adversely affected.

We have no internal sales, marketing or distribution capabilities, nor have we commercialized a product. If any of our product candidates ultimately receives marketing approval, we must build a marketing and sales organization with technical expertise and supporting distribution capabilities to commercialize each such product in major markets, which will be expensive and time consuming, or collaborate with third parties that have direct sales forces and established distribution systems, either to augment our own sales force and distribution systems or in lieu of our own sales force and distribution systems. We have no prior experience as a company in the marketing, sale and distribution of biopharmaceutical products and there are significant risks involved in building and managing a sales organization, including our ability to hire, retain and incentivize qualified individuals, generate sufficient sales leads, provide adequate training to sales and marketing personnel and effectively manage a geographically dispersed sales and marketing team. Any failure or delay in the development of our internal sales, marketing and distribution capabilities would adversely impact the commercialization of these products. We may not be able to enter into collaborations or hire consultants or external service providers to assist us in sales, marketing and distribution functions on acceptable financial terms, or at all. In addition, our product revenues and our profitability, if any, may be lower if we rely on third parties for these functions than if we were to market, sell and distribute any products that we develop ourselves. We likely will have little control over such third parties, and any of them may fail to devote the necessary resources and attention to sell and market our products effectively. If we are not successful in commercializing our products, either on our own or through arrangements with one or more third parties, we may not be able to generate any future product revenue and we would incur significant additional losses.

From time to time, the global credit and financial markets have experienced extreme volatility and disruptions, including severely diminished liquidity and credit availability, declines in consumer confidence, declines in economic growth, increases in unemployment rates and uncertainty about economic stability. The financial markets and the global economy may also be adversely affected by the current or anticipated impact of military conflict, including the wars between Russia and Ukraine and Israel and Hamas, terrorism or other geopolitical events. Sanctions imposed by the United States and other countries in response to such conflicts may also adversely impact the financial markets and the global economy, and any economic countermeasures by affected countries and others could exacerbate market and economic instability. In addition, in 2023 the closures of financial institutions and their placement into receivership with the FDIC created bank-specific and broader financial institution liquidity risk and concerns. Future adverse developments with respect to specific financial institutions or the broader financial services industry may lead to market-wide liquidity shortages, impair the ability of companies to access near-term working capital needs, and create additional market and economic uncertainty. There can be no assurance that future credit and financial market instability and a deterioration in confidence in economic conditions will not occur. Our general business strategy may be adversely affected by any such economic downturn, liquidity shortages, volatile business environment or continued unpredictable and unstable market conditions. If the equity and credit markets deteriorate, or if adverse developments are experienced by financial institutions, it may cause short-term liquidity risk and also make any necessary debt or equity financing more difficult, more costly, more onerous with respect to financial and operating covenants and more dilutive. Failure to secure any necessary financing in a timely manner and on favorable terms could have a material adverse effect on our growth strategy, financial performance and stock price and could require us to delay or abandon clinical development plans. In addition, there is a risk that one or more of our current service providers, financial institutions, manufacturers and other partners may be adversely affected by the foregoing risks, which could directly affect our ability to attain our operating goals on schedule and on budget.

Our future growth may depend, in part, on our ability to develop and commercialize our product candidates in foreign markets. We are not permitted to market or promote any of our product candidates before we receive marketing approval from applicable regulatory authorities in foreign markets, and we may never receive such marketing approvals for any of our product candidates. To obtain separate marketing approval in many other countries we must comply with numerous and varying regulatory requirements regarding safety and efficacy and governing, among other things, clinical trials, commercial sales, pricing and distribution of our product candidates. If we obtain marketing approval of our product candidates and ultimately commercialize our products in foreign markets, we would be subject to additional risks and uncertainties, including: - different regulatory requirements for approval of drugs in foreign countries;- reduced protection for intellectual property rights;- the existence of additional third-party patent rights of potential relevance to our business;- unexpected changes in tariffs, trade barriers and regulatory requirements;- economic weakness, including inflation, political instability or war in particular foreign economies and markets;- compliance with tax, employment, immigration and labor laws for employees living or traveling abroad;- foreign currency fluctuations, which could result in increased operating expenses and reduced revenues, and other obligations incident to doing business in another country;- foreign reimbursement, pricing and insurance regimes;- workforce uncertainty in countries where labor unrest is common;- production shortages resulting from any events affecting raw material supply or manufacturing capabilities abroad; and - business interruptions resulting from geopolitical actions, including war and terrorism, or natural disasters including earthquakes, typhoons, floods and fires.