GeneDx Holdings (WGS) Risk Factors

The sale and use of our solutions, products and services could lead to product or professional liability claims, including class action lawsuits. We may also be subject to liability for errors in the test results including health information it provides to healthcare providers or patients or for a misunderstanding of, or inappropriate reliance upon, the information it provides. Claims could also arise out of clinical studies we may conduct or any of our other activities. A product or professional liability claim could result in substantial damages, be costly and time consuming to defend, and cause material harm to our business, reputation or financial condition. We cannot assure you that our liability insurance would protect our assets from the financial impact of defending a product or professional liability claim. Any claim brought against us, with or without merit, could increase our liability insurance rates or prevent it from securing insurance coverage in the future.

As our business grows, we are required to comply with increasingly complex taxation rules and practices. We are subject to tax in multiple U.S. tax jurisdictions and may be subject to foreign tax jurisdictions in the future. The development of our tax strategies requires additional expertise and may impact how we conduct our business. Our future effective tax rates could be unfavorably affected by changes in, or interpretations of, tax rules and regulations in the jurisdictions in which we do business or by changes in the valuation of our deferred tax assets and liabilities. Furthermore, we provide for certain tax liabilities that involve significant judgment. We are and may be subject to the examination of our tax returns by federal, state and foreign tax authorities. If our tax strategies are ineffective or it is not in compliance with domestic and international tax laws, as applicable, our financial position, operating results and cash flows could be adversely affected.

In the ordinary course of our business, our collection and storing of PHI also includes more sensitive data, such as genetic information, as well as personally identifiable information, genetic information, credit card information, financial information, intellectual property and proprietary business information owned or controlled by us or our customers, payors and other parties. We manage and maintain our applications and data utilizing a combination of on-site systems, managed data center systems and cloud-based systems. We also communicate PHI and other sensitive patient data through our various customer tools and platforms, and in physical form. In addition to storing and transmitting sensitive data that is subject to multiple legal protections, these applications and data encompass a wide variety of business-critical information including research and development information, commercial information, and business and financial information. We continue to face a number of risks relative to protecting this critical information, including loss of access risk, inappropriate disclosure, inappropriate modification, and the risk of our being unable to adequately monitor and modify our controls over our critical information. Any technical problems that may arise in connection with the data that we access and our systems, including those that are hosted by third-party providers, could result in interruptions to our business and operations or exposure to security vulnerabilities. These types of problems may be caused by a variety of factors, including infrastructure changes, intentional or accidental human actions or omissions, software errors, malware, viruses, security attacks, fraud, spikes in customer usage and denial of service issues. From time to time, large third-party web hosting providers have experienced outages or other problems that have resulted in their systems being offline and inaccessible. Such outages could materially impact our business and operations. Although we take what we believe to be reasonable and appropriate measures, including a formal, dedicated enterprise security program, to protect sensitive information from various compromises (including unauthorized access, disclosure, or modification or lack of availability), our information technology and infrastructure may be vulnerable to attacks by hackers or viruses or breached due to employee error, malfeasance, lost or stolen technology, or other disruptions. Any such breach or interruption could compromise our networks and the information stored therein could be accessed by unauthorized parties, altered, publicly disclosed, lost or stolen. Further, some of our customer tools and platforms are currently accessible through a portal and there is no guarantee that we can protect our portal from a security breach. Unauthorized access, loss or dissemination could also disrupt our operations (including our ability to conduct our analyses, provide test results, bill payors or patients, process claims and appeals, provide customer assistance, conduct research and development activities, collect, process and prepare company financial information, provide information about our tests and other patient and physician education and outreach efforts through our website, and manage the administrative aspects of our business) and damage our reputation, any of which could adversely affect our business. In addition to data security risks, we also face privacy risks. For example, as noted above, pursuant to guidance recently issued by OCR, HIPAA covered entities and business associates who permit tracking technology vendors to collect PHI from their patients must enter into a HIPAA compliant business associate agreement with that vendor or obtain advance consent. We have utilized, and may continue to utilize, tracking technologies on one or more of our websites, and may not be able to do so in a manner that is consistent with what HIPAA requires. Should we actually violate, or be perceived to have violated, any privacy promises our business makes to patients or consumers, we could be subject to a complaint from an affected individual or interested privacy regulator, such as OCR, the FTC, a state Attorney General, an EU Member State Data Protection Authority, or a data protection authority in another international jurisdiction. This risk is heightened given the sensitivity of the data we collect. Any security compromise that causes an apparent privacy violation could also result in legal claims or proceedings; liability under federal, state, foreign, or multinational laws that regulate the privacy, security, or breach of personal information, such as but not limited to the HIPAA, HITECH, state data security and data breach notification laws, the EU's GDPR, the UK Data Protection Act of 2018; and related regulatory penalties. Penalties for failure to comply with a requirement of HIPAA or HITECH vary significantly, and, depending on the knowledge and culpability of the HIPAA-regulated entity, may include civil monetary penalties of up to $1.5 million per calendar year for each provision of HIPAA that is violated. A person who knowingly obtains or discloses individually identifiable health information in violation of HIPAA may face a criminal penalty of up to $50,000 and up to one-year imprisonment. The criminal penalties increase if the wrongful conduct involves false pretenses or the intent to sell, transfer or use identifiable health information for commercial advantage, personal gain or malicious harm. Penalties for unfair or deceptive acts or practices under the FTC Act or state UDAP, statutes may also vary significantly. There has been unprecedented activity in the development of data protection regulation around the world. As a result, the interpretation and application of consumer, health-related and data protection laws in the U.S., Europe and elsewhere are often uncertain, contradictory and in flux. The GDPR applies to any entity established in the EU as well as extraterritorially to any entity outside the EU that offers goods or services to, or monitors the behavior of, individuals who are located in the EU. The GDPR imposes strict requirements on controllers and processors of personal data, including enhanced protections for "special categories" of personal data, which includes sensitive information such as health and genetic information of data subjects. The GDPR also grants individuals various rights in relation to their personal data, including the rights of access, rectification, objection to certain processing and deletion. The GDPR provides an individual with an express right to seek legal remedies if the individual believes his or her rights have been violated. Failure to comply with the requirements of the GDPR or the related national data protection laws of the member states of the EU, which may deviate from or be more restrictive than the GDPR, may result in significant administrative fines issued by EU regulators. Maximum penalties for violations of the GDPR are capped at 20 million euros or 4% of an organization's annual global revenue, whichever is greater. Additionally, the implementation of GDPR has led other jurisdictions to either amend or propose legislation to amend their existing data privacy and cybersecurity laws to resemble the requirements of GDPR. For example, on June 28, 2018, California adopted the CCPA. The CCPA regulates how certain for-profit businesses that meet one or more CCPA applicability thresholds collect, use, and disclose the personal information of consumers who reside in California. Among other things, the CCPA confers to California consumers the right to receive notice of the categories of personal information that will be collected by a business, how the business will use and share the personal information, and the third parties who will receive the personal information; the CCPA also confers rights to access, delete, or transfer personal information; and the right to receive equal service and pricing from a business after exercising a consumer right granted by the CCPA. In addition, the CCPA allows California consumers the right to opt out of the "sale" of their personal information, which the CCPA defines broadly as any disclosure of personal information to a third party in exchange for monetary or other valuable consideration. The CCPA also requires a business to implement reasonable security procedures to safeguard personal information against unauthorized access, use, or disclosure. California amended the law in September 2018 to exempt all PHI collected by certain parties subject to HIPAA, and further amended the law in September 2020 to clarify that de-identified data as defined under HIPAA will also be exempt from the CCPA. The California Attorney General's final regulations implementing the CCPA took effect on August 14, 2020. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches resulting from a business's failure to implement and maintain reasonable data security procedures that is expected to increase data breach litigation. In addition, California voters recently approved the California Privacy Rights Act of 2020 ("CPRA,") that went into effect on January 1, 2023. The CPRA among other things, amends the CCPA to give California residents the ability to limit the use of their sensitive information provides for penalties for CPRA violations concerning California residents under the age of 16, and establishes a new California Privacy Protection Agency to implement and enforce the law. Other jurisdictions in the U.S. are beginning to propose and enact laws similar to the CCPA. Some observers have noted that the CCPA could mark the beginning of a trend toward more stringent privacy legislation, which could increase our potential liability and adversely affect our business, results of operations, and financial condition. It is possible the GDPR, CCPA and other emerging U.S. and international data protection laws may be interpreted and applied in manner that is inconsistent with our practices. If so, this could result in government-imposed fines or orders requiring that we change our practices, which could adversely affect our business. In addition, these privacy laws and regulations may differ from country to country and state to state, and our obligations under these laws and regulations vary based on the nature of our activities in the particular jurisdiction, such as whether we collect samples from individuals in the local jurisdiction, perform testing in the local jurisdiction, or process personal information regarding employees or other individuals in the local jurisdiction. In the U.S., the SEC has adopted rules for mandatory disclosure of cybersecurity incidents suffered by public companies, as well as cybersecurity governance and risk management. Complying with these various laws and regulations could cause us to incur substantial costs or require it to change our business practices and compliance procedures in a manner adverse to our business. Any failure or perceived failure by us to comply with these laws may also subject us to enforcement action or litigation, any of which could harm our business. We can provide no assurance that it is or will remain in compliance with diverse privacy and data security requirements in all of the jurisdictions in which we do business. Failure to comply with privacy and data security requirements could result in a variety of consequences, or damage to our reputation, any of which could have a material adverse effect on our business.

Our business environment is rapidly evolving and intensely competitive. Our businesses face changing technologies, shifting provider and patient needs, and frequent introductions of rival products and services. To compete successfully, we must accurately anticipate technology developments and deliver innovative, relevant and useful products, services, and technologies in a timely manner. As our businesses evolve, the competitive pressure to innovate will encompass a wider range of products and services. We must continue to invest significant resources in research and development, including through acquisitions and collaborations, joint ventures and partnerships, in order to enhance our current diagnostics and health information and data science technologies, and existing and new products and services based off these technologies. We have many competitors in different industries. Our current and potential domestic and international competitors range from large and established companies to emerging start-ups in addition to academic and scientific institutions, and public and private research organizations. Some competitors have longer operating histories than our Company in various sectors. They can use their experience and resources in ways that could affect our competitive position, including by making acquisitions, continuing to invest heavily in research and development and in talent, initiating intellectual property claims (whether or not meritorious), and continuing to compete aggressively for our customers and partners in the market for genetic testing and screening, health information and data science products and services. Our competitors may be able to innovate and provide products and services faster than we can or may foresee the need for products and services before we do. Our operating results may also suffer if our products and services are not responsive to the needs of our customers and partners. As technologies continue to develop, our competitors may be able to offer products and services that are, or that are seen to be, substantially similar to or better than our current products and services. This may force us to compete in different ways and expend significant resources in order to remain competitive. If our competitors are more successful than us in developing compelling products and services for or in attracting and retaining customers or partners in the market for genetic testing and screening, health information and data science products and services, our operating results could be harmed.

When cleared, authorized or approved, we and our collaborators may market, sell, and distribute our products and services outside of the U.S., and our business would be subject to risks associated with doing business outside of the U.S., including an increase in our expenses and diversion of our management's attention from the development of future products and services. Accordingly, our business and financial results in the future could be adversely affected due to a variety of factors, including: - multiple, conflicting and changing laws and regulations such as privacy, security and data use regulations, tax laws, export and import restrictions, economic sanctions and embargoes, employment laws, anticorruption laws, regulatory requirements, reimbursement or payor regimes and other governmental approvals, permits and licenses;- failure by us, our collaborators or our distributors to obtain regulatory clearance, authorization or approval for the use of our products and services in various countries;- additional potentially relevant third-party patent rights;- complexities and difficulties in obtaining intellectual property protection and enforcing our intellectual property;- difficulties in staffing and managing foreign operations, including repatriating foreign earned profits;- complexities associated with managing multiple payor reimbursement regimes, government payors or patient self-pay systems;- difficulties in negotiating favorable reimbursement negotiations with governmental authorities;- logistics and regulations associated with shipping samples, including infrastructure conditions and transportation delays;- limits in our ability to penetrate international markets if we are not able to conduct our clinical diagnostic services locally;- financial risks, such as longer payment cycles, difficulty collecting accounts receivable, the impact of local and regional financial crises on demand and payment for our products and services and exposure to foreign currency exchange rate fluctuations;- international regulations and license requirements that may restrict foreign investment in and operation of the internet, IT infrastructure, data centers and other sectors, and international transfers of data;- natural disasters, political and economic instability, including wars, terrorism and political unrest, and outbreak of disease;- boycotts, curtailment of trade and other business restrictions; and - regulatory and compliance risks that relate to maintaining accurate information and control over sales and distributors' activities that may fall within the purview of the Foreign Corrupt Practices Act of 1977 (the "FCPA"), its books and records provisions, or its anti-bribery provisions, Canada's Corruption of Foreign Public Officials Act, or laws similar to the FCPA in other jurisdictions in which we may in the future operate, such as the United Kingdom's Bribery Act of 2010 and anti-bribery requirements of member states in the European Union (the "EU"). Any of these factors could significantly harm our future international expansion and operations and, consequently, our revenue and results of operations.