XWELL (XWEL) Risk Factors

Our XpresCheck operations are subject to extensive federal, state, local and foreign laws and regulations, all of which are subject to change. These laws and regulations currently include, among other things: - CLIA, which requires that laboratories obtain certification from the federal government, and state licensure laws;- FDA laws and regulations;- HIPAA, which imposes comprehensive federal standards with respect to the privacy and security of protected health information and requirements for the use of certain standardized electronic transactions, and amendments to HIPAA under the HITECH, which strengthen and expand HIPAA privacy and security compliance requirements, increase penalties for violators, extend enforcement authority to state attorneys general and impose requirements for breach notification;- state laws regulating genetic testing and protecting the privacy of genetic test results, as well as state laws protecting the privacy and security of health information and personal data and mandating reporting of breaches to affected individuals and state regulators;- the federal anti-kickback law, or the Anti-Kickback Statute, which prohibits knowingly and willfully offering, paying, soliciting, receiving, or providing remuneration, directly or indirectly, in exchange for or to induce either the referral of an individual, or the furnishing, arranging for, or recommending of an item or service that is reimbursable, in whole or in part, by a federal healthcare program;- other federal and state fraud and abuse laws, such as anti-kickback laws, prohibitions on self-referral, and false claims acts, which may extend to services reimbursable by any third-party payor, including private insurers;- the federal Physician Payments Sunshine Act, which requires medical device manufactures to track and report to the federal government certain payments and other transfers of value made to physicians and teaching hospitals and ownership or investment interests held by physicians and their immediate family members;- Section 216 of the federal Protecting Access to Medicare Act of 2014, which requires applicable laboratories to report private payor data in a timely and accurate manner beginning in 2017 and every three years thereafter (and in some cases annually);- state laws that impose reporting and other compliance-related requirements;- state billing laws, including regulations on "pass through billing" which may limit our ability to submit claims for payment and/or mark up the cost of services in excess of the price paid for such services, and "direct-bill" laws which may limit our ability to purchase services from a laboratory and bill for the services ordered; and- similar foreign laws and regulations that apply to us in the countries in which we operate. These laws and regulations are complex and are subject to interpretation by the courts and by government agencies. Our failure to comply could lead to civil or criminal penalties, exclusion from participation in state and federal healthcare programs, or prohibitions or restrictions on our laboratory's ability to provide or receive payment for our services. We believe that we are in material compliance with all statutory and regulatory requirements, but there is a risk that one or more government agencies could take a contrary position, or that a private party could file suit under the qui tam provisions of the federal False Claims Act or a similar state law. Such occurrences, regardless of their outcome, could damage our reputation and adversely affect important business relationships with third parties, including managed care organizations, and other private third-party payors.

The FDA has regulatory responsibility for instruments, test kits, reagents and other devices used by clinical laboratories. The FDA enforces laws and regulations that govern the development, testing, manufacturing, performance, labeling, advertising, marketing, distribution and surveillance of diagnostic products, and it regularly inspects and reviews the manufacturing processes and product performance of diagnostic products. FDA regulation of the diagnostic products we use could result in increased costs and administrative and legal actions for noncompliance, including warning letters, fines, penalties, product suspensions, product recalls, injunctions and other civil and criminal sanctions, which could have a material adverse effect on our business, financial condition, results of operation and cash flows.

The performance of laboratory testing is subject to extensive U.S. regulation, and many of these statutes and regulations have not been interpreted by the courts. CLIA extends federal oversight to virtually all physician practices performing clinical laboratory testing and to clinical laboratories operating in the U.S. by requiring that they be certified by the federal government or, in the case of clinical laboratories, by a federally approved accreditation agency. The sanction for failure to comply with CLIA requirements may be suspension, revocation or limitation of a laboratory's CLIA certificate, which is necessary to conduct business, as well as significant fines and/or criminal penalties. In addition, we expect to be subject to regulation under state law. State laws may require that laboratories and/or laboratory personnel meet certain licensing or other qualifications, specify certain quality controls or require maintenance of certain records. Applicable statutes and regulations could be interpreted or applied by a prosecutorial, regulatory or judicial authority in a manner that would adversely affect our business. Potential sanctions for violation of these statutes and regulations include significant fines and the suspension or loss of various licenses, certificates and authorizations, which could have a material adverse effect on our business. In addition, compliance with future legislation could impose additional requirements on us, which may be costly.

We must comply with a variety of employment and business practices laws across the United States, Netherlands, Turkey, and United Arab Emirates. We monitor the laws governing our activities, but in the event we do not become aware of a new regulation or fail to comply with a regulation, we could be subject to disciplinary action by governing bodies and potentially employee lawsuits.

In operating our XpresCheck and Treat businesses, we have medical service agreements ("MSAs") with state licensed physicians and nurse practitioners, under which we administer COVID-19 testing options, in three locations operating in three airports. Some of the states in which we currently operate this business have laws that prohibit business entities from directly owning physician practices, practicing medicine, employing physicians to practice medicine, exercising control over medical decisions by physicians or engaging in certain arrangements, such as fee-splitting, with physicians (such activities are generally referred to as the "corporate practice of medicine"). In some states these prohibitions are expressly stated in a statute or regulation, while in other states the prohibition is a matter of judicial or regulatory interpretation. Other states in which we may operate in the future may also generally prohibit the corporate practice of medicine. While we endeavor to comply with state corporate practice of medicine laws and regulations as we interpret them in the operation of our XpresCheck and Treat businesses, the laws and regulations in these areas are complex, changing, and often subject to varying interpretations. The interpretation and enforcement of these laws vary significantly from state to state. Penalties for violations of the corporate practice of medicine vary by state and may result in physicians being subject to disciplinary action, as well as to forfeiture of revenue from payors for services rendered. For business entities such as us, violations may also bring both civil and, in more extreme cases, criminal liability for engaging in medical practice without a license. Some of the relevant laws, regulations and agency interpretations in states with corporate practice of medicine restrictions have been subject to limited judicial and regulatory interpretation, and state laws and regulations are subject to change. Regulatory authorities and other parties in some states may assert that our MSAs mean that, through our XpresCheck and Treat businesses, we are engaged in the prohibited corporate practice of medicine. If this were to occur, we could be subject to civil and/or criminal penalties, our MSAs with physicians could be found legally invalid and unenforceable (in whole or in part) or we could be required to restructure our arrangements with physicians, in each case in one or more of the jurisdictions in which we operate. Any of these outcomes may have a material adverse effect on our business, results of operations, financial condition, cash flows in our XpresCheck and Treat businesses and our reputation overall.

Pursuant to ACDBE participation requirements, we are often required to meet, or use good faith efforts to meet, certain minimum ACDBE participation requirements when bidding on or submitting proposals for new concession contracts. If we are unable to find and/or partner with an appropriate ACDBE, we may lose opportunities to open new locations. In addition, a number of our existing leases contain minimum ACDBE participation requirements which require the ACDBE to own a significant portion of the business being operated under those leases. The level of ACDBE participation requirements may affect our profitability and/or its ability to meet financial forecasts. Further, if we fail to comply with the minimum ACDBE participation requirements, we may be held responsible for a breach of contract, which could result in the termination of a lease and impairment of our ability to bid on or obtain future concession contracts. To the extent that our leases are terminated and we are required to shut down one or more store locations, there could be a material adverse impact to our business and results of operations.

There are a number of state, federal and international laws protecting the privacy and security of health information and personal data. Under the administrative simplification provisions of HIPAA, the U.S. Department of Health and Human Services has issued regulations which establish uniform standards governing the conduct of certain electronic healthcare transactions and protecting the privacy and security of PHI used or disclosed by healthcare providers and other covered entities. The privacy regulations regulate the use and disclosure of PHI by healthcare providers engaging in certain electronic transactions or "standard transactions." They also set forth certain rights that an individual has with respect to his or her PHI maintained by a covered healthcare provider, including the right to access or amend certain records containing PHI or to request restrictions on the use or disclosure of PHI. The HIPAA security regulations establish administrative, physical, and technical standards for maintaining the integrity and availability of PHI in electronic form. These standards apply to covered healthcare providers and also to "business associates" or third parties providing services involving the use or disclosure of PHI. The HIPAA privacy and security regulations establish a uniform federal "floor" and do not supersede state laws that are more stringent or provide individuals with greater rights with respect to the privacy or security of, and access to, their records containing PHI. As a result, we may be required to comply with both HIPAA privacy regulations and varying state privacy and data security laws. Moreover, HITECH, among other things, established certain health information security breach notification requirements. In the event of a breach of unsecured PHI, a covered entity must notify each individual whose PHI is breached, federal regulators and in some cases, must publicize the breach in local or national media. Breaches affecting 500 individuals or more are publicized by federal regulators who publicly identify the breaching entity, the circumstances of the breach and the number of individuals affected. These laws contain significant fines and other penalties for wrongful use or disclosure of PHI. Given the complexity of HIPAA and HITECH and their overlap with state privacy and security laws, and the fact that these laws are rapidly evolving and are subject to changing and potentially conflicting interpretation, our ability to comply with the HIPAA, HITECH and state privacy requirements is uncertain and the costs of compliance are significant. Adding to the complexity is that our operations are currently evolving and the requirements of these laws will apply differently depending on such things as whether or not we bill electronically for our services, or provide services involving the use or disclosure of PHI and incur compliance obligations as a business associate. The costs of complying with any changes to HIPAA, HITECH and state privacy restrictions may have a negative impact on our operations. Noncompliance could subject us to criminal penalties, civil sanctions and significant monetary penalties as well as reputational damage. We also are required to collect and maintain personal information about our employees as well as receive and transfer certain payment information, to accept payments from our customers, including credit card information. Most states have adopted laws requiring notification of affected individuals and state regulators in the event of a breach of personal information, which is a broader class of information than the health information protected by HIPAA. Many state laws impose significant data security requirements, such as encryption or mandatory contractual terms to ensure ongoing protection of personal information. Activities outside of the United States implicate local and national data protection standards, impose additional compliance requirements, and generate additional risks of enforcement for non-compliance. The collection and use of such information may be subject to contractual obligations as well. If the security and information systems that we or our outsourced third-party providers use to store or process such information are compromised or if we, or such third parties, otherwise fail to comply with these laws, regulations, and contractual obligations, we could face litigation and the imposition of penalties that could adversely affect our financial performance. We must comply with all applicable privacy and data security laws in order to operate our business and may be required to expend significant capital and other resources to ensure ongoing compliance, to protect against security breaches and hackers or to alleviate problems caused by such breaches. Breaches of health information and/or personal data may be extremely expensive to remediate, may prompt federal or state investigation, fines, civil and/or criminal sanctions and significant reputational damage.

As of March 24, 2023, we had approximately 382 full-time and 101 part-time employees in its locations. Excluding some dedicated retail staff, the majority of these employees are licensed to perform spa services, and hold such licenses as masseuses, nail technicians, and aestheticians. The demand for these licensed technicians has been increasing as more consumers gravitate to health and wellness treatments such as spa services. We compete not only with other airport-based spa companies but with spa companies outside of the airport for this skilled labor force. In addition, all staff hired by us must pass the background checks and security clearances necessary to work in airport locations. If we are unable to attract and retain qualified staff to work in our airport locations, its ability to operate will be impacted negatively.

An increase in the minimum wage could increase our cost of labor and have an adverse impact on our business, financial condition and results of operations.

We rely on a small number of suppliers for our products. As a result, these suppliers may have increased bargaining power and we may be required to accept less favorable purchasing terms. In the event of a dispute with a supplier, the delivery of a significant amount of merchandise may be delayed or cancelled, or we may be forced to purchase merchandise from other suppliers on less favorable terms. Such events could cause turnover to fall or costs to increase, adversely affecting our business, financial condition and results of operations. In particular, we have publicized our sale of certain brands of products in our stores – our failure to sell these brands may adversely affect our business. Further, damage or disruption to our supply chain due to any of the following could impair our ability to sell our products: adverse weather conditions or natural disaster, government action, fire, terrorism, cyber-attacks, the outbreak or escalation of armed hostilities  (such as the Russian invasion of Ukraine), pandemics, industrial accidents or other occupational health and safety issues, strikes and other labor disputes, customs or import restrictions or other reasons beyond our control or the control of our suppliers and business partners. Failure to take adequate steps to mitigate the likelihood or potential impact of such events, or to effectively manage such events if they occur, could adversely affect our business, financial condition and results of operations, as well as require additional resources to restore our supply chain.