information or data accurately or disclose unauthorized activities to us. In particular, sales, marketing and business arrangements in the healthcare industry are subject to extensive laws and
regulations intended to prevent fraud, kickbacks, self-dealing and other abusive practices. These laws and regulations may restrict or prohibit a wide range of pricing, discounting, marketing and promotion, sales commission, customer incentive
programs and other business arrangements. Such misconduct could also involve the improper use of information obtained in the course of clinical trials, which could result in regulatory sanctions and serious harm to our reputation. It is not always
possible to identify and deter misconduct, and the precautions we take to detect and prevent this activity may not be effective in controlling unknown or unmanaged risks or losses or in protecting us from governmental investigations or other actions
or lawsuits stemming from a failure to be in compliance with such laws or regulations. If any such actions are instituted against us, and we are not successful in defending ourselves or asserting our rights, those actions could have a material
adverse effect on our business and financial condition, including the imposition of significant criminal, civil and administrative fines or other sanctions, such as monetary penalties, damages, fines, disgorgement, imprisonment, exclusion from
participation in government-funded healthcare programs, such as Medicare and Medicaid, integrity obligations, reputational harm and the curtailment or restructuring of our operations.
We depend on sophisticated information technology systems and data processing to operate our business. If we experience security or data privacy
breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data or personal data, we may face costs, significant liabilities, harm to our brand and business disruption.
We rely on information technology systems and data processing that we or our service providers, collaborators, consultants, contractors or
partners operate to collect, process, transmit and store electronic information in our day-to-day operations, including a variety of personal data, such as
name, mailing address, email addresses, phone number and potentially clinical trial information. Additionally, we, and our service providers, collaborators, consultants, contractors or partners, do or will collect, receive, store, process, generate,
use, transfer, disclose, make accessible, protect and share personal information, health information and other information to host or otherwise process some of our anticipated future clinical data and that of users, develop our products, to operate
our business, for clinical trial purposes, for legal and marketing purposes, and for other business-related purposes. Our internal computer systems and data processing and those of our third-party vendors, consultants, collaborators, contractors or
partners, including future CROs may be vulnerable to a cyber-attack (including supply chain cyber-attacks), malicious intrusion, breakdown, destruction, loss of data privacy, actions or inactions by our employees or contractors that expose security
vulnerabilities, theft or destruction of intellectual property or other confidential or proprietary information, business interruption or other significant security incidents. As the cyber-threat landscape evolves, these attacks are growing in
frequency, level of persistence, sophistication and intensity, and are becoming increasingly difficult to detect. In addition to traditional computer hackers, threat actors, software bugs, malicious code (such as viruses and worms),
employee theft or misuse, denial-of-service attacks (such as credential stuffing), phishing and ransomware attacks, sophisticated nation-state and nation-state
supported actors now engage in attacks (including advanced persistent threat intrusions). These risks may be increased as a result of COVID-19, owing to an increase in personnel working remotely and
higher reliance on internet technology. Furthermore, because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate
these techniques or implement adequate preventative measures. We may also experience security breaches that may remain undetected for an extended period.
There can be no assurance that we, our service providers, collaborators, consultants, contractors or partners will be successful in efforts to
detect, prevent or fully recover systems or data from all breakdowns, service interruptions, attacks or breaches of systems that could adversely affect our business and operations and/or result in the loss of critical or sensitive data. Any failure
by us or our service providers, collaborators, consultants, contractors or partners to detect, prevent, respond to or mitigate security breaches or improper access to, use of, or inappropriate disclosure of any of this information or other
confidential or sensitive information, including
38