ACADIA Pharmaceuticals (ACAD) Risk Analysis

In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, processing) personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, data we collect about trial participants in connection with clinical trials, sensitive third-party data, business plans, transactions, financial information and medical information collected by our patient access management team (collectively, sensitive data). Our data processing activities may subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, HIPAA, as amended by HITECH, imposes specific requirements relating to the privacy, security, and transmission of individually identifiable health information. For example, the California Consumer Privacy Act of 2018 (CCPA) requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights. The CCPA provides for civil penalties of up to $7,500 per violation and allows private litigants affected by certain data breaches to recover significant statutory damages. Although the CCPA exempts some data processed in the context of clinical trials, the CCPA may increase compliance costs and potential liability with respect to other personal data we may maintain about California residents. In addition, the California Privacy Rights Act of 2020 (CPRA), which became operative January 1, 2023, expands the CCPA's requirements, including applying to personal information of business representatives and employees and establishing a new regulatory agency to implement and enforce the law. Other states, such as Virginia and Colorado, have also passed comprehensive privacy laws, and similar laws are being considered in several other states, as well as at the federal and local levels. While these states, like the CCPA, also exempt some data processed in the context of clinical trials, these developments further complicate compliance efforts and increase legal risk and compliance costs for us and the third parties upon whom we rely. Outside the United States, an increasing number of laws, regulations, and industry standards may govern data privacy and security. For example, the EU GDPR, UK GDPR, Brazil's General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or LGPD) (Law No. 13,709/2018), and China's Personal Information Protection Law (PIPL) impose strict requirements for processing personal data. For example, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros under the EU GDPR / 17.5 million pounds sterling under the UK GDPR or 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. In addition, we may be unable to transfer personal data from Europe and other jurisdictions to the United States or other countries due to data localization requirements or limitations on cross-border data flows. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area (EEA) and the UK have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it believes are inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA and UK's standard contractual clauses, these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. If there is no lawful manner for us to transfer personal data from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including by limiting our ability to conduct clinical trial activities in Europe and elsewhere, the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers of personal data to recipients outside Europe for allegedly violating the EU GDPR's cross-border data transfer limitations. Additionally, companies that transfer personal data to recipients outside of the EEA and/or UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators individual litigants and activist groups. In addition to data privacy and security laws, we may be contractually subject to industry standards adopted by industry groups and may become subject to such obligations in the future. We may also be bound by other contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. We may publish privacy policies, marketing materials, and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and security. If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators, or other adverse consequences. Obligations related to data privacy and security are quickly changing, becoming increasingly stringent, and creating regulatory uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources and may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third parties on whom we rely on may fail to comply with such obligations, which could negatively impact our business operations. If we or the third parties on which we rely fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including but not limited to: government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class-action claims); additional reporting requirements and/or oversight; bans on processing personal data; and orders to destroy or not use personal data. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to loss of customers; inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations.

Our operations are directly, and indirectly through our customers and third-party payors, subject to various U.S. federal and state healthcare laws and regulations, including, without limitation, the U.S. federal Anti-Kickback Statute, the U.S. federal False Claims Act, and physician payment sunshine laws and regulations. These laws may impact, among other things, our clinical research, sales, marketing, grants, charitable donations, and education programs and constrain the business or financial arrangements with healthcare providers, physicians, charitable foundations that support Parkinson's disease patients generally, and other parties that have the ability to directly or indirectly influence the prescribing, ordering, marketing, or distribution of our products for which we obtain marketing approval. In addition, we and any current or potential future collaborators, partners or service providers are or may become subject to data privacy and security regulation by both the U.S. federal government and the states in which we conduct our business, including laws and regulations that apply to our processing of personal data or the processing of personal data on our behalf. Finally, we may be subject to additional healthcare, statutory and regulatory requirements and enforcement by foreign regulatory authorities in jurisdictions in which we conduct our business. The laws that may affect our ability to operate include: - the U.S. federal Anti-Kickback Statute, which prohibits, among other things, persons or entities from knowingly and willfully soliciting, offering, receiving or paying any remuneration (including any kickback, bribe, or certain rebates), directly or indirectly, overtly or covertly, in cash or in kind, to induce, or in return for, either the referral of an individual, or the purchase, lease, order or recommendation of any good, facility, item or service, for which payment may be made, in whole or in part, under U.S. federal and state healthcare programs such as Medicare and Medicaid. A person or entity does not need to have actual knowledge of the statute or specific intent to violate it in order to have committed a violation;- the U.S. federal civil and criminal false claims laws, including the civil False Claims Act, which can be enforced through civil whistleblower or qui tam actions, and civil monetary penalties laws, which impose criminal and civil penalties on individuals or entities for, among other things, knowingly presenting, or causing to be presented to the U.S. federal government, claims for payment or approval that are false or fraudulent or from knowingly making a false statement to avoid, decrease or conceal an obligation to pay money to the U.S. federal government. In addition, the government may assert that a claim including items and services resulting from a violation of the U.S. federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the False Claims Act;- the U.S. federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), which imposes criminal and civil liability for, among other things, knowingly and willfully executing, or attempting to execute, a scheme to defraud any healthcare benefit program or obtain, by means of false or fraudulent pretenses, representations, or promises, any of the money or property owned by, or under the custody or control of, any healthcare benefit program, regardless of the payor (e.g., public or private) and knowingly and willfully falsifying, concealing or covering up by any trick or device a material fact or making any materially false statement, in connection with the delivery of, or payment for, healthcare benefits, items or services. Similar to the U.S. federal Anti-Kickback Statute, a person or entity does not need to have actual knowledge of the statute or specific intent to violate it in order to have committed a violation;- HIPAA, and its implementing regulations, and as amended again by the Final HIPAA Omnibus Rule, Modifications to the HIPAA Privacy, Security, Enforcement and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act (HITECH) and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules, published in January 2013, which imposes certain obligations, including mandatory contractual terms, with respect to safeguarding the privacy, security and transmission of individually identifiable health information on covered entities subject to the rule, such as health plans, healthcare clearinghouses and certain healthcare providers as well as their business associates, individuals or entities that perform certain services involving the use or disclosure of individually identifiable health information on behalf of a covered entity and their subcontractors that use, disclose or otherwise process individually identifiable health information;- the U.S. Federal Food, Drug and Cosmetic Act (FDCA), which prohibits, among other things, the adulteration or misbranding of drugs, biologics and medical devices;- the U.S. federal physician payment transparency requirements, sometimes referred to as the "Physician Payments Sunshine Act", which was enacted as part of the ACA and its implementing regulations and requires certain manufacturers of drugs, devices, biologics and medical supplies for which payment is available under Medicare, Medicaid, or the Children's Health Insurance Program to report annually to the CMS information related to certain payments and other transfers of value made to physicians (as defined to include doctors of medicine, dentists, optometrists, podiatrists and chiropractors under such law), other healthcare professionals (such as physician assistants and nurse practitioners), and teaching hospitals, as well as information regarding ownership and investment interests held by physicians and their immediate family members; and - analogous state and local laws and regulations, including: state anti-kickback and false claims laws, which may apply to our business practices, including but not limited to, research, distribution, sales and marketing arrangements and claims involving healthcare items or services reimbursed by any third-party payor, including private insurers; state laws that require pharmaceutical companies to comply with the pharmaceutical industry's voluntary compliance guidelines and the relevant compliance guidance promulgated by the U.S. federal government, or otherwise restrict payments that may be made to healthcare providers and other potential referral sources; state and local laws and regulations that require drug manufacturers to file reports relating to pricing and marketing information, which requires tracking gifts and other remuneration and items of value provided to healthcare professionals and entities and/or the registration of pharmaceutical sales representatives; and state laws governing the privacy and security of health information in certain circumstances, many of which differ from each other in significant ways and often are not preempted by HIPAA, thus complicating compliance efforts. Ensuring that our internal operations and future business arrangements with third parties comply with applicable healthcare laws and regulations could involve substantial costs. It is possible that governmental authorities will conclude that our business practices do not comply with current or future statutes, regulations or case law interpreting applicable fraud and abuse or other healthcare laws and regulations. For example, contributions to third-party charitable foundations are a current area of significant governmental and congressional scrutiny, and we could face action if a federal or state governmental authority were to conclude that our charitable contributions to foundations that support Parkinson's disease patients generally are not compliant. If our operations are found to be in violation of any of the laws described above or any other governmental laws and regulations that may apply to us, we may be subject to significant penalties, including civil, criminal and administrative penalties, damages, fines, exclusion from U.S. government-funded healthcare programs, such as Medicare and Medicaid, disgorgement, imprisonment, contractual damages, reputational harm, diminished profits, additional reporting requirements and/or oversight, and the curtailment or restructuring of our operations. Moreover, while we do not bill third-party payors directly and our customers make the ultimate decision on how to submit claims, from time-to-time, for NUPLAZID, DAYBUE and any other product candidates that may be approved, we may provide reimbursement guidance to patients and healthcare providers. If a government authority were to conclude that we provided improper advice and/or encouraged the submission of a false claim for reimbursement, we could face action against us by government authorities. If any of the physicians or other providers or entities with whom we expect to do business is found to be not in compliance with applicable laws, they may be subject to criminal, civil or administrative sanctions, including exclusions from government-funded healthcare programs and imprisonment. If any of the above occur, it could adversely affect our ability to operate our business and our results of operations. In addition, the approval and commercialization of NUPLAZID, DAYBUE or any other product candidates that may be approved, outside the U.S. will also likely subject us to foreign equivalents of the healthcare laws mentioned above, among other foreign laws.

While pimavanserin has been approved in the U.S. by the FDA for the treatment of hallucinations and delusions associated with PDP, it has not been approved by the FDA for any other indications, and it has not been approved in any other jurisdiction for this indication or for any other indication. In order to market pimavanserin for other indications or in other jurisdictions, we must obtain regulatory approval for each of those indications and in each of the applicable jurisdictions, and we may never be able to obtain such approval. Approval of NUPLAZID by the FDA for the treatment of hallucinations and delusions associated with PDP does not ensure that NUPLAZID will be approved by the FDA for any other indication. For example, following the successful completion of our Phase 3 HARMONY study, we submitted an sNDA to the FDA for the treatment of DRP on June 3, 2020. On April 2, 2021, we received a complete response letter (CRL) from the FDA, indicating that the FDA had completed its review of the application and determined that it could not be approved in its present form. In February 2022, we resubmitted the aforementioned sNDA refining the proposed indication to treatment of hallucinations and delusions associated with ADP. On August 4, 2022 we received a CRL from the FDA regarding our ADP sNDA resubmission. At this time, we are not planning to conduct any additional studies for pimavanserin in ADP. We initiated a Phase 3 program for pimavanserin as an adjunctive treatment for major depressive disorder (MDD) in April 2019. In July 2020, we announced that our Phase 3 CLARITY study, which combined two identical, double-blind, placebo-controlled studies, did not achieve statistical significance on the primary endpoint. As a result, at this time we do not plan on initiating any additional Phase 3 studies to evaluate pimavanserin for adjunctive use with selective serotonin reuptake inhibitor (SSRI)/ serotonin-norepinephrine reuptake inhibitor (SNRI) drugs for the treatment of MDD. We initiated the Phase 3 ADVANCE-2 study of pimavanserin for the treatment of the negative symptoms of schizophrenia in August 2020. We completed the enrollment with top-line results expected inthe firest quarter of 2024. There is no guarantee that our ongoing study will be successful, or that the FDA or any regulatory authority in foreign jurisdictions will approve pimavanserin for that indication. The research, testing, manufacturing, labeling, approval, sale, import, export, marketing, and distribution of pharmaceutical product candidates are subject to extensive regulation by the FDA and other regulatory authorities in the U.S. and other countries, whose regulations differ from country to country. We will be required to comply with different regulations and policies of the jurisdictions where we seek approval for our product candidates, and we have not yet identified all of the requirements that we will need to satisfy to submit NUPLAZID for approval for other indications or in other jurisdictions. This will require additional time, expertise and expense, including the potential need to conduct additional studies or development work for other jurisdictions beyond the work that we have conducted to support our NDA submission in PDP. If we do not receive marketing approval for NUPLAZID for any other indication, we will never be able to commercialize NUPLAZID for any other indication in the U.S. Even if we do receive additional regulatory approvals, we may not be successful in commercializing those opportunities. If the results or timing of regulatory filings, the regulatory process, regulatory developments, clinical trials or preclinical studies, or other activities, actions or decisions related to NUPLAZID do not meet our or others' expectations, the market price of our common stock could decline significantly and the long-term success of the product and our company could be harmed.

The scope and terms of the FDA's approval of NUPLAZID may limit our ability to commercialize NUPLAZID and, therefore, our ability to generate substantial sales revenues. The FDA has approved NUPLAZID only for the treatment of hallucinations and delusions associated with PDP. The label for NUPLAZID also contains a "boxed" warning that elderly patients with dementia-related psychosis (DRP) treated with antipsychotic drugs are at an increased risk of death, and that NUPLAZID is not approved for the treatment of patients with DRP unrelated to the hallucinations and delusions associated with PDP. This "boxed" warning may discourage physicians from prescribing NUPLAZID to patients diagnosed with PDP, including those with dementia. In connection with the FDA approval, we agreed to four post-marketing commitments (PMCs): (i) a randomized withdrawal trial of pimavanserin 34 mg/day compared to placebo, (ii) a placebo-controlled trial (or trials) of pimavanserin 34 mg/day for eight weeks in at least 500 predominantly frail and elderly subjects, (iii) a drug-drug interaction study to measure the effect of a strong CYP3A4 inducer on the exposure to pimavanserin, and (iv) re-analysis of tissue samples from certain previously conducted preclinical studies. We have fulfilled three PMCs; the PMC covering a trial (or trials) in frail and elderly subjects is in process and expected to be completed in accordance with the timeline agreed with the FDA. Failure to complete the remaining PMC may result in regulatory action by the FDA. The results of any post-marketing study may cause the FDA to update the label and/or cause the FDA to request additional studies or require risk mitigation plans. The manufacturing processes, labeling, packaging, distribution, adverse event reporting, storage, advertising, promotion and recordkeeping for NUPLAZID will also continue to be subject to extensive and ongoing regulatory requirements. These requirements include submissions of safety and other post-marketing information and reports, registration, as well as continued compliance with cGMPs, good clinical practices, international council for harmonization guidelines and good laboratory practices, each of which are regulations and guidelines enforced by the FDA for all of our nonclinical and clinical development and for any clinical trials that we conduct post-approval. Discovery of any issues post-approval, including any safety concerns, such as unexpected side effects or drug-drug interaction problems, adverse events of unanticipated severity or frequency, or concerns over misuse or abuse of the product, problems with the facilities where the product is manufactured, packaged or distributed, or failure to comply with regulatory requirements, may result in, among other things, restrictions on NUPLAZID or on us, including: - withdrawal of approval, addition of warnings or narrowing of the approved indication in the product label;- requirement of a Risk Evaluation and Mitigation Strategy to mitigate the risk of off-label use in populations where the FDA may believe that the potential risks of use may outweigh its benefits;- voluntary or mandatory recalls;- warning letters;- suspension of any ongoing clinical studies;- refusal by the FDA or other regulatory authorities to approve pending applications or supplements to approved applications filed by us, or suspension or revocation of product approvals;- restrictions on operations, including restrictions on the marketing or manufacturing of the product or the imposition of costly new manufacturing requirements; or - seizure or detention, or refusal to permit the import or export of products. If any of these actions were to occur, we may have to discontinue the commercialization of NUPLAZID, limit our sales and marketing efforts, conduct further post-approval studies, and/or discontinue or change any other ongoing or planned clinical studies, which in turn could result in significant expense and delay or limit our ability to generate sales revenues.

As of June 30, 2023, we employed approximately 540 employees. Our current infrastructure may be inadequate to support our development and commercialization efforts and expected growth. Future growth will impose significant added responsibilities on members of management, including the need to identify, recruit, and integrate additional employees and retain existing employees, and may take time away from running other aspects of our business, including development and commercialization of our product candidates. Our future financial performance and our ability to commercialize NUPLAZID, DAYBUE and any other product candidates that receive regulatory approval and to compete effectively will depend, in part, on our ability to manage any future growth effectively. In particular, we will need to support the training and ongoing activities of our sales force. To that end, we must be able to: - manage our development efforts effectively;- integrate additional management, administrative and manufacturing personnel;- develop our marketing and sales organization; and - maintain sufficient administrative, accounting and management information systems and controls. We may not be able to accomplish these tasks or successfully manage our operations and, accordingly, may not achieve our research, development, and commercialization goals. Our failure to accomplish any of these goals could harm our financial results and prospects.

The pharmaceutical industry is subject to stringent regulation by the FDA and other regulatory agencies in the U.S. and by comparable authorities in other countries. Neither we nor our collaborators can market a pharmaceutical product, including NUPLAZID and DAYBUE, in the U.S. until it has completed rigorous preclinical testing and clinical trials and an extensive regulatory clearance process implemented by the FDA. Satisfaction of regulatory requirements typically takes many years, depends upon the type, complexity and novelty of the product, and requires substantial resources. Even if regulatory approval is obtained, the FDA and other regulatory agencies may impose significant restrictions on the indicated uses, conditions for use, labeling, advertising, promotion, and/or marketing of such products, and requirements for post-approval studies, including additional research and development and clinical trials. These limitations may limit the size of the market for the product or result in the incurrence of additional costs. Any delay or failure in obtaining required approvals could have a material adverse effect on our ability to generate revenues from the particular product candidate. Outside the U.S., the ability to market a product is contingent upon receiving approval from the appropriate regulatory authorities. The requirements governing the conduct of clinical trials, marketing authorization, pricing, and reimbursement vary widely from country to country. Only after the appropriate regulatory authority is satisfied that adequate evidence of safety, quality, and efficacy has been presented will it grant a marketing authorization. Approval by the FDA does not automatically lead to the approval by regulatory authorities outside the U.S. and, similarly, approval by regulatory authorities outside the U.S. will not automatically lead to FDA approval. In addition, U.S. and foreign government regulations control access to and use of some human or other tissue samples in our research and development efforts. U.S. and foreign government agencies may also impose restrictions on the use of data derived from human or other tissue samples. Accordingly, if we fail to comply with these regulations and restrictions, the commercialization of our product candidates may be delayed or suspended, which may delay or impede our ability to generate product revenues.