Krystal Biotech (4KB) Risk Analysis

The clinical trial requirements of the FDA, EMA, European Commission, MHLW, and other regulatory authorities and the criteria these regulators use to determine the safety and efficacy of a product candidate vary substantially according to the type, complexity, novelty and intended use, and market of such product candidates. The regulatory approval process for novel product candidates such as ours, including approvals of or changes to manufacturing processes, can be more expensive and take longer than for other, better known or more extensively studied product candidates. It is difficult to determine how long it will take or how much it will cost to obtain regulatory approvals for our product candidates in the United States, the European Union, Japan, or elsewhere, or how long it will take to commercialize our product candidates. Approvals by the European Commission, MHLW, or other foreign regulators may not be indicative of what the FDA may require for approval and approval by the FDA may not be indicative of what the European Commission, MHLW, or other foreign regulators would require for approval. Regulatory requirements and policy governing gene and cell therapy products have changed frequently and may continue to change in the future. In 2016, the FDA established the Office of Tissues and Advanced Therapies ("OTAT") within its Center for Biologics Evaluation and Research to consolidate the review of gene therapy and related products, and has established the Cellular, Tissue and Gene Therapies Advisory Committee, among others, to advise this review. In September 2022, the FDA announced retitling of OTAT to the Office of Therapeutic Products, or OTP, and elevation of OTP to a "Super Office" to meet its growing cell and gene therapy workload. If we engage a National Institutes of Health funded institution to conduct a clinical trial, that institution's Institutional Biosafety Committee as well as its Institutional Review Board would need to review the proposed clinical trial to assess the safety and ethics of the trial. Further, the FDA continues to update policies relating to clinical trial design and data collection which may impact compliance requirements. Similarly, the EMA, the European Commission, MHLW, or other foreign regulators may issue new or revised guidelines concerning the development and marketing authorization of gene therapy medicinal products. These regulatory review committees and advisory groups and the new guidelines they promulgate may lengthen the regulatory review process, require us to perform additional studies, increase our development costs, lead to changes in regulatory positions and interpretations, delay or prevent approval and commercialization of our product candidates, or lead to significant post-approval limitations or restrictions. These additional processes may result in a review and approval process that is longer than we otherwise would have expected. Delay or failure to obtain, or unexpected costs in obtaining, the regulatory approval necessary to bring a product candidate to market could decrease our ability to generate sufficient product revenue, and our business, financial condition, results of operations, and prospects would be materially and adversely affected.

We may seek approval of our current or future product candidates using the FDA's accelerated approval pathway. This pathway may not lead to a faster development, regulatory review, or approval process and does not increase the likelihood that our product candidates will receive marketing approval. A product may be eligible for accelerated approval if it treats a serious or life-threatening condition, generally provides a meaningful advantage over available therapies, and demonstrates an effect on a surrogate endpoint or an intermediate clinical endpoint that is reasonably likely to predict clinical benefit. As a condition of approval, the FDA may require that a sponsor of a product receiving accelerated approval perform adequate and well-controlled post-marketing confirmatory clinical trials. These confirmatory trials must be completed with due diligence. Under the Food and Drug Omnibus Reform Act of 2022, or FDORA, the FDA is permitted to require, as appropriate, that a post-approval confirmatory trial or trials be underway prior to approval or within a specified time after the date accelerated approval was granted. FDORA also requires sponsors to send updates to the FDA every 180 days on the status of such studies, including progress toward enrollment targets, and the FDA must promptly post this information publicly. The FDA has also continued to update its accelerated approval policies, including expectations for clinical trial endpoints. Furthermore, under FDORA, the FDA is empowered to take action, such as issuing fines, against companies that fail to conduct with due diligence any post-approval confirmatory trial or submit timely reports to the agency on their progress. In addition, for products under consideration for accelerated approval, the FDA currently requires, unless otherwise requested by the agency, pre-approval of promotional materials intended for dissemination or publication within 120 days of marketing approval be submitted to the agency for review during the review period, which could adversely impact the timing of the commercial launch of the product. There can be no assurance that the FDA would allow any of our product candidates to proceed on an accelerated approval pathway, and even if the FDA did allow such pathway, there can be no assurance that any expedited development, review, or approval will be granted on a timely basis, or at all.

Regulatory authorities in some jurisdictions, including the United States, the European Union, and Japan may designate drugs for relatively small patient populations as orphan drugs. Under the Orphan Drug Act of 1983, as amended, the FDA may designate a product candidate as an orphan drug if it is intended to treat a rare disease or condition, which is generally defined as having a patient population of fewer than 200,000 individuals in the United States, or a patient population greater than 200,000 in the United States where there is no reasonable expectation that the cost of developing the drug will be recovered from sales in the United States of such drug. Orphan drug designation itself does not convey any advantage in or shorten the duration of the regulatory review and approval process, but it can lead to financial incentives, such as opportunities for grant funding toward clinical trial costs, tax advantages, and user-fee waivers. In addition, if a product candidate that has orphan designation subsequently receives the first FDA approval for the disease or condition for which it has such designation, the drug is entitled to orphan drug marketing exclusivity for a period of seven years. Orphan drug marketing exclusivity generally prevents the FDA from approving another application to market the same drug or biological product for the same disease or condition for seven years, except in limited circumstances, including if the FDA concludes that the later drug is safer, more effective, or makes a major contribution to patient care. A designated orphan drug may not receive orphan drug marketing exclusivity if it is approved for a use that is broader than the indication for which it received orphan designation. Orphan drug marketing exclusivity rights in the United States may be lost if the FDA later determines that the request for designation was materially defective or if the manufacturer is unable to assure sufficient quantity of the drug to meet the needs of patients with the rare disease or condition. In the European Union, the European Commission, upon a recommendation from the EMA's Committee for Orphan Medicinal Products, grants orphan drug designation to promote the development of products that are intended for the diagnosis, prevention, or treatment of a life-threatening or chronically debilitating condition affecting not more than 5 in 10,000 persons in the EU. Additionally, orphan designation is granted for products intended for the diagnosis, prevention, or treatment of a life-threatening, seriously debilitating, or serious and chronic condition and when, without incentives, it is unlikely that sales of the drug in the European Union would be sufficient to justify the necessary investment in developing the drug or biologic product. In the European Union, orphan medicinal product designation does not convey any advantage in, or shorten the duration of, the regulatory review and approval process, but orphan drug designation may entitle an applicant to financial incentives such as reduction of fees or fee waivers, protocol assistance, and access to the centralized marketing authorization procedure. Upon grant of a marketing authorization, orphan products are entitled to ten years of market exclusivity for the approved therapeutic indication, which means that the EMA and European Commission cannot accept another marketing authorization application, grant a marketing authorization, or accept an application to extend a marketing authorization for a similar product for the same indication for a period of ten years. The period of market exclusivity is extended by two years for orphan medicinal products that have also complied with an agreed Pediatric Investigation Plan. The ten-year market exclusivity in the European Union may be reduced to six years if, at the end of the fifth year, it is established that the product no longer meets the criteria for which it received orphan designation, including where it is shown that the product is sufficiently profitable not to justify maintenance of market exclusivity, or where the prevalence of the condition has increased above the threshold. Additionally granting of an authorization for another similar orphan medicinal product where another product has market exclusivity can happen at any time: (i) that the second applicant can establish that its product, although similar, is safer, more effective, or otherwise clinically superior, (ii) that the first applicant cannot supply enough orphan medicinal product, or (iii) where the first applicant consents to a second orphan medicinal product application. Pursuant to a recent legislative reform initiative of the pharmaceutical framework, for which a provisional political agreement has been reached between the European Parliament and the Council in December of 2025, exclusivity for new orphan medicinal products will likely run nine years (as opposed to the current ten years), while "breakthrough" orphan medicinal products addressing diseases with no existing treatments can benefit from up to 11 years of market exclusivity. The final legislative text has not yet been published, however, and remains subject to formal adoption, entry into force, and transitional arrangements. The orphan drug designation system in Japan aims to support the development of drugs for diseases that affect fewer than 50,000 patients in Japan, for which significant unmet medical need exists. An investigational therapy may be eligible for orphan drug designation in Japan if there is no approved alternative treatment option or if the therapy is expected to demonstrate superior efficacy or safety compared to existing treatment options. Specific measures to support the development of orphan drugs in Japan include subsidies for research and development expenditures, prioritized consultation regarding clinical development, reduced consultation fees, tax incentives, priority review of applications, reduced application fees, and extended registration validity period. Up to ten years of orphan exclusivity, known as the re-examination period, is granted for the product after approval. The orphan drug exclusivity may be rescinded by the Japanese government in certain circumstances. Even though we have obtained orphan drug exclusivity for VYJUVEK in the United States, EU, and Japan and obtained orphan drug designation for certain product candidates in the United States and the European Union, we may not be able to maintain orphan drug exclusivity, and if we are able to maintain the orphan drug exclusivity, the exclusivity may not effectively protect the product or product candidate from competition because different drugs can be approved for the same condition. Further, we cannot assure you that any of our other product candidates will be approved for any orphan-designated use in any jurisdiction, in a timely manner, or at all, or that a competitor will not obtain orphan drug exclusivity that could block the regulatory approval of any of our product candidates for several years. If we are unable to maintain or obtain orphan drug exclusivity, our ability to generate sufficient revenue may be negatively affected. If a competitor is able to obtain orphan drug exclusivity that would block our product candidates' regulatory approval, our ability to generate revenue could be significantly reduced, which would harm our business prospects, financial condition, and results of operations. We do not know if, when, or how the FDA or other regulators may change the applicable orphan drug regulations and policies in the future, and it is uncertain how any changes might affect our business. Depending on what changes may be made to orphan drug regulations and policies, our business could be adversely impacted.

VYJUVEK, our first FDA, European Commission, and MHLW-approved product, and any other product candidates that obtain regulatory approval in the future, will remain subject to ongoing regulatory requirements for manufacturing, labeling, packaging, storage, advertising, promotion, sampling, record-keeping, and submission of safety and other post-market information. Any regulatory approvals that we receive for our product candidates may also be subject to a post-approval safety monitoring program, limitations on the approved indicated uses for which the product may be marketed or to the conditions of approval, or contain requirements for potentially costly post-marketing testing, including Phase 4 clinical trials, and surveillance to monitor the quality, safety, and efficacy of the product. For example, the holder of an approved Biologics License Application, or BLA, is obligated to monitor and report adverse events and any failure of a product to meet the specifications in the BLA. The holder of an approved BLA also must submit new or supplemental applications and obtain FDA approval for certain changes to the approved product, product labeling, or manufacturing process. For example, if demand for an approved product increases more than we previously estimated, we may need or desire to scale up an existing FDA-approved manufacturing process and the scaled-up manufacturing process would be subject to FDA review and approval. Advertising and promotional materials must comply with FDA rules and are subject to FDA review, in addition to other potentially applicable federal, state, and foreign laws. In addition, product manufacturers and their facilities are subject to payment of user fees and continual review and periodic inspections by the FDA and other regulatory authorities for compliance with CGMP requirements and adherence to commitments made in the BLA or foreign marketing application. If we, or a regulatory authority, discover previously unknown problems with an approved product, such as adverse events of unanticipated severity or frequency, or problems with the facility where the product is manufactured or a regulatory authority disagrees with the promotion, marketing, or labeling of that product, a regulatory authority may impose restrictions relative to that product, the manufacturing facility, or us, including requiring recall or withdrawal of the product from the market or suspension of manufacturing. If we fail to comply with applicable regulatory requirements, a regulatory authority may, among other actions: - issue a warning letter asserting that we are in violation of the law;- seek an injunction or impose administrative, civil, or criminal penalties or monetary fines;- suspend or withdraw regulatory approval;- suspend any ongoing clinical trials;- refuse to approve a pending BLA or comparable foreign marketing application (or any supplements thereto) submitted by us or our strategic partners, if any;- restrict the marketing or manufacturing of the product;- seize or detain the product or otherwise require the withdrawal of the product from the market;- refuse to permit the import or export of product candidates; or - refuse to allow us to enter into government contracts. Any government investigation of alleged violations of law could require us to expend significant time and resources in response and could generate negative publicity. The occurrence of any event or penalty described above may inhibit our ability to commercialize our approved product, VYJUVEK, and any product candidates that obtain regulatory approval and adversely affect our business, financial condition, results of operations, and prospects. The FDA's policies, and those of equivalent foreign regulatory agencies, may change and additional government regulations may be enacted that could negatively impact the existing marketing approval for VYJUVEK and prevent, limit, or delay regulatory approval of our product candidates.

Approval of a product candidate in the United States by the FDA does not ensure approval of such product candidate by regulatory authorities in other countries or jurisdictions, and approval by one foreign regulatory authority does not ensure approval by regulatory authorities in other foreign countries or by the FDA. Sales of VYJUVEK or our product candidates, if approved, outside of the United States will be subject to foreign regulatory requirements governing clinical trials and marketing approval. Even if the FDA grants marketing approval for a product candidate, comparable regulatory authorities of foreign countries also must approve the manufacturing and marketing of the product candidate in those countries and the process for obtaining such approval may be lengthy and expensive. Approval procedures vary among jurisdictions and can involve requirements and administrative review periods different from, and more onerous than, those in the United States, including additional preclinical studies or clinical trials. In many countries outside the United States, a product candidate must be approved for reimbursement before it can be approved for sale in that country. In some cases, the price that we intend to charge for our product candidates, if approved, is also subject to approval. Obtaining a Marketing Authorization Application ("MAA") from the European Commission following the opinion of the EMA and obtaining marketing authorization from the MHLW in Japan are lengthy and expensive processes. Even if a product candidate is approved, the FDA, the European Commission, or the MHLW, as the case may be, may limit the indications for which the product may be marketed, require extensive warnings on the product labeling or require expensive and time-consuming additional clinical trials or reporting as conditions of approval. Regulatory authorities in countries outside of the United States, the European Union, and Japan also have requirements for approval of product candidates with which we must comply prior to marketing in those countries. Obtaining foreign regulatory approvals and compliance with foreign regulatory requirements could result in significant delays, difficulties, and costs for us and could delay or prevent the introduction of our product candidates in certain countries. Further, clinical trials conducted in one country may not be accepted by regulatory authorities in other countries. Also, regulatory approval for any of our product candidates may be withdrawn. If we fail to comply with the regulatory requirements, our target market will be reduced and our ability to realize the full market potential of our product candidates will be harmed and our business, financial condition, results of operations, and prospects will be adversely affected.

In 2012, Congress authorized the FDA to award priority review vouchers to sponsors of certain rare pediatric disease product applications. This program is designed to encourage development of new drug and biological products for prevention and treatment of certain rare pediatric diseases. Specifically, under this program, a sponsor that receives an approval for a drug or biologic for a "rare pediatric disease" that meets certain criteria may qualify for a voucher that can be redeemed to receive a priority review of a subsequent marketing application for a different product. The sponsor of a rare pediatric disease drug product receiving a priority review voucher may transfer (including by sale) the voucher to another sponsor. The voucher may be further transferred any number of times before the voucher is used, as long as the sponsor making the transfer has not yet submitted the application. The FDA may also revoke any priority review voucher if the rare pediatric disease drug for which the voucher was awarded is not marketed in the United States within one year following the date of approval. We received rare pediatric disease designation for VYJUVEK and were awarded a priority review voucher following FDA approval of VYJUVEK in May 2023. The priority review voucher was sold in August 2023. We have also obtained a rare pediatric disease designation for certain of our product candidates, including KB407, inhaled KB707, and intratumoral KB707. However, there is no guarantee that we will be able to obtain a priority review voucher if these product candidates are approved by the FDA. Congress included a sunset provision in the statute authorizing the rare pediatric disease priority review voucher program. Under current law, the FDA's authority to award rare pediatric disease priority review vouchers is scheduled to sunset after September 30, 2029. If the program is not extended, modified, or reauthorized prior to that date, we may be unable to obtain a priority review voucher for one or more of our product candidates, even if such product candidates otherwise satisfy the applicable criteria. Separately, in June 2025, the FDA announced the Commissioner's National Priority Voucher pilot program, which is distinct from the priority review voucher program and is intended to expedite review of certain applications aligned with national health priorities.

Before we can begin to commercially manufacture our product candidates, we must pass a pre-approval inspection of our manufacturing facilities by the FDA. A manufacturing authorization may also be required from the appropriate regulatory authorities outside of the United States. The timeframe required for us to obtain such approvals is uncertain. To obtain approval, we need to ensure that all our processes, methods, and equipment are compliant with CGMP, and perform extensive audits of vendors, contract laboratories, and suppliers. If any of our vendors, contract laboratories, or suppliers are found to be out of compliance with CGMP, we may experience delays or disruptions in manufacturing while we work with these third parties to remedy the violation or while we work to identify suitable replacement vendors, contract laboratories, or suppliers. The CGMP requirements govern quality control of the manufacturing process and documentation policies and procedures. In complying with CGMP, we are obligated to expend time, money, and effort in production, record keeping and quality control to assure that the product meets applicable specifications and other requirements. If we fail to comply with these requirements, we will be subject to possible regulatory action and may not be permitted to sell any approved product. In addition, the manufacturing process used to produce VYJUVEK and our product candidates is complex and novel and demand for an approved product may require us to change the manufacturing process, which may require regulatory approval before we are able to sell the product manufactured by the changed process. The production of VYJUVEK and our product candidates require processing steps that are more complex than those required for most pharmaceuticals. Moreover, the physical and chemical properties of a biologic such as ours generally cannot be fully characterized. As a result, assays of the finished product may not be sufficient to ensure that the product will perform in the intended manner. Accordingly, we employ multiple steps to control our manufacturing process to assure that the process works and that VYJUVEK and our product candidates are made strictly and consistently in compliance with the process. Problems with an approved manufacturing process, even minor deviations from the normal process, could result in product defects or manufacturing failures that result in lot failures, product recalls, product liability claims, or insufficient inventory. In addition, changes to an approved manufacturing process may result in problems with the process design, process reproducibility, stability, or batch consistency, and may require regulatory approval before we are permitted to sell products manufactured with the changed manufacturing process, which could potentially delay commercial availability of an approved product. We may encounter problems achieving adequate quantities and quality of materials that meet FDA or other applicable standards or specifications with consistent and acceptable production yields and costs, which could materially and adversely affect our business, financial condition, results of operations, and prospects.

We expect that coverage and reimbursement of pharmaceuticals may be increasingly restricted both in the United States and internationally. The escalating cost of health care has led to increased pressure on the health care industry to reduce costs. Drug pricing by pharmaceutical companies recently has come under increased scrutiny and continues to be subject to intense political and public debate in the United States and abroad. Government and private third-party payors have proposed health care reforms and cost reductions. A number of federal and state proposals to control the cost of health care, including the cost of drug treatments, have been made in the United States. Specifically, there have been several recent U.S. Congressional inquiries and proposed bills designed to, among other things, bring more transparency to drug pricing, review the relationship between pricing and manufacturer patient programs, and reform government program reimbursement methodologies for drugs. In some international markets, the government controls the pricing, which can affect the profitability of drugs. Current government regulations and possible future legislation regarding health care may affect coverage and reimbursement for medical treatment by third-party payors, which may render VYJUVEK or our product candidates, if approved, not commercially viable or may adversely affect our anticipated future revenue and gross margins. We cannot predict the extent to which our business may be affected by proposed health care reforms and cost reductions or potential future legislative or regulatory developments. However, future price controls or other changes in pricing regulation or negative publicity related to the pricing of drugs or biologics generally could restrict the amount that we are able to charge for VYJUVEK or our product candidates, if approved, which would adversely affect our anticipated revenue and results of operations.

In the United States and some foreign jurisdictions, there have been, and continue to be, several legislative and regulatory changes and proposed changes regarding the healthcare system that could prevent or delay marketing approval of our product candidates, restrict or regulate post-approval activities, and affect our ability to profitably sell VYJUVEK and any product candidates for which we obtain marketing approval. In the United States, there have been and continue to be a number of legislative efforts to contain healthcare costs. Any legislative changes that result in price controls, reduce access to and reimbursement for care, or add additional regulations may have an adverse effect on our financial condition and results of operations. Any changes that reduce, or impede the ability to obtain, reimbursement for VYJUVEK or our product candidates that we intend to commercialize in the United States could adversely affect successful commercialization of VYJUVEK and our plans to introduce our product candidates in the United States. In August 2022, the Inflation Reduction Act ("IRA") was signed into law. The IRA includes several provisions to lower prescription drug costs for people with Medicare and reduce drug spending by the federal government. In relevant part, the IRA allows Medicare to negotiate prices for certain prescription drugs, requires drug manufacturers to pay a rebate to the federal government if prices for single-source drugs and biologicals covered under Medicare Part B and nearly all covered drugs under Part D increase faster than the rate of inflation, caps out of pocket spending for Medicare Part D enrollees, and makes other benefit design changes to Medicare Part D intended to lower drug costs for enrollees and Medicare. Implementation of these changes began in 2023 and will continue to be implemented over the next several years. Beginning January 1, 2025, Medicare Part D enrollees now have a new annual out-of-pocket cap of $2,000 on prescription drugs. Other 2025 Medicare Part D changes include the elimination of the coverage gap phase and the replacement of the Coverage Gap Discount Program with the Manufacturer Discount Program, under which drug manufacturers are required provide a 10% discount for brand-name drugs and biologics during the initial coverage phase and a 20% discount during the catastrophic phase. Multiple pharmaceutical manufacturers have challenged the law in court, largely on constitutional grounds. To date, the majority of these challenges have been unsuccessful, with courts upholding the IRA. However, these suits will likely continue and the ultimate effects of such legal challenges are unclear. On April 15, 2025, President Trump issued an executive order directing the Secretary of the Department of Health and Human Services to take certain actions on drug pricing reform, including working with Congress on amendments to the IRA and rule making to establish new Medicare payment models for so-called "high-cost" prescription drugs and biological products. Subsequently, President Trump has issued additional executive orders directing additional actions designed to lower drug prices, including by tying the price of certain drugs to the price of those drugs in other countries. It is unclear whether the Trump administration executive orders will lead to actual legislative initiatives. At this time, we continue to evaluate the effect of the IRA and the Trump administration's executive actions on our business operations and financial condition and results as the full impact of the IRA and the executive actions remains uncertain. On July 4, 2025, legislation commonly referred to as the One Big Beautiful Bill Act was signed into law, which reduces funding to federal healthcare programs and imposes additional requirements to be eligible for healthcare, which may result in decreased access to healthcare, particularly in Medicaid programs. Further, there has been heightened governmental scrutiny in recent years over the manner in which manufacturers set prices for their marketed products and the cost of prescription drugs to consumers and government healthcare programs, which have resulted in several recent Congressional inquiries and proposed and enacted bills designed to, among other things, reduce the cost of prescription drugs, bring more transparency to product pricing, review the relationship between pricing and manufacturer patient programs, and reform government program reimbursement methodologies for products. In addition, the United States government, state legislatures, and foreign governments have shown significant interest in implementing cost containment programs, including price-controls, restrictions on reimbursement, and requirements for substitution of generic products for branded prescription drugs to limit the growth of government paid health care costs. For example, the United States government has passed legislation requiring pharmaceutical manufacturers to provide rebates and discounts to certain entities and governmental payors to participate in federal healthcare programs. Individual states in the United States have also increasingly enacted legislation and implemented regulations designed to control pharmaceutical product pricing, including price or patient reimbursement constraints, required discounts, restrictions on certain product access and marketing cost disclosure and transparency measures, and, in some cases, measures designed to encourage importation from other countries and bulk purchasing. Additional changes may affect our business, including those governing enrollment in federal healthcare programs, reimbursement changes, fraud and abuse enforcement, and expansion of new programs, such as Medicare payment for performance initiatives. Healthcare reform measures that may be adopted could result in more rigorous coverage criteria and in additional downward pressure on the price that we receive for any approved product. Any reduction in reimbursement from Medicare or other government programs may result in a similar reduction in payments from private payors. The implementation of cost containment measures or other healthcare reforms could result in reduced demand for our product and product candidates that are approved for sale or additional pricing pressures and may adversely impact our ability to generate sufficient revenue, attain consistent profitability, or commercialize our product candidates, if approved.

With the FDA approval of VYJUVEK, our operations are directly, or indirectly through our prescribers, customers, and purchasers, subject to various federal and state fraud and abuse laws and regulations, including, without limitation, the federal Anti-Kickback Statute, federal civil and criminal false claims laws, and the Physician Payments Sunshine Act and regulations. These laws impact, among other things, our sales, marketing, access assistance, sponsored genetic patient testing, and educational programs. In addition, we are subject to privacy and data security laws concerning personal information and health information imposed by both the federal government and the states in which we conduct our business, as well as by foreign jurisdictions. The laws that affect our operations include, but are not limited to: - the federal Anti-Kickback Statute, which prohibits, among other things, persons or entities from knowingly and willfully soliciting, receiving, offering, or paying any remuneration (including any kickback, bribe, or rebate), directly or indirectly, overtly or covertly, in cash or in kind, in return for the purchase, recommendation, leasing, or furnishing of an item or service reimbursable under a federal healthcare program, such as the Medicare and Medicaid programs. This statute has been interpreted to apply to arrangements between pharmaceutical manufacturers on the one hand, and prescribers, purchasers, and formulary managers on the other. The ACA amended the intent requirement of the federal Anti-Kickback Statute to clarify that a person or entity does not have to have actual knowledge of this statute or specific intent to violate it;- federal civil and criminal false claims laws and civil monetary penalty laws which prohibit, among other things, individuals or entities from knowingly presenting, or causing to be presented, claims for payment or approval from Medicare, Medicaid, or other government payors that are false or fraudulent. The ACA provides that a claim for items or services resulting from an Anti-Kickback Statute violation is a false claim under the False Claims Act ("FCA"). Cases against pharmaceutical manufacturers support the view that certain marketing practices, including off-label promotion, may implicate the FCA;- the federal Health Care Fraud statute imposes criminal and civil liability for executing or attempting to execute a scheme to defraud any healthcare benefit program or making false statements relating to healthcare matters;- the Health Insurance Portability and Accountability Act of 1996 Rules ("HIPAA Rules"), which impose certain requirements relating to the privacy, security, and transmission of individually identifiable health information by certain entities subject to the HIPAA Rules, such as health plans, health care clearinghouses, and health care providers that engage in certain covered transactions, known as covered entities, as well as their business associates that perform certain services that involve the use or disclosure of individually identifiable health information for or on behalf of covered entities;- federal transparency laws, including the federal Physician Payment Sunshine Act, that require certain manufacturers of drugs, devices, biologics, and medical supplies for which payment is available under Medicare, Medicaid, or the Children's Health Insurance Program, with specific exceptions, to report annually to the United States Centers for Medicare and Medicaid Services ("CMS") information related to: (i) payments or other "transfers of value" made to physicians and teaching hospitals, and (ii) ownership and investment interests held by physicians and their immediate family members;- our operations in Europe and Japan may be directly or indirectly subject to European and Japanese law equivalents of each of the above U.S. federal laws, some of which may not have been applicable prior to the recent European Commission and MHLW approvals and commercial launch of VYJUVEK in Europe and Japan;- U.S. state and foreign law equivalents of each of the above federal laws, state laws that require drug manufacturers to report information related to payments and other transfers of value to physicians and other healthcare providers or marketing expenditures; and - state and foreign laws governing data privacy and security of health information, many of which differ from each other and require attention to frequently changing regulatory requirements, thus complicating compliance efforts in certain circumstances and increasing exposure to liability. Because of the breadth of these laws and the narrowness of the statutory exceptions and safe harbors available, it is possible that some of our business activities could be subject to challenge under one or more of such laws. If our operations are found to be in violation of any of the laws described above or any other government regulations that apply to us, we may be subject to penalties, including civil and criminal penalties, damages, fines, exclusion from participation in government health care programs, such as Medicare and Medicaid, imprisonment, and the curtailment or restructuring of our operations, any of which could adversely affect our ability to operate our business and our results of operations. Often, to avoid the threat of treble damages and penalties under the FCA, health care providers and drug manufacturers will resolve allegations in a settlement without admitting liability. Any such settlement could materially affect our business, financial operations, and reputation. Efforts to ensure that our business arrangements with third parties comply with applicable healthcare laws and regulations involve substantial costs. It is possible that governmental authorities will conclude that our business practices may not comply with current or future statutes, regulations or case law involving applicable fraud and abuse or other healthcare laws and regulations. The risk of our being found in violation of these laws is increased by the fact that many of them have not been fully interpreted by the regulatory authorities or the courts, and their provisions are open to a variety of interpretations. Any action against us for violation of these laws, even if we successfully defend against such action, could cause us to incur significant legal expenses and divert our management's attention from the operation of our business. The shifting compliance environment and the need to build and maintain a robust and expandable systems to comply with multiple jurisdictions with different compliance and/or reporting requirements increases the possibility that we may run afoul of one or more of the requirements.

Privacy and data security have become significant areas of legal and regulatory focus in the United States, European Union, Japan, and in many other jurisdictions where we conduct or may conduct our operations. In our ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, "process") personal information and other sensitive information, including, but not limited to, health information, individuals' financial information, as well as proprietary and confidential business data, including trade secrets, intellectual property, and sensitive third-party data (collectively, "sensitive data"). The legislative and regulatory landscape for privacy and data security continues to evolve, and there has been an increasing focus on privacy and data security issues, which may affect our business and is expected to increase our compliance costs and exposure to liability. Our data processing activities may subject us to numerous privacy and data security obligations, including, but not limited to, domestic and international laws, regulations, guidance, industry standards, external and internal privacy and security policies, and contractual requirements. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal information privacy laws, consumer protection laws, and other similar laws. Notably, HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, imposes requirements on covered entities, as well as their business associates regarding the privacy, security, and transmission of individually identifiable health information. Further, states continue to adopt new laws or amend existing laws related to privacy and data security, requiring attention to frequently changing regulatory requirements. For example, the California Consumer Privacy Act of 2018 ("CCPA") requires businesses to provide specific disclosures in their privacy notices and honor residents' privacy rights. The CCPA provides for civil penalties of up to $7,500 per violation and allows private litigants affected by certain data breaches to recover significant statutory damages. Although the CCPA does not apply to certain data that we process in the context of clinical trials, efforts to comply with the CCPA may increase our annual compliance costs and subject us to potential liability with respect to other personal information we may maintain about California residents. In addition, the California Privacy Rights Act of 2020 ("CPRA"), which came into effect on January 1, 2023, expanded the CCPA's requirements, extending it to cover personal information of business representatives and employees and the CPRA established a new regulatory agency to implement and enforce the law. Other states, such as Virginia, Nevada, Connecticut, Utah, Texas, Colorado, Oregon, Montana, Iowa, Indiana, Tennessee, Delaware, and New Jersey, have enacted comprehensive privacy laws that have taken effect or are scheduled to take effect, and similar laws are being considered in several other states, as well as at the federal and local levels, which impose similar obligations to those in the CCPA. Further, other states, such as Nevada and Washington, have enacted privacy laws specifically governing consumer health information, with Washington providing for a private right of action, and additional states are considering similar consumer health information-related laws. Although many of these laws currently exempt certain health-related information, the laws may increase our potential liability related to our data processing activities, complicate our compliance efforts, and increase both legal risk and compliance costs for us and the third parties upon whom we rely. Outside of the United States, there are an increasing number of laws, regulations, and industry standards regarding privacy and data security. For example, the EU General Data Protection Regulation ("GDPR"), the Japanese Act on the Protection of Personal Information, and UK GDPR impose strict requirements on processing personal information. Companies that violate the GDPR may face temporary or permanent bans on certain data processing activities and may be subject to significant penalties, including fines of up to 20 million Euros under the EU GDPR or 17.5 million pounds sterling under the UK GDPR, or 4% of annual global revenue, whichever is greater. In addition, companies may be subject to private litigation relating to processing of personal information, including actions brought by brought by classes of data subjects or consumer protection organizations authorized to represent data subjects' interests. In some circumstances, we may be unable to transfer personal information between certain jurisdictions due to data localization requirements or other limitations on cross-border data flows. The European Economic Area ("EEA"), the UK, Japan, and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal information to other countries. In particular, the EEA and the UK have significantly restricted the transfer of personal information to the United States and other countries whose privacy laws they consider inadequate. Although there are various mechanisms that may be used to transfer personal information from the EEA and UK to the United States in compliance with the law, such as the EEA and UK's standard contractual clauses, and other approved data transfer mechanisms, these mechanisms are subject to legal challenges, and we may be unable to rely on these measures to lawfully transfer personal information to the United States in all cases. If there is no lawful manner for us to transfer personal information from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally compliant transfer are too onerous, we could face significant adverse consequences, including increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors, and other third parties, and injunctions against our processing or transferring of personal information necessary to operate our business. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers of personal information to recipients outside of the EEA for allegedly violating the EU GDPR's cross-border data transfer limitations. Additionally, companies that transfer personal information to recipients outside of the EEA and/or UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Compliance with applicable privacy and data security laws and regulations is a rigorous and time-intensive process, and we may be required to put in place additional mechanisms ensuring compliance with new data protection rules. Failure to comply with any such laws or regulations puts us at risk of facing significant fines and penalties that could adversely affect our business, financial condition, reputation, and results of our operations. Furthermore, conflicting requirements across applicable privacy and data security laws would complicate our compliance efforts and increase both legal risk and compliance costs for us and the third parties upon whom we rely. In addition to any applicable privacy and data security laws and regulations, we may be subject to industry standards adopted by industry groups or bound by other contractual obligations related to privacy and data security. We may publish privacy policies, marketing materials, and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and security. If these policies, materials, or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to regulatory inquiries, regulatory enforcement actions, and other adverse consequences. Our obligations related to privacy and data security are quickly changing, becoming increasingly stringent, and creating regulatory uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent between jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources and may necessitate changes to our information technologies, systems, and practices and to those of any third parties that process personal information or other sensitive data on our behalf. We may at times fail (or be perceived to have failed) in our efforts to comply with our privacy and data security obligations. Moreover, despite our efforts, our personnel or third parties on whom we rely may fail to comply with such obligations, which could negatively impact our business operations. If we or the third parties that process personal information or other sensitive data on our behalf fail, or are perceived to have failed, to address or comply with applicable privacy and data security obligations, we could face significant consequences, including but not limited to government enforcement actions (e.g.,investigations, fines, penalties, audits, and inspections), litigation (including class-action claims), additional reporting requirements and/or oversight, bans on processing personal information, and orders to destroy or not use personal information. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to loss of customers, significant reputational harm, an inability to process personal information or to operate in certain jurisdictions, limited ability to commercialize VYJUVEK or develop and commercialize our product candidates, expenditures of time and resources to defend ourselves against claims or inquiries, adverse publicity, or substantial changes to our business model or operations.