Heart Test Laboratories, Inc. (HSCS) Risk Analysis

In the past, companies that have experienced volatility in the market price of their stock have been subject to securities class action litigation. We may be the target of this type of litigation in the future. Litigation of this type could result in substantial costs and diversion of management's attention and resources, which could seriously hurt our business. Any adverse determination in litigation could also subject us to significant liabilities.

The ability of the FDA to review and clear or approve new products can be affected by a variety of factors, including government budget and funding levels, statutory, regulatory, and policy changes, the FDA's ability to hire and retain key personnel and accept the payment of user fees, and other events that may otherwise affect the FDA's ability to perform routine functions. Average review times at the FDA have fluctuated in recent years as a result. In addition, government funding of other government agencies that fund research and development activities is subject to the political process, which is inherently fluid and unpredictable. Disruptions at the FDA and other agencies may also slow the time necessary for new medical devices or modifications to cleared or approved medical devices to be reviewed and/or approved by necessary government agencies, which would adversely affect our business. For example, in response to the COVID-19 pandemic, in March of 2020 the FDA postponed most inspections of foreign manufacturing and domestic facilities. Although limited inspections were again initiated in 2021, FDA also utilized alternative methods for inspections and could continue to exercise discretion on a case-by-case basis to approve products based on a desk review, particularly for foreign inspections. If a prolonged government shutdown occurs, or if global health concerns continue to prevent or temporarily restrict the FDA or other regulatory authorities from conducting their regular inspections, reviews, or other regulatory activities, it could significantly impact the ability of the FDA to timely review and process our regulatory submissions, which could have a material adverse effect on our business. Regulatory authorities outside the United States may adopt similar restrictions or other policy measures in response to the COVID-19 pandemic. If a prolonged government shutdown occurs, or if global health concerns continue to prevent the FDA or other regulatory authorities from conducting their regular inspections, reviews, or other regulatory activities, it could significantly impact the ability of the FDA or other regulatory authorities to timely review and process our regulatory submissions, which could have a material adverse effect on our business.

In the normal course of business, we will receive health information and other highly sensitive or confidential information and data of patients and other third parties, which we compile and analyze. Our collection and use of this data, including that of our vendors, might raise privacy and data protection concerns, which could negatively impact our business. There are numerous federal, state and international laws and regulations regarding privacy, data protection, information security, and the collection, storing, sharing, use, processing, transfer, disclosure, and protection of personal information and other data, and the scope of such laws and regulations may change, be subject to differing interpretations, and may be inconsistent among countries and regions we intend to operate in (e.g., the United States and the European Union),or conflict with other laws and regulations. The regulatory framework for privacy and data protection worldwide is, and is likely to remain for the foreseeable future, uncertain and complex, and this or other actual or alleged obligations may be interpreted and applied in a manner that we may not anticipate or that is inconsistent from one jurisdiction to another. Further, any significant change to applicable laws, regulations, or industry practices regarding the collection, use, retention, security, or disclosure of data, or any changes regarding the manner in which the consent of relevant users for the collection, use, retention, or disclosure of such data must be obtained, could increase our costs and require us to modify our services and products, possibly in a material manner, which we may be unable to complete, and may limit our ability to store and process patients' data or develop new services and features. In particular, we are subject to U.S. data protection laws and regulations (i.e., laws and regulations that address privacy and data security of personal information) at both the federal and state levels. The legislative and regulatory landscape for data protection continues to evolve, and in recent years there has been an increasing focus on privacy and data security issues. Numerous federal and state laws, including state data breach notification laws, state health information privacy laws, and federal and state consumer protection laws, govern the collection, use, and disclosure of health-related and other personal information. Failure to comply with such laws and regulations could result in government enforcement actions and create liability for us (including the imposition of significant civil or criminal penalties), private litigation and/or adverse publicity that could negatively affect our business. In addition, we expect to obtain health information that is subject to privacy and security requirements under HIPAA and its implementing regulations. The Privacy Standards and Security Standards under HIPAA establish a set of standards for the protection of individually identifiable health information by health plans, health care clearing houses and certain health care providers, referred to as Covered Entities, and the business associates with whom Covered Entities enter into service relationships pursuant to which individually identifiable health information may be exchanged. Notably, whereas HIPAA previously directly regulated only Covered Entities, HITECH makes certain of HIPAA's privacy and security standards also directly applicable to Covered Entities' business associates. As a result, both Covered Entities and business associates are now subject to significant civil and criminal penalties for failure to comply with Privacy Standards and Security Standards. As part of our normal operations, we expect to collect, process and retain personal identifying information regarding patients, including as a business associate of Covered Entities, so we expect to be subject to HIPAA, including changes implemented through HITECH, and we could be subject to criminal penalties if we improperly handle or knowingly obtain or disclose individually identifiable health information in a manner that is not authorized or permitted by HIPAA. A data breach affecting sensitive personal information, including health information, also could result in significant legal and financial exposure and reputational damages that could potentially have an adverse effect on our business. HIPAA requires Covered Entities (like many of our potential customers) and business associates (like us) to develop and maintain policies and procedures with respect to protected health information that is used or disclosed, including the adoption of administrative, physical and technical safeguards to protect such information. HITECH expands the notification requirement for breaches of patient-identifiable health information, restricts certain disclosures and sales of patient-identifiable health information, and provides for civil monetary penalties for HIPAA violations. HITECH also increased the civil and criminal penalties that may be imposed against Covered Entities and business associates and gave state attorneys general new authority to file civil actions for damages or injunctions in federal courts to enforce HIPAA and its implementing regulations and seek attorney's fees and costs associated with pursuing federal civil actions. Additionally, certain states have adopted comparable privacy and security laws and regulations, some of which may be more stringent than HIPAA. In addition, certain state laws govern the privacy and security of health-related and other personal information in certain circumstances, some of which may be more stringent, broader in scope or offer greater individual rights with respect to protected health information than HIPAA, many of which may differ from each other, thus, complicating compliance efforts. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. Failure to comply with these laws, where applicable, can result in the imposition of significant civil and/or criminal penalties and private litigation. For example, California enacted the California Consumer Privacy Act, or CCPA, which creates individual privacy rights for California consumers (as defined in the law), including the right to opt out of certain disclosures of their information, and places increased privacy and security obligations on entities handling certain personal data of consumers or households and may apply to us in the future. The CCPA also creates a private right of action with statutory damages for certain data breaches, thereby potentially increasing risks associated with a data breach. Further, the California Privacy Rights Act, or CPRA, was recently passed in California. The CPRA will impose additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for sensitive data such as health information, and opt outs for certain uses of sensitive data. It will also create a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. The majority of the provisions have gone into effect on January 1, 2023, and additional compliance investment and potential business process changes may be required. The CCPA and CPRA are reflective of a trend toward more stringent privacy legislation in the United States, as other states or the federal government have followed or may follow California's lead and increase protections for U.S. residents. Since California enacted the CCPA, a growing number of states have enacted comprehensive consumer privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Tennessee, Indiana, Iowa, Delaware, New Hampshire, New Jersey, Kentucky, Rhode Island, Minnesota and Maryland, among others, with additional states expected to follow. These laws impose varying obligations on businesses with respect to the collection, use, retention, disclosure and security of personal information, and some include sensitive data, consumer rights, opt-out and risk assessment requirements, creating a complex and evolving patchwork of compliance obligations. The CCPA has already prompted a number of proposals for new federal and state privacy legislation that, if passed, could increase our potential liability, add layers of complexity to compliance in the U.S. market, increase our compliance costs and adversely affect our business. Internationally, many jurisdictions have or are considering enacting privacy or data protection laws or regulations relating to the collection, use, storage, transfer, disclosure and/or other processing of personal data, as well as certification requirements for the hosting of health data specifically. Such laws and regulations may include data hosting, data residency or data localization requirements (which generally require that certain types of data collected within a certain country be stored and processed within that country), data export restrictions, international transfer laws (which prohibitor impose conditions upon the transfer of such data from one country to another), or may require companies to implement privacy or data protection and security policies, enable users to access, correct and delete personal data stored or maintained by such companies, inform individuals of security breaches that affect their personal data or obtain individuals' consent to use their personal data. The General Data Protection Regulation (the "GDPR"), which went into effect in May 2018, imposes stringent requirements for controllers and processors of personal data of individuals within the EEA. As Switzerland and the United Kingdom are not part of the European Union they enforce separate laws governing personal data, which are derived from or directly based on the GDPR. The GDPR applies to any company established in the EEA as well as to those outside the EEA if they collect, process, and use personal data in connection with the offering of goods or services to individuals in the EEA or the monitoring of their behavior. The GDPR, together with national legislation, regulations and guidelines of the EEA countries governing the processing of personal data, impose strict obligations and restrictions on the ability to collect, analyze and transfer personal data, including health data from clinical trials and adverse event reporting. In particular, these obligations and restrictions involve the consent of the individuals to whom the personal data relates, the information provided to the individuals, the transfer of personal data out of the EEA to jurisdictions deemed to have inadequate data protection laws, security breach notifications, security and confidentiality of the personal data and imposition of substantial potential fines for breaches of the data protection obligations. Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance of up to €20 million or 4% of the annual global revenues of the noncompliant company, whichever is greater. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the European Union, or EU, and the United States remains uncertain. In 2016, the EU and United States agreed to a transfer framework for data transferred from the EU to the United States, called the Privacy Shield, but the Privacy Shield was invalidated in July 2020 by the Court of Justice of the European Union, (the "CJEU"). While the CJEU upheld the adequacy of the standard contractual clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism, and potential alternative to the Privacy Shield), it made clear that reliance on them alone may not necessarily be sufficient in all circumstances. Use of the standard contractual clauses must now be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals and additional measures and/or contractual provisions may need to be put in place, however, the nature of these additional measures is currently uncertain. The CJEU went on to state that if a competent supervisory authority believes that the standard contractual clauses cannot be complied with in the destination country and the required level of protection cannot be secured by other means, such supervisory authority is under an obligation to suspend or prohibit that transfer. The European Commission has published revised standard contractual clauses for data transfers from the EEA: the revised clauses must be used for relevant new data transfers from September 27, 2021; existing standard contractual clauses arrangements must have been migrated to the revised clauses by December 27, 2022. If applicable, we would be required to implement the revised standard contractual clauses, in relation to relevant existing contracts and certain additional contracts and arrangements, within the relevant time frames. There is some uncertainty around whether the revised clauses can be used for all types of data transfers, particularly whether they can be relied on for data transfers to non-EEA entities subject to the GDPR. In July 2023, the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework (the "DPF"), which provides a mechanism for transferring personal data from the EEA to participating U.S. organizations that have self-certified to the principles of the DPF. The DPF, like prior transfer frameworks, may be subject to legal challenge or revocation, and our reliance on the DPF, the standard contractual clauses or other transfer mechanisms may not provide certainty for cross-border data transfers and may be subject to additional or evolving requirements. While we implement various measures intended to enable us to comply with applicable privacy or data protection laws, regulations and contractual obligations, these measures may not always be effective and do not guarantee compliance. Any failure or perceived failure by us to comply with our contractual or legal obligations or regulatory requirements relating to privacy, data protection, or information security may result in governmental investigations or enforcement actions, litigation, claims, or public statements against us by consumer advocacy groups or others and could result in significant liability, cause our customers, partners or patients to lose trust in us, and otherwise materially and adversely affect our reputation and business. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, and policies that are applicable to the businesses of our customers or partners may limit the adoption and use of, and reduce the overall demand for, our device. Additionally, if third parties we work with violate applicable laws, regulations, or agreements or suffer data breaches such violations or data breaches may put the data we have received at risk, could result in governmental investigations or enforcement actions, fines, litigation, claims, or public statements against us by consumer advocacy groups or others and could result in significant liability, cause our customers, partners or patients to lose trust in us, and otherwise materially and adversely affect our reputation and business. Further, public scrutiny of, or complaints about, technology companies or their data handling or data protection practices, even if unrelated to our business, industry or operations, may lead to increased scrutiny of technology companies, including us, and may cause government agencies to enact additional regulatory requirements, or to modify their enforcement or investigation activities, which may increase our costs and risks.

Many of our competitors, such as GE Healthcare, Philips and Baxter, have long histories and strong reputations within the industry. These competitors have significantly greater brand recognition, and financial and human resources than we do. They also have more experience and capabilities in researching and developing diagnostic devices, obtaining and maintaining regulatory clearances and other requirements, manufacturing and marketing those products than we do. There is a significant risk that we may be unable to overcome the advantages held by our competition, and our inability to do so could lead to the failure of our business and the loss of your investment. In addition, we may be unable to develop additional products in the future or to keep pace with developments and innovations in the market and lose market share to our competitors. Medical device markets, and more specifically ECG technologies and solutions markets, are competitive, which can lead to, among other things, price reductions, longer selling cycles, lower product margins, loss of market share and additional working capital requirements. To succeed, we must, among other critical matters, gain consumer acceptance for our products as compared to other solutions currently available in the cardiac screening market or advanced cardiac screening offering. For more information regarding risks related to our dependence on physician acceptance, see "- Our success will be dependent upon physician acceptance." If our competitors offer significant discounts on certain products and solutions, we may need to lower our prices or offer other favorable terms in order to compete successfully. Any broad-based changes to our prices and pricing policies could make it difficult to generate revenues or cause our revenues to decline. Moreover, if our competitors develop and market products and solutions that are more effective or desirable than products and solutions than we may develop, we may not convince our customers to use our products and solutions. Any such changes would likely reduce our commercial opportunity and revenue potential and could materially adversely impact our operating results.

Our future growth and profitability largely depend on our ability to increase physician awareness of the MyoVista wavECG device and the MyoVista Insights™ as well as the willingness of hospitals, physicians, patients and/or third-party payors to use it. These parties may not use our products unless they are able to determine, based on experience, clinical data, medical society recommendations and other analyses, that our products are safe, effective and cost-effective, on a stand-alone basis and relative to our competitors' products. If we fail to deliver products that physicians want to use, our revenue potential, financial results and business may be significantly harmed. Even if we are able to deliver a superior device and are able to raise physician awareness of our products through effective marketing, physicians tend to be slow in making changes to their medical treatment practices and may be hesitant to select one of our devices as their preferred diagnostic device for a variety of reasons, including: - long-standing relationships with competing companies and distributors that sell competing devices;- lack of experience with our products and concerns that we are new to market;- lack or perceived lack of sufficient clinical evidence, including long-term data, supporting safety or clinical benefits; and - time commitment and skill development that may be required to gain familiarity and proficiency with our products. Physicians play a significant role in determining the course of a patient's treatment and, as a result, the type of treatment that will be utilized and provided to a patient. We intend to focus our sales, marketing and education efforts on educating cardiologists and any other potential referring physicians. However, if physicians do not perceive our products to be useful and reliable, we may not be able to attract or retain customers.

Our products do not currently have coverage and reimbursement approved for third-party payor coverage or reimbursement. Such reimbursement, if and when approved, will vary based on the identity of the third-party. Our ability to successfully launch sales of our products into the U.S. and achieve market acceptance of our products depends, in significant part, on the availability of adequate financial coverage and reimbursement from third-party payors, including governmental payors (such as the Medicare and Medicaid programs in the U.S.), managed care organizations and private health insurers. Third-party payors decide which treatments they will cover and then establish reimbursement rates for those treatments. If approved and successfully marketed, we expect that our products may be used by hospitals and other providers who will then seek reimbursement from third-party payors for the use of our products and, in many cases, the decision whether or not to purchase our products will be dependent upon whether or not such purchaser will be able to seek reimbursement. Increasingly, third-party payors are also examining the cost effectiveness of products, in addition to their safety and efficacy, when making coverage and payment decisions. Third-party payors have also instituted initiatives to limit the growth of healthcare costs using, for example, price regulation or controls and competitive pricing programs. Some third-party payors also require demonstrated superiority, on the basis of randomized clinical trials, or pre-approval of coverage, for new or innovative devices before they will reimburse healthcare providers who use such devices. Additionally, there is no uniform policy for coverage and reimbursement in the U.S., and coverage and reimbursement can differ significantly from payor to payor. Third-party payors often rely upon Medicare coverage policy and payment limitations in setting their own reimbursement rates, but also have their own methods and approval process apart from the Medicare coverage determination process. It is uncertain whether our products will be viewed as sufficiently cost effective to warrant coverage and adequate reimbursement levels for use in any given jurisdiction. We expect to engage with the American Medical Association, or AMA, and American College of Cardiology to gain approval for use of the standard ECG reimbursement coding for the conventional ECG functions of the MyoVista wavECG device. We will also seek to have private third-party payors provide reimbursement for the use of our proprietary AI-ECG algorithms. We cannot assure you that these efforts will be successful in obtaining third-party payor reimbursement. The lack of reimbursement from third-party payors would have an adverse effect on our revenues, which could have an adverse effect on our business, financial condition and results of operations. Reimbursement systems in international markets vary significantly by country and, within some countries, by region and reimbursement approvals must be obtained on a country-by-country or a region-by-region basis. In certain international markets, a product must be approved for reimbursement before it can be approved for sale in that country. Furthermore, many international markets have government-managed healthcare systems that control reimbursement for new devices. In most markets, there are private insurance systems as well as government-managed systems. For more information regarding the process of receiving reimbursement approval, please see "Business-Market Strategy-Reimbursement."

Advertising and promotion of our future products that obtains approval in the United States may be heavily scrutinized by the FDA, the DOJ, HHS, state attorneys general, members of Congress, and the public. In addition, advertising and promotion of any future product that obtains approval outside of the United States will be heavily scrutinized by comparable foreign regulatory authorities. We expect that, if cleared or approved, our products will also be cleared by the requisite regulatory authorities for specific indications. We expect to train our marketing personnel and direct sales force to not promote our products for uses outside of the FDA-approved indications for use, known as "off-label uses." Physicians may use our devices off-label, when in the physician's independent professional medical judgment, he or she deems it appropriate as the FDA does not restrict or regulate a physician's choice of treatment within the practice of medicine. There may be increased risk of injury to patients if physicians attempt to use our devices off-label. Furthermore, the use of our devices for indications other than those approved by the FDA or approved by any foreign regulatory body may not effectively treat such conditions, which could harm our reputation in the marketplace among healthcare providers and patients. If the FDA or any state or foreign regulatory body determines that our promotional materials or training constitute promotion of an off-label use, it could request that we modify our training or promotional materials or subject us to regulatory or enforcement actions, including the issuance or imposition of a warning letter, an untitled letter, which is used for violators that do not necessitate a warning letter, injunction, seizure, civil fine or criminal penalties, which could have an adverse impact on our reputation and financial results. It is also possible that other federal, state or foreign enforcement authorities might take action under other regulatory authority, such as false claims laws, if they consider our business activities to constitute promotion of an off-label use, which could result in significant penalties, including, but not limited to, criminal, civil and administrative penalties, damages, fines, disgorgement, exclusion from participation in government healthcare programs and the curtailment or restructuring of our operations. We may become subject to such actions and, if we are not successful in defending against such actions, those actions may have a material adverse effect on our business, financial condition and results of operations. Equivalent laws and potential consequences exist in foreign jurisdictions. In addition, if our devices are cleared or approved, healthcare providers may misuse our devices or use improper techniques if they are not adequately trained, potentially leading to injury and an increased risk of product liability. If our devices are misused or used with improper technique, we may become subject to costly litigation by our customers or their patients. Product liability claims could divert management's attention from our core business, be expensive to defend and result in sizeable damage awards against us that may not be covered by insurance.

Our business is subject to risks arising from changes in domestic and global economic conditions, including adverse economic conditions in the markets in which we operate, which may harm our business. Factors such as geopolitical events (including the ongoing war in Ukraine, the military conflict in Israel and Gaza, disruptions to commercial shipping in the Red Sea, and trade tensions between the United States and other countries, including the imposition of new tariffs), inflationary pressures, impacts from the COVID-19 pandemic, and the U.S. election cycles have contributed to economic volatility. Recently, among other effects, volatile economic conditions have caused high levels of inflation, increases in interest rates by central banks with the intent of slowing inflation, and a reduction of available capital following increased interest rates. These global economic conditions could result in a variety of risks to our business, including difficulty in raising funding from capital markets. Such impacts would materially and adversely affect our financial condition, liquidity and the value of our securities. Further, if our future customers significantly reduce spending in areas in which our technology and products are utilized, or prioritize other expenditures over our technology and products, our business, financial condition, results of operations and prospects would be materially adversely affected. Disruption to the global economy could also result in a number of follow-on effects on our business, including a possible slow-down resulting from lower customer expenditures; inability of customers to pay for products on time, if at all; more restrictive export regulations which could limit our potential customer base; negative impact on our liquidity, financial condition and share price, which may impact our ability to raise capital in the market, obtain financing and secure other sources of funding in the future on terms favorable to us. In addition, the occurrence of catastrophic events, such as war, hurricanes, storms, earthquakes, tsunamis, floods, medical epidemics and other catastrophes that adversely affect the business climate in any of our markets could have a material adverse effect on our business, financial condition and results of operations. Some of our operations are located in areas that may be in the future, susceptible to such occurrences.

We plan to conduct business outside of the U.S. which will therefore subject us to a number of risks, including, but not limited to, conflicting and changing laws and regulations such as privacy regulations, tax laws, export and import restrictions, employment laws, regulatory requirements and other governmental approvals, permits and licenses. Since we anticipate conducting business outside of the U.S., we anticipate that we will be subject to rules and regulations in non-U.S. jurisdictions. In some countries, pricing may be subject to governmental control under certain circumstances. In these countries, pricing negotiations with governmental agencies can take considerable time after the receipt of marketing approval for a medical device. To obtain reimbursement or pricing approval in some countries, we may be required to conduct a clinical trial that compares the cost-effectiveness of our products to other available products. If reimbursement of our products is unavailable or limited in scope or amount, or if pricing is set at unsatisfactory levels, we may be unable to achieve or sustain profitability.

We may face risks related to health epidemics and pandemics or other outbreaks of communicable diseases. The spread of an infectious disease, such as COVID-19, may also result in the inability of our manufacturers to deliver components or finished products on a timely basis and may also result in the inability of our suppliers to deliver the parts required by our manufacturers to complete manufacturing of components or finished products. In addition, governments may divert spending from other budgeted resources as they seek to reduce and/or stop the spread of pandemics. Such events may result in a period of business and manufacturing disruption, and in reduced operations, any of which could materially affect our business, financial condition and results of operations. While the potential economic impact brought by the pandemic may be difficult to assess or predict, it has already caused, and is likely to result in further, significant disruption of global financial markets which may reduce our ability to access capital either at all or on favorable terms. In addition, a recession, depression or other sustained adverse market event resulting from pandemics could materially and adversely affect our business and the value of our Common Stock.