Larimar Therapeutics (LRMR) Risk Analysis

In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, data we collect about trial participants in connection with clinical trials, sensitive third-party data, business plans, transactions, financial information and medical information collected by our patient access management team (collectively, sensitive data). Our data processing activities may subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act (FTCA)), and other similar laws (e.g., wiretapping laws). For example, HIPAA, as amended by HITECH, imposes specific requirements relating to the privacy, security, and transmission of individually identifiable health information. Even when HIPAA does not apply, according to the FTC, failing to take appropriate steps to keep consumers' personal information secure constitutes unfair acts or practices in or affecting commerce in violation of the FTCA. The FTC's current guidance for appropriately securing consumers' personal information is similar to what is required by the HIPAA security regulations, but this guidance may change in the future, resulting in increased complexity and the need to expend additional resources to ensure we are complying with the FTCA. Additionally, in the past few years, numerous U.S. states-including California, Virginia, Colorado, Connecticut, and Utah-have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (CPRA) (collectively, CCPA) requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights. The CCPA provides for fines of up to $7,500 per intentional violation and allows private litigants affected by certain data breaches to recover significant statutory damages. Although some U.S. comprehensive privacy laws exempt some data processed in the context of clinical trials, these laws may increase compliance costs and potential liability with respect to other personal data we may maintain about California residents. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more jurisdictions to pass similar laws in the future. Furthermore, other states have proposed or enacted legislation that is focused on more narrow aspects of privacy. For example, some states have passed laws that protect biometric information and a smaller number of states have passed or are considering laws that are specifically focused upon health privacy, such as Washington's My Health My Data Act. The My Health My Data Act imposes new state restrictions and requirements on the processing and sale of consumer health data and creates a private right of action, which further increases the relevant compliance risk. Connecticut and Nevada have also passed similar laws regulating consumer health data. The effects of state and federal privacy laws are potentially significant and may require us to modify our data processing practices and policies and to incur substantial costs and potential liability in an effort to comply with such legislation. Outside the United States, an increasing number of laws, regulations, and industry standards may govern data privacy and security. For example, the European Union's General Data Protection Regulation (EU GDPR), United Kingdom's GDPR (UK GDPR) (collectively, the GDPR), Brazil's General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or LGPD) (Law No. 13,709/2018), and China's Personal Information Protection Law (PIPL) impose strict requirements for processing personal data. For example, the GDPR imposes numerous obligations on companies, including requirements relating to processing health and other sensitive data, where required obtaining consent of the individuals to whom the personal data relates, having legal bases and/or conditions for processing, requiring disclosures to individuals regarding data processing activities, requiring that safeguards are implemented to protect the security and confidentiality of personal data, responding on individuals' requests to exercise their rights, limiting retention periods for personal data, creating mandatory data breach notification requirements in certain circumstances, requiring that certain measures (including contractual requirements) are put in place when engaging third-party processors, appointing data protection officers, conducting data protection impact assessments, ensuring certain accountability measures are in place and record keeping. Companies that fail to comply with the GDPR may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros under the EU GDPR / 17.5 million pounds sterling under the UK GDPR or 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. The Swiss Federal Act on Data Protection, or the FADP, also applies to the collection and processing of personal data, including health-related information, by companies located in Switzerland, or in certain circumstances, by companies located outside of Switzerland. The FADP has been revised and adopted by the Swiss Parliament. Companies must comply with the revised version of the FADP and its revised ordinances from September 1, 2023, which may result in an increase of costs of compliance, risks of noncompliance and penalties for noncompliance. Although the UK is regarded as a third country under the EU GDPR, the EC has now issued a decision recognizing the UK as providing adequate protection under the EU GDPR and, therefore, transfers of personal data originating in the EU to the UK remain unrestricted. In December 2025, the EC adopted a decision to extend the validity of the UK adequacy decision for six years until December 2031, determining that the UK continues to offer a level of data protection that is "essentially equivalent" to the EU standards. This follows the UK's adoption of the Data (Use and Access) Act 2025 (the "DUAA") on 19 June 2025. The respective provisions and enforcement of the EU GDPR and UK GDPR may further diverge in the future and create additional regulatory challenges and uncertainties. This lack of clarity on future UK laws and regulations and their interaction with EU laws and regulations could add legal risk, complexity and cost to our handling of personal data and our privacy and data security compliance programs and could require us to implement different compliance measures for the UK and the EEA. Like the EU GDPR, the UK GDPR restricts personal data transfers outside the UK to countries not regarded by the UK as providing adequate protection. The UK government has confirmed that personal data transfers from the UK to the European Economic Area (EEA) remain free flowing. In addition, to enable the transfer of personal data outside of the EEA or the UK, adequate safeguards must be implemented in compliance with European and UK data protection laws. There are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA's standard contractual clauses, the UK's International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework ("Framework") and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework). When relying on certain mechanisms, such as the EEA's standard contractual clauses, companies are required to conduct transfer impact assessments. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws. Furthermore, regulators and legislators in the U.S. are increasingly scrutinizing and restricting certain personal data transfers and transactions involving foreign countries. For example, Executive Order 14117, Preventing Access to Americans' Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern, as implemented by Department of Justice regulations issued in December 2024, prohibits data brokerage transactions involving certain sensitive personal data categories, including health data, genetic data, and biospecimens, to countries of concern, including China. The regulations also restrict certain investment agreements, employment agreements and vendor agreements involving such data and countries of concern, absent specified cybersecurity controls. Actual or alleged violations of these regulations may be punishable by criminal and/or civil sanctions and may result in exclusion from participation in federal and state programs. If we are unable to transfer personal data from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including by limiting our ability to conduct clinical trial activities in Europe and elsewhere, the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. In addition to data privacy and security laws, we may be contractually subject to industry standards adopted by industry groups and may become subject to such obligations in the future. We are also bound by other contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. We publish privacy policies, marketing materials, and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and security. If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators, or other adverse consequences. Additionally, under various privacy laws and other obligations, we may be required to obtain certain consents to process personal data. For example, some of our data processing practices may be challenged under wiretapping laws, if we obtain consumer information from third parties through various methods, including chatbot and session replay providers, or via third-party marketing pixels. These practices may be subject to increased challenges by class action plaintiffs. Our inability or failure to obtain consent for these practices could result in adverse consequences, including class action litigation and mass arbitration demands. Obligations related to data privacy and security (and consumers' data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources and may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third parties on whom we rely may fail to comply with such obligations, which could negatively impact our business operations. If we or the third parties on which we rely fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including but not limited to: government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class-action claims) and mass arbitration demands; additional reporting requirements and/or oversight; bans on processing personal data; and orders to destroy or not use personal data. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to loss of customers; inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations.

The FDA and other regulatory agencies strictly regulate the promotional claims that may be made about prescription products, such as nomlabofusp or any potential product candidates, if approved. If we receive marketing approval for nomlabofusp, or any potential product candidates, physicians may prescribe our product candidates to their patients in a manner that is inconsistent with the approved label. If we are found to have promoted such off-label uses, we may become subject to significant liability. The federal government has levied large civil and criminal fines against companies for alleged improper promotion and has enjoined several companies from engaging in off-label promotion and required that they enter into corporate integrity agreements with the Office of Inspector General of the Department of Health and Human Services. The FDA has also requested that companies enter into consent decrees or permanent injunctions under which specified promotional conduct is changed or curtailed. Further, FDA's Office of Prescription Drug Promotion (OPDP) actively scrutinizes promotional communications, including digital and social media; any materials that are false, misleading or promote unapproved uses can lead to enforcement actions and could necessitate corrective communications. In the current administration, the FDA has increased its enforcement scrutiny over prescription drug advertising, particularly direct-to-consumer product promotion and advertising. If the FDA finds any of our promotional communications or advertising to be violative, we may receive an untitled or warning letter, requests for corrective advertising, or fines, amongst other enforcement tools available to the FDA. If we cannot successfully manage the promotion of nomlabofusp or any potential product candidates, if approved, we could become subject to significant liability, which would materially adversely affect our business, financial condition and results of operations.

The commercial potential for our approved products, if any, could be affected by changes in healthcare spending and policy in the United States and abroad. We operate in a highly regulated industry. New laws, regulations or judicial decisions or new interpretations of existing laws, regulations or decisions, related to healthcare availability, the method of delivery or payment for healthcare products and services could adversely affect our business, operations and financial condition. The United States and many foreign jurisdictions have enacted or proposed legislative and regulatory changes affecting the healthcare system that may affect our ability to profitably sell our product and product candidates, if approved. The United States government, state legislatures and foreign governments also have shown significant interest in implementing cost-containment programs to limit the growth of government-paid healthcare costs, including price controls, restrictions on reimbursement and requirements for substitution of generic products for branded prescription drugs. The pharmaceutical industry has been a particular focus of these efforts and has been significantly affected by major legislative initiatives. Previously, in March 2010, the ACA was enacted, which was intended to broaden access to health insurance, reduce or constrain the growth of healthcare spending, enhance remedies against fraud and abuse, add new transparency requirements for health care and health insurance industries, impose new taxes and fees on the health industry and impose additional health policy reforms. Healthcare reform initiatives culminated in the enactment of the IRA, which, among other things, allows HHS to directly negotiate the ceiling price of a statutorily specified number of drugs and biologic each year that CMS reimburses under Medicare Part B and Part D, requires the payment of rebates on Medicare Part B and Part D drugs whose prices have increased at a rate faster than the rate of inflation, and redesign the Medicare Part D cost sharing structure, including revising manufacturer financial liability for covered products. For more information, see the section of this report titled "Business – Healthcare Laws and Regulations – Healthcare Reform." Moreover, the Creating and Restoring Equal Access to Equivalent Samples Act ("CREATES" Act), was enacted in 2019 requiring sponsors of approved new drug applications and biologics license applications to provide sufficient quantities of product samples on commercially reasonable, market-based terms to entities developing generic drugs and biosimilar biological products. The law establishes a private right of action allowing developers to sue application holders that refuse to sell them product samples needed to support their applications. If we are required to provide product samples or allocate additional resources to respond to such requests or any legal challenges under this law, our business could be adversely impacted. We expect that additional federal, state and foreign healthcare reform measures will be adopted in the future, any of which could limit the amounts that federal and state governments will pay for healthcare products and services, which could result in limited coverage and reimbursement and reduced demand for our products, once approved, or additional pricing pressures. The effect of these healthcare reform initiatives on our business and the pharmaceutical industry in general is not yet known, but could be substantial and materially adverse to our ability to successfully commercialize our product candidates at profitable price points.

Healthcare providers, physicians and others will play a primary role in the recommendation and prescription of nomlabofusp or any potential product candidates, if approved. Our future arrangements with third-party payors will expose us broadly to applicable fraud and abuse and other healthcare laws and regulations that may constrain the business or financial arrangements and relationships through which we market, sell and distribute nomlabofusp or potential product candidates, if we obtain marketing approval. In addition, we may be subject to patient privacy regulation by both the federal government and the states or other countries in which we conduct our business. For more information, see the section of this report titled "Business – Healthcare Laws and Regulations – Other Healthcare Laws." Ensuring that our future business arrangements with third parties comply with applicable healthcare laws and regulations could be costly. It is possible that governmental authorities will conclude that our business practices do not comply with current or future statutes, regulations or case law involving applicable fraud and abuse or other healthcare laws and regulations. If our operations, including anticipated activities to be conducted by our sales team, were found to be in violation of any of these laws or any other governmental regulations that may apply to us, we may be subject to significant civil, criminal and administrative penalties, damages, fines and exclusion from government funded healthcare programs, such as Medicare and Medicaid, any of which could substantially disrupt our operations and would materially adversely affect our business, financial condition and results of operations. If any of the physicians or other providers or entities with whom we expect to do business is found not to be in compliance with applicable laws, they may be subject to criminal, civil or administrative sanctions, including exclusions from government funded healthcare programs, which could have a material adverse effect on our business, results of operations, financial condition and prospects.

Before obtaining regulatory approvals for the commercial sale of any product candidate, we must demonstrate through non-clinical testing and clinical trials that the product candidate is safe and effective for use in each target indication. This process can take many years. In addition, approval policies, regulations, or the type and amount of clinical data necessary to gain approval may change during the course of a product candidate's clinical development and may vary among jurisdictions, which may cause delays in the approval of or may result in the decision not to approve our product candidates. We have not obtained regulatory approval for nomlabofusp, and it is possible that this product candidate or any product candidates we may seek to develop in the future will never obtain regulatory approval. If marketing approval is obtained, it will likely include post-marketing studies, and other post-marketing requirements, and could include surveillance such as REMS which will require the expenditure of substantial resources beyond the proceeds we currently have on hand. Furthermore, we are not permitted to market nomlabofusp in the United States, or the European Union until we receive approval of a BLA from the FDA or the grant of an MA from the European Commission, or in any other foreign countries until we receive the requisite marketing approval from such countries. The development of drugs for FA or other rare diseases may require initial non-clinical studies, early and usually smaller, clinical trials and randomized, double-blind placebo controlled long-term safety and efficacy trials in order to test the safety and efficacy of the drug. Development and/or regulatory programs for nomlabofusp in countries (such as a MAA to the EMA) are in earlier stages than in the United States and may require substantial further development in those countries prior to regulatory submissions seeking regulatory approval for marketing. Even after successful completion of clinical trials, there is a risk that the FDA or other regulatory agencies may request further information from us, disagree with our findings or otherwise undertake a lengthy review of our submission. The FDA and certain European regulatory authorities may delay, limit or deny testing or approval of nomlabofusp for many reasons, including, among others: - we may not be able to demonstrate that nomlabofusp is safe and effective to the satisfaction of the FDA or the EMA;- the results of our clinical trials may not meet the level of statistical or clinical significance required by the FDA or the EMA for marketing approval;- the FDA or the EMA may disagree with the number, design, size, duration, conduct or implementation of our clinical trials;- the FDA or the EMA may require that we conduct additional non-clinical studies and/or clinical trials;- the FDA or the EMA may not approve the formulation, manufacturing, labeling or specifications of nomlabofusp;- the CROs that we retain to conduct our clinical trials may take actions outside of our control that materially adversely impact our clinical trials;- the FDA or the EMA may find the data from non-clinical studies and clinical trials insufficient to demonstrate that nomlabofusp's clinical and other benefits outweigh its safety risks;- the FDA or the EMA may disagree with our interpretation of data from our non-clinical studies or clinical trials;- the FDA or the EMA may not accept data generated at our clinical trial sites;- if and when our BLA is submitted, the FDA could require an FDA advisory committee assessment, or the advisory committee may recommend against approval of our application or may recommend that the FDA require, as a condition of approval, additional non-clinical studies or clinical trials, limitations on approved labeling or distribution and use restrictions;- the FDA or the EMA could require development of a REMS as a condition of approval or post-approval, or may not agree with our proposed REMS, or may impose additional requirements, including requirements that limit the promotion, advertising, distribution, or sales of nomlabofusp;- the FDA or the EMA may find deficiencies with or not approve the manufacturing processes or facilities of third-party manufacturers with which we contract; or - the FDA or the EMA may change their approval policies or adopt new regulations rendering our clinical data insufficient for approval. Any of these factors, many of which are beyond our control, could jeopardize our ability to obtain and/or maintain regulatory approval for and successfully market nomlabofusp. Any delay or failure in obtaining required approvals could have a material adverse effect on our business, financial condition and results of operations. This process can take many years and will likely require the expenditure of substantial resources. Of the large number of drugs in development in the United States, only a small percentage will successfully complete the FDA regulatory approval process and be commercialized. It is possible that the FDA or other regulatory agencies will not approve any application that we submit. It is possible that our product candidates may not obtain appropriate regulatory approvals necessary for us to commence clinical trials for our product candidates. Accordingly, even if we are able to obtain the requisite financing to continue to fund our development and clinical trials, we cannot ensure that nomlabofusp, or any other of our potential product candidates will be successfully developed or commercialized.

Regulatory requirements governing biologic drug products are evolving and may continue to change in the future. As a result, it is difficult to determine how long it will take or how much it will cost to obtain regulatory approvals for nomlabofusp for the treatment of FA or any other future protein replacement therapy product candidates in any indication, if at all. Regulatory review agencies and the new requirements and guidelines they promulgate may lengthen the regulatory review process, require us to perform additional or larger studies, increase our development costs, lead to changes in regulatory positions and interpretations, delay or prevent approval and commercialization of our product candidates or lead to significant post-approval studies, limitations or restrictions. Legislative and regulatory proposals have been made to expand post-approval requirements and restrict sales and promotional activities for pharmaceutical products. We cannot be sure whether additional legislative changes will be enacted, or whether FDA regulations, guidance or interpretations will be changed, or what the impact of such changes on the marketing approvals of our product candidates, if any, may be. In addition, increased scrutiny by the U.S. Congress of the FDA's approval process may significantly delay or prevent marketing approval, as well as subject us to more stringent product labeling and post-marketing testing and other requirements. Delays, failure or unexpected costs in obtaining, the regulatory approval necessary to bring our product candidates to market could have a material adverse effect on our business, results of operations, financial condition and prospects. In addition, the clinical trial requirements of the FDA, the EMA and other regulatory authorities and the criteria these regulators use to determine the safety and efficacy of a product candidate vary substantially according to the type, complexity, novelty and intended use and market of such product candidates. The regulatory approval process for novel product candidates such as ours can be more expensive and take longer than for other, better known or more extensively studied product candidates.

We may pursue marketing approval for nomlabofusp in the United States, the European Union and in other jurisdictions worldwide. In order to market any product outside of the United States, we must establish and comply with the numerous and varying safety, efficacy and other regulatory requirements of other jurisdictions, including potential additional clinical trials and/or non-clinical studies. Approval procedures vary among jurisdictions and can involve additional testing and additional administrative review periods. The time required to obtain approvals in other jurisdictions might differ from that required to obtain FDA approval. The marketing approval processes in other jurisdictions may implicate all of the risks detailed above regarding FDA approval in the United States as well as other risks. In particular, in many countries outside of the United States, products must receive pricing and reimbursement approval before the product can be commercialized. Obtaining this approval can result in substantial delays in bringing products to market in such countries. Marketing approval in one jurisdiction does not necessarily ensure marketing approval in another, but a failure or delay in obtaining marketing approval in one country may have a negative effect on the regulatory process or commercial activities in others. Failure to obtain marketing approval in other countries or any delay or other setback in obtaining such approval would impair our ability to market a product candidate in such foreign markets. Any such impairment would reduce the size of our potential market, which could have a material adverse impact on our business, financial condition, results of operations and prospects.

Even if we receive marketing approval for nomlabofusp or a future product candidate, regulatory authorities may still impose significant restrictions on the indicated uses or marketing or impose ongoing requirements for potentially costly post-approval studies. Nomlabofusp or future product candidates will also be subject to ongoing regulatory requirements for manufacturing, labeling, packaging, storage, advertising, promotion, sampling, record-keeping and submission of safety and other post-market information. The FDA has significant post-market authority, including, for example, the authority to require labeling changes based on new safety information and to require post-market studies or clinical trials to evaluate serious safety risks related to the use of a drug. An unsuccessful post-marketing study or failure to complete such a study could result in the withdrawal of marketing approval. Any regulatory approvals that we receive for nomlabofusp may also be subject to a REMS, limitations on the approved indicated uses for which the product may be marketed or to the conditions of approval, or contain requirements for potentially costly post-marketing testing, including post-approval clinical trials, and surveillance to monitor the quality, safety and efficacy of the product, all of which could lead to lower sales volume and revenue. For example, the holder of an approved BLA or NDA is obligated to monitor and report adverse events and any failure of a product to meet the specifications in the BLA or NDA. The holder of an approved BLA or NDA also must submit new or supplemental applications and obtain FDA approval for certain changes to the approved product, product labeling or manufacturing process. Advertising and promotional materials must comply with FDA rules and are subject to FDA review, in addition to other potentially applicable federal and state laws. In addition, product manufacturers and their facilities are subject to payment of user fees and continual review and periodic inspections by the FDA and other regulatory authorities for compliance with cGMP requirements and adherence to commitments made in the BLA or NDA or foreign marketing application. If we, or a regulatory authority, discover(s) previously unknown problems with a product, such as adverse events of unanticipated severity or frequency, or problems with the facility where the product is manufactured or if a regulatory authority disagrees with the promotion, marketing or labeling of that product, a regulatory authority may impose restrictions relative to that product, the manufacturing facility or us, including requiring recall or withdrawal of the product from the market or suspension of manufacturing. If we or our contractors fail to comply with applicable regulatory requirements following approval of nomlabofusp, a regulatory authority may: - issue a warning letter, or untitled letter asserting that we are in violation of the law;- require us to enter into a consent decree, which can include imposition of various fines, reimbursements for inspection costs, required due dates for specific actions and penalties for non-compliance;- request voluntary product recalls;- seek an injunction or impose administrative, civil or criminal penalties or monetary fines;- suspend or withdraw regulatory approval;- suspend any ongoing clinical trials;- refuse to approve a pending BLA or NDA or comparable foreign marketing application (or any supplements thereto) submitted by us;- restrict the marketing or manufacturing of the product;- seize or detain the product or otherwise require the withdrawal of the product from the market;- refuse to permit the import or export of product candidates; or - refuse to allow us to enter into supply contracts, including government contracts. Any government investigation of alleged violations of law could require us to expend significant time and resources in response and could generate negative publicity. The occurrence of any event or penalty described above may inhibit our ability to commercialize nomlabofusp, if approved, and adversely affect our business, financial condition, results of operations and prospects. In addition, the FDA's policies, and those of equivalent foreign regulatory agencies, may change and additional government regulations may be enacted that could prevent, limit or delay regulatory approval of nomlabofusp. We cannot predict the likelihood, nature or extent of government regulation that may arise from future legislation or administrative action, either in the United States or abroad. If we are slow or unable to adapt to changes in existing requirements or the adoption of new requirements or policies, or if we are not able to maintain regulatory compliance, we may lose any marketing approval that we may have obtained and we may not achieve or sustain profitability, which would materially and adversely affect our business, financial condition, results of operations and prospects.

Changes in regulatory requirements, FDA guidance or guidance from EMA or unanticipated events during our non-clinical or clinical trials may force us to terminate or adjust our clinical programs. The FDA, or other applicable regulatory authorities may impose additional clinical trial and/or non-clinical study requirements. Amendments to our clinical trial protocols would require resubmission to the FDA, or the applicable regulatory authorities as well as IRBs and ethics committees for review and approval, which may adversely impact the cost, timing or successful completion of a clinical trial. If we experience delays completing, or if we terminate, any of our clinical trials, or if we are required to conduct additional clinical trials, or non-clinical studies and/or post-market studies, the commercial prospects for nomlabofusp or any other potential product candidates may be harmed and our ability to generate product revenue will be delayed or eliminated, and it would materially adversely affect our business, financial condition and results of operations. In order to market any product outside of the United States, we must comply with numerous and varying regulatory requirements of other countries regarding drug development and commercialization. The approval processes varies from country to country and can involve additional product testing and additional administrative review periods. The time required to obtain approval in other countries might differ from and be longer than that required to obtain FDA approval. Regulatory approval in one country does not ensure regulatory approval in another, but a failure or delay in obtaining regulatory approval in one country may negatively impact the regulatory process in others. Even if we receive marketing approval for nomlabofusp in the United States, we may never receive regulatory approval to market nomlabofusp outside of the United States.

All entities involved in the preparation of therapeutics for clinical trials or commercial sale, including our existing contract manufacturers for nomlabofusp, are subject to extensive regulation. Some components of a finished therapeutic product approved for commercial sale or used in late-stage clinical trials must be manufactured in accordance with cGMP. These regulations govern manufacturing processes and procedures (including record keeping) and the implementation and operation of quality systems to control and assure the quality of investigational products and products approved for sale. Poor control of production processes can lead to the introduction of adventitious agents or other contaminants, or to inadvertent changes in the properties or stability of our product candidates that may not be detectable in final product testing. We or our contract manufacturers must supply all necessary documentation in support of a BLA or NDA on a timely basis and where required, must adhere to the FDA's or other regulator's GLPs and cGMP regulations enforced by the FDA or other regulators through facilities inspection programs. The facilities and quality systems of some or all of our third party contractors must pass a pre-approval inspection for compliance with the applicable regulations as a condition of regulatory approval of nomlabofusp or any of our other potential products. In addition, the regulatory authorities may, at any time, audit or inspect a manufacturing facility involved with the preparation of nomlabofusp or our other potential products or the associated quality systems for compliance with the regulations applicable to the activities being conducted. If these facilities do not pass a pre-approval plant inspection, the FDA or other regulatory approval of the products will not be granted. The regulatory authorities also may, at any time following approval of a product for sale, audit the manufacturing facilities of our third party contractors. If any such inspection or audit identifies a failure to comply with applicable regulations or if a violation of our product specifications or applicable regulations occurs independent of such an inspection or audit, we or the relevant regulatory authority may require remedial measures that may be costly and/or time-consuming for us or a third party to implement and that may include the temporary or permanent suspension of a clinical trial or commercial sales or the temporary or permanent closure of a facility. Any such remedial measures imposed upon us or third parties with whom we contract could materially harm our business. If we or any of our third party manufacturers fail to maintain regulatory compliance, the FDA or other regulators can impose regulatory sanctions including, among other things, refusal to approve a pending application for a biologic product, or revocation of a pre-existing approval. As a result, our business, financial condition and results of operations may be materially harmed. Additionally, if supply from one approved manufacturer is interrupted, there could be a significant disruption in commercial supply. The number of manufacturers with the necessary manufacturing capabilities is limited. In addition, an alternative manufacturer would need to be qualified through a BLA or NDA supplement or similar regulatory submission which could result in further delay. The regulatory agencies may also require additional studies if a new manufacturer is relied upon for commercial production. The delays associated with the verification of a new manufacturer could negatively affect our ability to develop product candidates in a timely manner or within budget. These factors could also cause the delay of manufacturing development, clinical trials, regulatory submissions, required approvals or commercialization of nomlabofusp or any other product candidates, cause us to incur higher costs and prevent us from commercializing our products successfully. Furthermore, if our suppliers fail to meet contractual requirements, and we are unable to secure one or more replacement suppliers capable of production at a substantially equivalent cost, our clinical trials may be delayed, or we could lose potential revenues. Any of the above would materially adversely affect our business, financial condition and results of operations.

The sponsor of an application for a rare pediatric disease drug product may be eligible for a voucher that can be used or sold to obtain a priority review for a subsequent application submitted under section 505(b)(1) of the FDCA or section 351 of the PHS Act. The rare pediatric disease priority review voucher program was reauthorized by Congress. Under current law, after September 30, 2029, the FDA may not award any rare pediatric disease priority review vouchers although the FDA's authority to do so could be extended by Congress in the future. We received rare pediatric disease designation from the FDA for nomlabofusp in 2019. We may, in the future, apply for rare pediatric disease designation from the FDA for future product candidates that may qualify for designation. Vouchers for rare pediatric disease drugs are awarded for qualifying applications if properly requested when the drug receives approval. Although nomlabofusp has received rare pediatric disease designation, nomlabofusp may not receive a priority review voucher for a number of reasons: nomlabofusp may not receive approval; nomlabofusp may receive approval in adults, but not pediatric patients; nomlabofusp may not meet the eligibility requirements for a priority voucher at the time we seek approval for nomlabofusp; or we may not meet the current deadline for receiving a priority review voucher (September 30, 2029), in which case we would not be able to obtain a voucher unless Congress further reauthorizes the program in the future. Finally, a rare pediatric disease designation does not necessarily lead to faster development or regulatory review of the product or increase the likelihood that it will receive marketing approval. If the program is reauthorized and we apply for designation for future product candidates as drugs for rare pediatric diseases, the FDA may not find that those candidates meet the criteria for designation and may not grant the designation. The failure to maintain rare pediatric disease designation for nomlabofusp or if FDA approval does not occur prior to September 30, 2029 could result in the inability to receive a priority review voucher which could adversely affect our business, financial condition and results of operations.

We received orphan drug designation from the FDA for nomlabofusp for the treatment of FA in July 2017. In the United States, orphan drug designation entitles a party to financial incentives such as tax advantages and user-fee waivers. In addition, if a product candidate that has orphan drug designation subsequently receives the first FDA approval for the disease for which it has such designation, the product is entitled to orphan drug exclusivity, which means that the FDA may not approve any other applications, including an NDA or BLA, to market the same drug for the same disease or condition for seven years, except in limited circumstances, including if the FDA concludes that the later drug is clinically superior to the approved drug. A drug is clinically superior if it is safer, more effective, or makes a major contribution to patient care. In the case of a biological product, whether a drug is the same drug is based on the principal molecular structural features of the product. Orphan drug designation neither shortens the development time or regulatory review time of a drug nor gives the drug any advantage in the regulatory review or approval process. Additionally, we may lose orphan drug exclusivity if we are unable to assure sufficient quantity of the drug to meet the needs of patients with the rare disease or condition. Moreover, orphan drug exclusivity may not effectively protect our product candidates from competition because different drugs can be approved for the same condition. Further, even after an orphan drug is approved, the FDA or comparable foreign regulatory authority can subsequently approve another drug for the same condition if such regulatory authority concludes that the later drug is clinically superior, which means that it is shown to be safer, more effective or makes a major contribution to patient care. We have also received orphan designation for nomlabofusp in the European Union. In the European Union, the European Commission may grant orphan designation, following an opinion from the EMA's Committee for Orphan Medicinal Products (COMP), for products intended for the diagnosis, prevention or treatment of a life-threatening or chronically debilitating condition affecting not more than five in 10,000 persons in the European Union. Alternatively, designation may be granted for products intended for the diagnosis, prevention or treatment of a life-threatening, seriously debilitating or serious and chronic condition and where, without incentives, it is unlikely that sales of the drug in the European Union would be sufficient to justify the necessary investment in developing the drug. In each case, orphan designation is only available if there is no other satisfactory method authorized for marketing in the European Union for diagnosing, preventing or treating the condition, or if such a method exists, the proposed orphan product will be of significant benefit to patients over existing options. In the European Union, orphan designation also entitles a party to financial incentives such as reduction of fees and ten years of market exclusivity following the grant of marketing authorization. This period may be reduced to six years if it is determined at the end of the fifth year that the orphan designation criteria are no longer met, including where it is shown that the product is sufficiently profitable such that maintenance of market exclusivity is no longer justified. Loss of orphan drug designation for nomlabofusp or the failure to obtain such designation in other countries or for any future product candidates could adversely affect our business, financial condition and results of operations. If another product has received approval in the indications for which we have received orphan drug designation, we may still receive approval in that indication if we can demonstrate that our product candidate is clinically superior to the existing orphan product. This demonstration of clinical superiority may be done at the time of initial approval or in post-approval studies, depending on the type of marketing authorization granted. Having to comply with these additional requirements to obtain orphan drug exclusivity could adversely affect our business, financial condition and results of operation.

We are targeting to submit a BLA to the FDA in June 2026 to request marketing approval of nomlabofusp. We may not be able to obtain, and there can be no assurance that the FDA will agree that the data submitted in any BLA is adequate to support approval, including accelerated approval. Further, the FDA stated that the adequacy of the safety database will be a matter of review at the time of BLA submission. In particular, the FDA may refuse to accept our planned BLA for substantive review (thereby issuing a "refuse to file" letter) or may conclude after review of our data that our application is insufficient to obtain regulatory approval (thereby issuing a "complete response" letter). If the FDA does not accept or approve our planned BLA, the agency may require that we conduct additional clinical, non-clinical or manufacturing studies before it will reconsider our application. Depending on the extent of these or any other studies required by the FDA, approval of a BLA may be significantly delayed or we may be unable to obtain approval of a BLA because such studies may require us to expend more resources than we have available. It is also possible that additional studies, if performed and completed, may not be considered sufficient by the FDA. For example, if the FDA does accept our BLA for filing, the FDA could determine after review of our BLA that the increases in FXN shown in our clinical trials are not reasonably likely to predict clinical benefit, that the nomlabofusp safety database was not of sufficient size to demonstrate the safety of nomlabofusp or that we otherwise failed to provide information sufficient to approve the nomlabofusp BLA. Moreover, if FDA grants accelerated approval of nomlabofusp, we will be required to conduct a confirmatory study to verify and describe the clinical benefit of nomlabofusp, which may not be completed or which may fail to verify and describe the clinical benefit of nomlabofusp. If the confirmatory study is not successful or if the FDA determines that it does not verify or describe the clinical benefit of nomlabofusp, the FDA may not grant traditional approval and/or the accelerated approval may be withdrawn. If any of these outcomes occurs, we may be forced to abandon ourplanned BLA, which will materially adversely affect our business and could potentially cause us to ceaseoperations. Furthermore, the FDA may approve nomlabofusp for a narrower indication or population than we request or may grant approval contingent on the performance of costly post-marketing commitments beyond our planned confirmatory study. We face similar regulatory risks in foreign jurisdictions.

New income, sales, use or other tax laws, statutes, rules, regulations or ordinances could be enacted at any time, which could affect the tax treatment of any of our future domestic and foreign earnings. Any new taxes could adversely affect our domestic and international business operations, and our business and financial performance. Further, existing tax laws, statutes, rules, regulations or ordinances could be interpreted, changed, modified or applied adversely to us. For example, under Section 174 of the code, in taxable years beginning after December 31, 2021, expenses that are incurred for research and development in the U.S. are capitalized and amortized, which may have an adverse effect on our cash flow. In addition, it is unclear how these U.S. federal income tax changes will affect state and local taxation. Generally, future changes in applicable U.S. tax laws and regulations, or their interpretation and application could have an adverse effect on our business, financial conditions and results of operations.

Provisions in our certificate of incorporation and bylaws may delay or prevent an acquisition or a change in management. These provisions include a classified board of directors, a prohibition on actions by written consent of our stockholders, and the ability of the board of directors to issue preferred stock without stockholder approval. In addition, because we are in Delaware, we are governed by the provisions of Section 203 of the Delaware General Corporation Law ("DGCL") which prohibits stockholders owning in excess of 15% of our outstanding voting stock from merging or combining with us. Although we believe these provisions collectively will provide for an opportunity to receive higher bids by requiring potential acquirers to negotiate with our board of directors, they would apply even if the offer may be considered beneficial by some stockholders. In addition, these provisions may frustrate or prevent any attempts by our stockholders to replace or remove then current management by making it more difficult for stockholders to replace members of the board of directors, which is responsible for appointing the members of management.

We are currently a "smaller reporting company" as defined in the Exchange Act of 1934 and have elected to take advantage of certain of the scaled disclosures available to smaller reporting companies, including simplified executive compensation disclosures in our filings, exemption from the provisions of Section 404(b) of the Sarbanes-Oxley Act requiring that an independent registered accounting firm provide an attestation report on the effectiveness of internal control over financial reporting and certain other decreased disclosure obligations in our SEC filings, including, among other things, only being required to provide two years of audited financial statements in annual reports. Reduced disclosure in our SEC filings due to our status as a smaller reporting company may make it harder for investors to analyze our results of operations and financial prospects. We cannot predict whether investors will find our common stock less attractive because of our reliance on any of these exemptions. If some investors find our common stock less attractive as a result, there may be a less active trading market for our common stock and our stock price may be more volatile.

Entities affiliated with Deerfield Management Company beneficially own or control approximately 36.8% of our outstanding common stock (assuming no exercise of outstanding options and no conversion of Series A Convertible Preferred Stock) as of December 31, 2025. Accordingly, such entities have substantial influence over the outcome of a corporate action by us requiring stockholder approval, including the election of directors, any merger, consolidation or sale of all or substantially all of our assets or any other significant corporate transaction. These stockholders also may exert influence in delaying or preventing a change in control of the combined company, even if such change in control would benefit our other stockholders.

If we fail to satisfy the continued listing requirements of The Nasdaq Stock Market LLC ("Nasdaq") such as the corporate governance requirements or the minimum closing bid price requirement, Nasdaq may take steps to delist our common stock. Such a delisting would likely have a negative effect on the price of our common stock and would impair a stockholders ability to sell or purchase shares of common stock when they wish to do so. In the event of a delisting, we can provide no assurance that any action taken by us to restore compliance with listing requirements would allow the common stock to become listed again, stabilize the market price or improve the liquidity of the common stock, prevent the common stock from dropping below the Nasdaq minimum bid price requirement or prevent future noncompliance with Nasdaq's listing requirements.

Since our inception we have devoted substantially all of our resources to the development of nomlabofusp. We have incurred significant losses in each year of operation since our inception in 2016. For the years ended December 31, 2025 and 2024, we had net losses of $165.7 million and $80.6 million, respectively, and, as of December 31, 2025, we had an accumulated deficit of $434.8 million and we expect to continue to incur significant expenses and net operating losses ("NOLs") for the foreseeable future. We have devoted substantially all of our financial resources and efforts to research and development, including non-clinical studies, our clinical development program, the development of manufacturing processes as well as the manufacture of initial lots of clinical trial material. We expect to incur significant losses for the foreseeable future to further develop and commercialize our lead drug candidate, nomlabofusp. We expect that our expenses will increase substantially if and as we: - continue clinical development efforts for nomlabofusp;- seek regulatory and marketing approvals in the United States and in foreign jurisdictions for our product candidates that successfully complete clinical trials, if any;- establish sales, marketing, distribution and other commercial infrastructure to commercialize various products for which we may obtain marketing approval, if any;- contract for the manufacture of larger quantities of product candidates for clinical development and potentially commercialization;- maintain, expand and protect our intellectual property portfolio;- expand our operational, financial and management systems and hire and retain additional personnel, such as clinical, manufacturing, quality control, regulatory and finance personnel; and - experience any delays or encounter issues with any of the above. We currently have no sales, marketing or medical affairs infrastructure and have no experience in the sales, marketing, or distribution of pharmaceutical products. Assuming nomlabofusp ultimately is approved for marketing in the US and elsewhere, we will need to establish commercial capabilities as well as customer service and support, logistics, and other related functions, or make arrangements with third parties to perform these services. Net losses and negative cash flows have had, and will continue to have, an adverse effect on our liquidity and potentially the ability for us to raise capital due to our unfavorable operating results.

The current expectation is that we will retain our future earnings to fund the development and growth of our business. As a result, capital appreciation, if any, of our common stock will be stockholders' sole source of gain, if any, for the foreseeable future.

We must maintain effective internal control over financial reporting in order to accurately and timely report our results of operations and financial condition. In addition, as a public company, the Sarbanes-Oxley Act requires, among other things, that we assess the effectiveness of our disclosure controls and procedures quarterly and the effectiveness of our internal control over financial reporting at the end of each fiscal year. The rules governing the standards that must be met for our management to assess our internal control over financial reporting pursuant to Section 404 of the Sarbanes-Oxley Act are complex and require significant documentation, testing and possible remediation. These stringent standards require that our audit committee be advised and regularly updated on management's review of internal control over financial reporting. Our management may not be able to effectively and timely implement controls and procedures which respond to the increased regulatory compliance and reporting requirements that are applicable to us as a public company. If we fail to staff our accounting, finance and information technology functions adequately or maintain internal control over financial reporting adequate to meet the demands that are placed upon us as a public company, including the requirements of the Sarbanes-Oxley Act, or to otherwise prevent material weaknesses in internal control over financial reporting, our business and reputation may be harmed and our stock price may decline. Furthermore, investor perceptions of us may be adversely affected, which could cause a decline in the market price of our common stock.

Our development programs and the potential commercialization of our product candidates will require substantial additional cash to fund expenses. For nomlabofusp, and any future product candidates, we may decide to collaborate with pharmaceutical and/or biotechnology companies for the development and potential commercialization of those product candidates in some or all markets. We face significant competition in seeking appropriate collaborators. Whether we reach a definitive agreement for a collaboration for nomlabofusp or other potential product candidates will depend, among other things, upon our assessment of the collaborator's resources and expertise, the terms and conditions of the proposed collaboration and the proposed collaborator's evaluation of a number of factors. Those factors may include the design or results of clinical trials, the likelihood of approval by the FDA or similar regulatory authorities outside the United States, the potential market for the applicable product candidate, the costs and complexities of manufacturing and delivering such product candidate to patients, the potential of competing products, the existence of uncertainty with respect to our ownership of technology, which can exist if there is a challenge to such ownership without regard to the merits of the challenge and industry and market conditions generally. The collaborator may also consider alternative product candidates or technologies for similar indications that may be available to collaborate on and whether such collaboration could be more attractive than the one with us for our product candidate. The terms of any collaboration or other arrangement that we may establish may not be favorable to us. We may also be restricted under existing license agreements from entering into future agreements on certain terms with potential collaborators. Collaborations are complex and time-consuming to negotiate and document. In addition, there have been a significant number of recent business combinations among large pharmaceutical companies that have resulted in a reduced number of potential future collaborators. We may not be able to negotiate collaborations on a timely basis, on acceptable terms, or at all. If we are unable or unwilling to do so, we may have to curtail the development potential product candidates for which we are seeking to collaborate, reduce or delay our development program or one or more of our other development programs, delay potential commercialization in some or all markets or reduce the scope of any sales or marketing activities, or increase our expenditures and undertake development or commercialization activities at our own expense, including potentially increasing our infrastructure and investment outside the United States. If we elect to increase our expenditures to fund development or commercialization activities on our own, we will need to obtain additional capital, which may not be available to us on acceptable terms if at all. If we do not have sufficient funds, we may not be able to further develop our product candidates or bring them to market and generate product revenue. In addition, such efforts may require diversion of a disproportionate amount of our attention away from other day-to-day activities and require devotion of a substantial amount of our time to managing these activities. In addition, any future collaborations that we enter into may not be successful. The success of our collaboration arrangements will depend heavily on the efforts and activities of our collaborators. Collaborators generally have significant discretion in determining the efforts and resources that they will apply to these collaborations. Disagreements between parties to a collaboration arrangement regarding clinical development and commercialization matters can lead to delays in the development process or commercializing the applicable product candidate and, in some cases, termination of the collaboration arrangement. These disagreements can be difficult to resolve if neither of the parties has final decision-making authority. Collaborations with pharmaceutical or biotechnology companies and other third parties often are terminated or allowed to expire by the other party. Any such termination or expiration could adversely affect our business, financial condition, results of operations and could harm our business reputation.

We may acquire additional businesses or products, form strategic alliances or create joint ventures with third parties that we believe will complement or augment our existing business. If we acquire businesses with promising markets or technologies, we may not be able to realize the benefit of such transactions if we are unable to successfully integrate such businesses with our existing operations and company culture. We may encounter numerous difficulties in developing, manufacturing and marketing any new products resulting from a strategic alliance or acquisition that delays or prevents us from realizing their expected benefits or enhancing our business. We cannot be certain that, following any such transaction, we will achieve the expected synergies to justify the transaction and it could adversely affect our business, financial condition and results of operations.

We do not currently have an established infrastructure for the sales, marketing and distribution of biologic or drug products in the United States or foreign countries. In order to market a product candidate, if approved by the FDA or any other regulatory authority, we must build our sales, marketing, managerial and other non-technical capabilities or make arrangements with third parties to perform these services. If we are unable to establish adequate sales, marketing and distribution capabilities, whether independently or with third parties, or if we are unable to do so on commercially reasonable terms, our business, results of operations, financial condition and prospects will be materially adversely affected.