Profound Medical (PROF) Risk Analysis

Our products are regulated as medical devices in the United States and other jurisdictions. We and our products are subject to extensive regulation in the United States and elsewhere, including by the FDA and its foreign counterparts. The FDA and foreign regulatory agencies regulate, among other things, with respect to medical devices: design, development and manufacturing; testing, labeling, content and language of instructions for use and storage; clinical trials; product safety; establishment registration and device listing; marketing, sales and distribution; pre-market clearance, classification and approval; record keeping procedures; advertising and promotion; recalls and field safety corrective actions; post-market surveillance, including reporting of deaths or serious injuries and malfunctions that, if they were to recur, could lead to death or serious injury; post-market approval trials; and product import and export. The regulations to which we are subject are complex and have tended to become more stringent over time. Regulatory changes could result in restrictions on our ability to carry on or expand our operations, higher than anticipated costs or lower than anticipated sales. The FDA enforces its regulatory requirements through, among other means, periodic announced or unannounced inspections. We do not know whether we or our contract manufacturers will be found substantially compliant with applicable regulations in connection with any future FDA inspections. Failure to comply with applicable regulations could jeopardize our ability to sell our authorized products, or obtain marketing authorization for any of our product candidates, and could result in enforcement actions such as: warning letters; fines; injunctions; civil penalties; termination of distribution; recalls or seizures of products; delays in the introduction of products into the market; total or partial suspension of production; refusal to grant future clearances or approvals; withdrawals or suspensions of clearances or approvals, resulting in prohibitions on sales of our products; and in the most serious cases, criminal penalties.

Our products are subject to rigorous regulation by the FDA and numerous other federal, state and foreign governmental authorities and Notified Bodies. The process of obtaining FDA clearances or approvals, or equivalent third country authorizations to market a medical device can be costly and time consuming, and we may not be able to obtain these clearances or approvals on a timely basis, if at all. In the United States, before we can market a new medical device, or a new use of, or other significant modification to an existing, marketed medical device, we must first receive either clearance under Section 510(k) of the FFDCA, approval of a PMA or grant of a De Novo classification request from the FDA, unless an exemption applies. In the 510(k) clearance process, before a device may be marketed, the FDA must determine that a proposed device is substantially equivalent to a legally marketed predicate device. To be substantially equivalent, the proposed device must have the same or similar intended use as the predicate device, and either have the same technological characteristics as the predicate device or have different technological characteristics and not raise different questions of safety or effectiveness from the predicate device. In the process of obtaining PMA approval, the FDA must determine that a proposed device is safe and effective for its intended use based, in part, on extensive data, including, but not limited to, technical, preclinical, clinical trial, manufacturing and labeling data. The PMA process is typically required for devices that are deemed to pose the greatest risk, such as life sustaining, life supporting or implantable devices. In the De Novo classification process, a manufacturer whose novel device under the FDA would otherwise be automatically classified as class III and require the submission and approval of a PMA prior to marketing is able to request initial classification of the device as class I or class II based on evidence that the device in fact presents a low or moderate risk. If the FDA grants the De Novo classification request, the applicant receives authorization to market the device. If the De Novo process results in the classification of a device as class II, the authorized device may be used subsequently as a predicate device for future 510(k) submissions. The PMA approval, 510(k) clearance and De Novo classification processes can be expensive, lengthy and uncertain. The FDA's 510(k) clearance process can take anywhere from three to 12 months or longer to complete. The process of obtaining PMA approval or De Novo classification is much more costly and uncertain than the 510(k) clearance process and generally takes from one to three years, or even longer, from the time the application is submitted to the FDA. In addition, PMAs and De Novo classification requests generally require the applicant to have conducted one or more clinical trials. Despite the time, effort and cost expended in seeking a marketing authorization, there is no assurance that the FDA will grant it. Any delay or failure to obtain necessary regulatory marketing authorizations could harm our business. Furthermore, even if we are granted such marketing authorizations, they may include significant limitations on the indicated uses for the device, which may limit the potential commercial market for the device. The FDA or foreign regulatory authorities can delay, limit or deny marketing authorization or certification of a device for many reasons, including: - our inability to demonstrate to the satisfaction of the FDA or the applicable regulatory authorities that our products are safe and effective for their intended uses;- the disagreement of the FDA or foreign regulatory authorities with the design or implementation of our clinical trials or the interpretation of data from non- clinical studies or clinical trials;- serious and unexpected adverse device effects experienced by subjects enrolled in our clinical trials;- the data from our nonclinical studies and clinical trials may be insufficient to support marketing authorization, where required;- our inability to demonstrate that the clinical and other benefits of the device outweigh the risks;- the manufacturing process or facilities we use may not meet applicable requirements; and - the potential for approval policies or regulations of the FDA or foreign regulatory authorities to change significantly in a manner rendering our clinical data or regulatory filings insufficient for marketing authorization. We expect to generate a significant portion of our revenues from sales of our marketed systems, in particular our FDA-cleared TULSA-PRO system, but may be unable to do so if the systems do not continue to prove to be safe and effective for our intended use in clinical trials to the satisfaction of the relevant regulatory authorities in the United States, EU Member States, China or other countries. In addition, no assurance can be given that our other product candidates will prove to be sufficiently safe and effective in clinical trials or that we will receive regulatory approvals in the jurisdictions where we seek to market the systems. In addition, no assurance can be given that current regulations relating to regulatory approval will not change or become more stringent. Any delay in, or failure to receive or maintain, regulatory clearance or approval of other products under development would adversely affect our ability to commercialize those products, thereby adversely affecting operations and could prevent us from generating revenue from these products or achieving profitability. Any failure to obtain regulatory clearance or approval would materially adversely affect our business, financial condition and results of operations.

On May 25, 2017, the EU Medical Devices Regulation 2017/745, or the MDR, entered into force, repealing and replacing Council Directive 93/42/EEC, or the Medical Devices Directive, and Council Directive 90/385/EEC, or the AIMD Directive. Unlike directives, which must be implemented into the national laws of the EU member states, regulations are directly applicable (i.e., without the need for adoption of EU member state laws implementing them) in all EU member states from their effective applicability date and are intended to eliminate differences in the regulation of medical devices among EU member states. The New EU MDR, among other things, is intended to establish a uniform, transparent, predictable and sustainable regulatory framework across the EU for medical devices and ensure a high level of safety and health while supporting innovation. The New EU MDR became effective on May 26, 2021. Devices lawfully placed on the market pursuant to the MDD prior to May 26, 2021 could initially continue to be made available on the market or put into service until May 26, 2025. Nevertheless, the European Parliament adopted legislation to extend this transitional period to give manufacturers more time to switch from the previously applicable provisions to the new certification requirements for medical devices as laid down by the New EU MDR. For high risk, class III and class IIb implantable devices the transitional period was extended until December 31, 2027. For medium and low risk, class IIb devices and class IIa, Im, Is and Ir devices the transition period was extended until December 31, 2028. The New EU MDR among other things: - Strengthens the rules on placing devices on the market and reinforces surveillance once they are available;- Establishes explicit provisions on manufacturers' responsibilities for the follow-up of the quality, performance and safety of devices placed on the market;- Improves the traceability of medical devices throughout the supply chain to the end-user or patient through a unique identification number;- Sets up a central database to provide patients, healthcare professionals and the public with comprehensive information on products available in the EU; and - Strengthens the rules for the assessment of certain high-risk devices, which may have to undergo an additional check by experts before they are placed on the market. These modifications may have an effect on the way we design and manufacture product and products candidates and conduct our business in the EU and EEA. For example, as a result of the transition towards the new regime, Notified Body review times have lengthened, and product introductions or modifications could be delayed or canceled, which could adversely affect our ability to grow our business. Although our TULSA-PRO and Sonalleve systems have been certified under the MDD as class IIb devices, and are therefore eligible to remain on the EU market until the extended deadline of December 31, 2028, we are evaluating the implementation of the new requirements of the New EU MDR. We cannot exclude unexpected regulatory hurdles and possible delays while transitioning towards the new regime. The EU-UK Trade and Cooperation Agreement, or TCA, came into effect on January 1, 2021. The TCA does not specifically refer to medical devices. However, as a result of Brexit, the New EU MDR will not be implemented in the UK, and previous legislation that mirrored the New EU MDR in UK law has been revoked. The regulatory regime for medical devices in the United Kingdom will continue to be based on the requirements derived from current EU legislation, and the United Kingdom may choose to retain regulatory flexibility or align with the New EU MDR going forward. CE markings will continue to be recognized in the United Kingdom, and certificates issued by EU-recognized Notified Bodies will be valid in the United Kingdom, until the earlier of June 30, 2028 or the expiration of the certificate for devices compliant with the MDD or until June 30, 2030 for devices compliant with the New EU MDR. For medical devices placed on the UK market after this period, the UK Conformity Assessed, or UKCA, marking will be mandatory. In contrast, UKCA marking and certificates issued by UK Notified Bodies will not be recognized on the EU market. The TCA does provide for cooperation and exchange of information in the area of product safety and compliance, including market surveillance, enforcement activities and measures, standardization related activities, exchanges of officials, and coordinated product recalls (or other similar actions). For medical devices that are locally manufactured but use components from other countries, the "rules of origin" criteria will need to be reviewed. Depending on which countries products will be ultimately sold in, manufacturers may start seeking alternative sources for components if this would allow them to benefit from no tariffs. Under the Windsor Framework, an agreement between the UK government and the European Commission, the rules for placing medical devices on the Northern Ireland market differ from those in the United Kingdom. These modifications may have an effect on the way we design and manufacture products and we conduct our business in these countries.

Devices such as our TULSA-PRO and Sonalleve systems currently on the market in the EU that have been granted a CE Mark under the MDD, will need to be re-evaluated and re-certified in accordance with the New EU MDR. Any modification to an existing CE Marked medical device will also require review and certification under the New EU MDR. As many CE Mark certifications will become void as part of the transition to the New EU MDR, Notified Bodies must certify medical devices in accordance with the requirements of the New EU MDR. The New EU MDR requires a re-designation of the Notified Bodies, the organizations designated by the EU member state in which they are based that are responsible for assessing whether medical devices and manufacturers of medical devices meet the applicable regulatory requirements in the EU. To be re-designated, Notified Bodies must demonstrate increased technical expertise in their scope of designation, as well as improved quality management systems. This re-designation process has caused backlogs in the assessment of medical devices and medical device manufacturers during the transition period leading up to May 26, 2021, the effective date of the MDR. In the European Union, currently 50 Notified Bodies have been re-designated, including one for Belgium. To be able to continue to place our CE Marked devices on the EU market, if we decide to do so, such products must be re-certified under the New EU MDR before the applicable extended deadline of December 31, 2028. The re-certification requires us to present documentation and other evidence demonstrating that the performance and the safety of the system has been maintained and that the system continues to meet existing regulations and standards. Otherwise, the marketing and sale of our TULSA-PRO and Sonalleve systems in EU member states may be temporarily or permanently prohibited. Significant modifications to the our authorized products, if any, will require certification under the New EU MDR and cannot be implemented during the extended transition period. The overall backlogs experienced by the Notified Bodies having already been re-designated might have a negative impact on the re-certification of our TULSA-PRO and Sonalleve systems. We believe, however, that we are on track to meet the new requirements by the deadlines set forth in the New EU MDR. Any third-party entities that we rely upon for distribution of our products in the EU must also comply with applicable requirements of the New EU MDR. If a distributor in the EU fails to meet such requirements, on a timely basis or at all, the marketing and sale of our authorized products by such distributor may be temporarily or permanently prohibited. Any delay or failure to comply with the New EU MDR could result in the sale of our authorized products being temporarily or permanently prohibited in EU member states and may affect our reputation, business, financial condition, results of operations and prospects.

We have developed and maintain a quality management system for medical devices intended to ensure quality of our products and activities. The system is designed to be in compliance with regulations in many different jurisdictions, including the QSR, and the new QMSR effective as of February 2, 2026, mandated by the FDA in the United States and the requirements of the MDD and New EU MDR in the European Union, including the international standard ISO 13485 required by the member states in Europe that recognize the CE Mark. Compliance with regulations for quality management systems for medical device companies is time consuming and costly, and there are changes in such regulations from time to time. While management believes that we are compliant with existing quality management system regulations for medical device companies as of the date of this Annual Report, it is possible that we may be found to be noncompliant with new or existing regulations in the future. In addition, we may be found to be noncompliant as a result of future changes in, or interpretation of, the regulations for quality systems. If we do not achieve compliance or subsequently become noncompliant, the regulatory authorities may require that we take appropriate action to address nonconformance issues identified in a regulatory audit, and may, if we do not take such corrective actions in a timely manner, withdraw marketing clearance, or require product recall or take other enforcement action. Our external vendors must, in general, also comply with the applicable quality system requirements. Any of our external vendors may become noncompliant with the applicable quality system regulations, which could result in enforcement action by regulatory authorities, including, for example a Warning Letter from the FDA or a requirement to withdraw from the market or suspend distribution, or export or use of products manufactured by one or more of our vendors. If we or our contract manufacturers fail to comply with such laws and regulations where we would intend to market our products, we could be subject to enforcement action including recall of our device, withdrawal of approval, authorization, certification or clearance and civil and criminal penalties. If any of these events occur, it may materially and adversely affect our business, financial condition, results of operations and prospects.

Certain modifications to our products may require the submission of new 510(k) premarket notifications, PMA supplements, or other regulatory agency approval applications or documents. If a modification is implemented to address a safety concern, we may also need to initiate a recall or cease distribution of the affected device. The FDA can review a manufacturer's decision not to submit a new 510(k) premarket notification, PMA supplement or PMA for a modification and may disagree. The FDA may also on its own initiative determine that clearance of a new 510(k) or approval of a new PMA submission is required. We may make additional modifications to our products in the future that we believe do not or will not require clearance of a new 510(k) or approval of a new PMA. If we begin manufacture and distribution of the modified devices and the FDA later disagrees with our determination and requires the submission of a new 510(k) or PMA for the modifications, we may also be required to recall the distributed modified devices and to stop distribution of the modified devices until we have received approval or clearance for the modified device, which could have an adverse effect on our business. If the FDA does not clear or approve the modified devices, we may need to redesign the devices, which could also harm our business. When a device is marketed without a required clearance or approval, the FDA has the authority to take informal enforcement actions such as the issuance of a Warning Letter, or bring a formal enforcement action, including injunction, seizure and criminal prosecution. The FDA considers formal enforcement actions generally when there is a serious risk to public health or safety or the company's corrective and preventive actions are inadequate to address the FDA's concerns. Where we determine that modifications to our products require clearance of a new 510(k) or approval of a new PMA or PMA supplement, we may not be able to obtain those additional clearances or approvals for the modifications or additional indications in a timely manner, or at all. For those products sold in the EEA, we must notify an EU Notified Body, if significant changes are made to the products or if there are substantial changes to our quality assurance systems affecting those products. Delays in obtaining required future clearances or approvals would adversely affect our ability to introduce new or enhanced products in a timely manner, which in turn would harm its future growth. Additionally, such changes could mean we would no longer be able to rely on existing MDD CE Marks under the transition periods and would need to obtain a CE Mark under the New EU MDR.

Our contract manufacturers must comply with applicable FDA, EU, Health Canada and other applicable foreign regulations, which include quality control and quality assurance requirements, as well as the corresponding maintenance of records and documentation and manufacture of devices according to the specifications contained in the applicable regulatory file. The manufacturing practices of our third-party suppliers are subject to ongoing regulation and periodic inspection. In the United States, the methods used in, and the facilities used for, the manufacture of medical devices must comply with the QSR, and starting on February 2, 2026 the new QMSR, which is a complex regulatory scheme that covers the procedures and documentation of the design, testing, production, process controls, quality assurance, labeling, packaging, handling, storage, distribution, installation, and servicing of medical devices. Furthermore, we will be required to verify that our suppliers maintain facilities, procedures and operations that comply with our quality standards and applicable regulatory requirements. The FDA enforces the QSR/QMSR through periodic announced or unannounced inspections of medical device manufacturing facilities, which may include the facilities of subcontractors. Our authorized device products also subject to similar state regulations and various laws and regulations of other countries governing manufacturing. If our contract manufacturers do not or cannot comply with these requirements, our ability to commercialize our approved products may be adversely affected. The introduction of new or alternative manufacturers or suppliers also may require manufacturing or design changes to our products that are subject to FDA and other regulatory clearances or approvals. Similarly, in the European Union, the introduction of new or alternative manufacturers or suppliers could be considered to constitute a substantial change to our quality system or result in design changes to our products which could affect compliance with the Essential Requirements for the Notified Body's certificate under the MDD (which continues to be valid during the transition period) and with the General Safety and Performance Requirements once a Notified Body certificate under the New EU MDRs is required. If a substantial change is made to a device relying on an MDD certificate it will no longer benefit from the transition period set out in the New EU MDR. In this case the product would need to be CE marked under the New EU MDR to be placed on the market. Once CE marked under the New EU MDR these changes must be disclosed to our Notified Body in the EU before implementation. The Notified Body will then assess the changes and verify whether they affect the product's conformity with the General Safety and Performance Requirements. If the assessment is favorable the Notified Body will issue a new CE Certificate of Conformity or an addendum to the existing certificates attesting compliance with the General Safety and Performance Requirements. We may also be required to assess the new manufacturer's compliance with all applicable regulations and guidelines, which could further impede our ability to manufacture our products in a timely manner. As a result, we could incur increased production costs, experience delays in deliveries of our products, suffer damage to our reputation, and experience a material adverse effect on our business, financial condition, and results of operations.

The governments and regulatory authorities in the United States, the European Union, Canada and other markets in which we expect to sell our devices may propose and adopt new legislation and regulatory requirements relating to medical product approval criteria, manufacturing and marketing requirements. In addition, regulations and guidance promulgated by the FDA, the European Commission, Health Canada, and other regulatory bodies are often revised or reinterpreted by the agency and other relevant regulatory bodies in ways that may significantly affect our business and products. It is impossible to predict whether legislative changes will be enacted or regulations, guidance or interpretations changed and what the impact of such changes, if any, may be. Such legislation or changes in regulatory requirements, or the failure to comply with such, could adversely impact our operations and could have a material adverse effect on our business, financial condition and results of operations. In the United States, there have been and continue to be a number of legislative initiatives to contain healthcare costs. Federal and state lawmakers regularly propose and, at times, enact legislation that would result in significant changes to the healthcare system, some of which are intended to contain or reduce the costs of medical products and services. Future legislative and regulatory proposals to further reform healthcare or reduce healthcare costs may prevent, limit or delay regulatory authorization of our product candidates or coverage or reimbursement for such product candidates, if approved, or even lower reimbursement for the procedures associated with the use of such product candidates. More broadly, such future legislation or regulation may materially impact the ability of the FDA and other regulatory agencies to operate as they have historically operated. The cost containment measures that payors and providers are instituting and the effect of any healthcare reform initiative implemented in the future could impact our revenue from the sale of our products. We cannot be sure whether additional legislative changes will be enacted, or whether any of the FDA's regulations, guidances or interpretations will be changed, or what the impact of such changes on the agency and its scientific review staff, if any, may be. In December 2022, the U.S. Congress enacted the Consolidated Appropriations Act for 2023, an omnibus appropriations bill, which included amendments to the FDDCA under the Food and Drug Omnibus Reform Act of 2022, or FDORA. In addition to the requirement that sponsors of pivotal trials submit diversity action plans for pivotal trials (see "Government Regulation-Regulatory Landscape in the United States-Device Clinical Studies"), FDORA included new requirements for cyber devices, defined as any medical device that is or includes software that is validated, installed, or authorized by the manufacturer; can connect to the internet; and may be vulnerable to cybersecurity threats. Under the FDORA amendments to the DFDCA, any application for marketing authorization of the cyber device must include a software bill of materials and a cybersecurity plan describing the methods by which the manufacturer will monitor, identify and address cybersecurity vulnerabilities. Any failure by a cyber device manufacturer to comply with applicable cybersecurity requirements is considered a violation of the FDDCA and will subject the manufacturer to enforcement actions and possibly legal sanctions. The growth of overall healthcare costs as a percentage of gross domestic product in many countries means that governments and payers are under intense pressure to control healthcare spending even more tightly. As a result, our businesses and the healthcare industry in general are operating in an ever more challenging environment with very significant pricing pressures. In recent years, national, federal, provincial, state and local officials and legislators have proposed, or are reportedly considering proposing, a variety of price-based reforms to the healthcare systems in the United States, the European Union and other countries. Some proposals include measures that would limit or eliminate payments for certain medical procedures and treatments or subject pricing to government control. In addition, proposed legislation may limit access to healthcare insurance coverage, which could reduce the volume of medical procedures involving our authorized device products. Furthermore, in certain foreign markets, the pricing or profitability of healthcare products is subject to government controls and other measures that have been prepared by legislators and government officials. While we cannot predict whether any such legislative or regulatory proposals or reforms will be adopted, the adoption of any such proposals or reforms could adversely affect the commercial viability of our existing and potential products. In addition, any changes of, or uncertainty with respect to, coverage or reimbursement rates relating to our authorized products, or procedures involving such products, could affect demand for our products, which in turn could impact our ability to successfully commercialize our authorized products and have a material adverse effect on our business, financial condition and results of operations.

Existing and proposed changes in the laws and regulations affecting public companies may cause us to incur increased costs as we evaluate the implications of new rules and responds to new requirements. Failure to comply with the new rules and regulations could result in enforcement actions or the assessment of other penalties. The new laws and regulations could make it more difficult to obtain certain types of insurance, including directors' and officers' liability insurance, and we may be forced to accept reduced policy limits and coverage or incur substantially higher costs to obtain the same or similar coverage. The impact of these events could also make it more difficult for us to attract and retain qualified persons to serve on our Board, or as executive officers. We may be required to hire additional personnel and utilize additional outside legal, accounting and advisory services, all of which could cause our general and administrative costs to increase beyond what we currently have planned. Although we intend to evaluate and monitor developments with respect to these rules, we cannot predict or estimate the amount of the additional costs we may incur or the timing of such costs.

Our business is subject to the FCPA, which generally prohibits U.S. companies and their officers, directors and employees from giving, promising, offering or authorizing, directly or indirectly, any payments or anything of value to foreign officials for the purpose of obtaining or retaining business or directing business to any company or person, by securing an improper advantage, influencing any act or decision by a foreign official in their official capacity, or inducing a foreign official to do or omit to do something in violation of their lawful duty. The FCPA also requires issuers to maintain accurate books and records and adequate internal controls. In addition, we are subject to anti-bribery laws of the nations in which we conduct business (e.g., Bribery Act 2010 in the United Kingdom, Articles 299a and 299b of the German Criminal Code specifically addressing bribery in the healthcare sector, the Corruption of Foreign Public Officials Act in Canada and laws adopted pursuant to the Organisation for Economic Co-operation and Development Convention on Combating Bribery of Foreign Public Officials in International Business Transactions). If our employees or our agents are found to have engaged in prohibited conduct under our policies and procedures, or under the FCPA or other anti-bribery laws to which we may be subject, we could suffer severe penalties and other consequences that may have a material adverse effect on our business, financial condition and results of operations. Our operations may be directly or indirectly affected by various broad United States or foreign healthcare fraud and abuse laws. For example, healthcare laws and regulations in the United States may constrain the business or financial arrangements and relationships through which we research, market, sell and distribute any authorized products or product candidates. In particular, the United States federal Anti-Kickback Statute prohibits any person from knowingly and willfully offering, paying, soliciting or receiving remuneration, directly or indirectly, in return for or to induce the referring, ordering, leasing, purchasing or arranging for or recommending the ordering, purchasing or leasing of an item or service, for which payment may be made under United States federal healthcare programs, such as the Medicare and Medicaid programs. A person or entity does not need to have actual knowledge of the statute or specific intent to violate it to have committed a violation. This statute has been interpreted to apply to arrangements between device manufacturers on one hand and prescribers and purchasers on the other. For example, the United States government has sought to apply the Anti-Kickback Statute to device manufacturers' financial relationships with physician consultants. Among other theories, the United States government has alleged that some such relationships are payments to induce the consultants to arrange for or recommend the ordering, purchasing or leasing of the manufacturers' products by the hospitals, medical institutions and other entities with whom they are affiliated. Although there are a number of statutory exemptions and regulatory safe harbors protecting certain common activities from prosecution or other regulatory sanctions, the exemptions and safe harbors are drawn narrowly, and arrangements that involve remuneration that could induce prescribing, purchases, or recommendations may be subject to government scrutiny if they do not qualify for an exemption or a safe harbor. The False Claims Act imposes criminal and civil penalties against individuals or entities for, among other things, knowingly presenting, or causing to be presented false or fraudulent claims for payment by a federal government program or making a false statement or record material to payment of a false claim or avoiding, decreasing or concealing an obligation to pay money to the federal government. The government may assert that a claim including items or services resulting from a violation of the federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the federal False Claims Act. Suits filed under the False Claims Act can be brought by the United States government or they can be brought by an individual on behalf of the United States government, as "qui tam" actions, and such individuals, commonly known as "whistleblowers," may share in any damages paid by the entity to the United States government in fines or settlement. When an entity is determined to have violated the False Claims Act, it may be required to pay up to three times the actual damages sustained by the United States government, plus civil penalties of up to approximately $25,000 for each separate false claim. Various states have also enacted laws modeled after the False Claims Act. The U.S. federal Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH"), imposes criminal and civil liability on any person who knowingly and willfully executes, or attempts to execute, a scheme to defraud any healthcare benefit program or obtain, by means of false or fraudulent pretenses, representations or promises, any of the money or property owned by, or under the custody or control of, any healthcare benefit program, regardless of the payor (e.g., public or private) and knowingly and willfully falsifying, concealing or covering up by any trick or device a material fact or making any materially false, fictitious, or fraudulent statements or representations in connection with the delivery of, or payment for, healthcare benefits, items or services relating to health care matters. In addition, HIPAA and HITECH impose obligations, including mandatory contractual terms, with respect to safeguarding the privacy, security and transmission of individually identifiable health information on certain health care providers, health plans, and health care clearinghouses, known as covered entities, as well as their respective business associates, individuals and entities that perform services on their behalf that involve the use or disclosure of individually identifiable health information and their subcontractors that use, disclose or otherwise process such information. The U.S. federal transparency requirements under the Physician Payments Sunshine Act require manufacturers of FDA-authorized drugs, devices, biologics and medical supplies covered by Medicare or Medicaid to report, on an annual basis, to the Centers for Medicare and Medicaid Services information related to payments and other transfers of value to physicians, certain advanced non-physician healthcare practitioners, and teaching hospitals as well as ownership and investment interests held by physicians and their immediate family members. Additionally, we are subject to U.S. state and foreign equivalents of each of the healthcare laws and regulations described above, among others, some of which may be broader in scope and may apply regardless of the payor. Many U.S. states have adopted laws similar to the federal Anti-Kickback Statute and False Claims Act, and may apply to our business practices, including, but not limited to, research, distribution, sales or marketing arrangements and claims involving health care items or services reimbursed by non-governmental payors, including private insurers. In addition, certain U.S. states require medical device companies to comply with the device industry's voluntary compliance guidelines and the relevant compliance guidance promulgated by the federal government in addition to requiring device manufacturers to report information related to payments to physicians and other healthcare providers or marketing expenditures. Efforts to ensure that our business arrangements with third parties will comply with applicable healthcare laws and regulations will involve substantial costs. It is possible that governmental authorities will conclude that our business practices, including our financial arrangements with physicians, some of whom receive compensation in the form of stock options, which could be viewed as influencing the purchase of or use of our products in procedures they perform and may not comply with current or future statutes, regulations or case law involving applicable fraud and abuse or other healthcare laws and regulations. Any action brought against us for violations of these laws or regulations, even if successfully defended, could cause us to incur significant legal expenses and divert our management's attention from the operation of our business. We may be subject to private qui tam actions brought by individual whistleblowers on behalf of the federal or state governments, with potential liability under the federal False Claims Act including mandatory treble damages and significant per-claim penalties. If our operations are found to be in violation of any of these laws or any other governmental regulations that may apply to us, we may be subject to significant civil, criminal and administrative penalties, damages, fines, imprisonment, exclusion of products from government funded healthcare programs, such as Medicare and Medicaid, and the curtailment or restructuring of our operations. If any of the physicians or other healthcare providers or entities with whom we expect to do business is found to be not in compliance with applicable laws, they may be subject to criminal, civil or administrative sanctions, including exclusions from government funded healthcare programs. Any of the foregoing consequences will negatively affect our business, financial condition and results of operations.

We and our current and potential collaborators may be subject to federal, state and foreign data protection laws and regulations (i.e., laws and regulations that address privacy and data security). In the United States, numerous federal and state laws and regulations, including federal health information privacy laws (e.g., HIPAA as amended by HITECH), state data breach notification laws, state health information privacy laws and federal and state consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), that govern the collection, use, disclosure and protection of health-related and other personal information could apply to our operations or the operations of our collaborators. In particular, HIPAA imposes requirements on certain healthcare providers, health plans and healthcare clearinghouses, or "covered entities," as well as their business associates that perform services for them that involve the use or disclosure of individually identifiable health information, called protected health information ("PHI"), under HIPAA, relating to the privacy and security of PHI, including the use of mandatory contractual terms, or Business Association Agreements, in some circumstances, as well as privacy and security standards and breach notification requirements. We may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy and security requirements under HIPAA, as amended by HITECH, or other privacy and data security laws. Depending on the facts and circumstances, we could be subject to criminal penalties if we knowingly obtain, use, or disclose PHI maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA. However, determining whether PHI has been handled in compliance with applicable privacy standards and our contractual obligations can be complex and may be subject to changing interpretation. We are not subject to HIPAA, but our customers, research collaborators and others in the United States with whom we do business are. Accordingly, we must ensure that any business arrangements that we have with covered entities are structured to comply with HIPAA and ensure that we have the authority to obtain any PHI that may be disclosed to us. If we are unable to properly protect the privacy and security of PHI or other personal, sensitive, or confidential information in our possession, we could be found to have breached our contracts. Further, if we fail to comply with applicable privacy laws, including applicable HIPAA privacy and security standards, we could face significant administrative, civil and criminal penalties. Enforcement activity can also result in financial liability and reputational harm, and responses to such enforcement activity can consume significant internal and outside resources. Furthermore, state attorneys general are authorized to bring civil actions seeking either injunctions or damages in response to violations that threaten the privacy of state residents. In addition to the risks associated with enforcement activities and potential contractual liabilities, our ongoing efforts to comply with evolving laws and regulations at the federal and state level may be costly and require ongoing modifications to our policies, procedures and systems. Many state laws govern the privacy and security of personal information and data in specified circumstances, many of which differ from each other in significant ways, are often not pre-empted by HIPAA, and may have a more prohibitive effect than HIPAA, thus complicating compliance efforts. For example, the California Confidentiality of Medical Information Act ("CMIA") imposes restrictive requirements regulating the use and disclosure of health information and other personally identifiable information. In addition to fines and penalties imposed upon violators, some of these state laws also afford private rights of action to individuals who believe their personal information has been misused. California's patient privacy laws, for example, provide for penalties of up to $250,000 and permit injured parties to sue for damages. In addition to the CMIA, in 2018, California enacted the California Consumer Privacy Act ("CCPA") which creates new individual privacy rights for California consumers (as defined in the law) and places increased privacy and security obligations on entities handling personal data of consumers or households. The CCPA requires covered companies to provide new disclosure to consumers about such companies' data collection, use and sharing practices, provide such consumers new ways to opt-out of certain sales or transfers of personal information, and provide consumers with additional causes of action. While there is currently an exception for PHI that is subject to HIPAA and clinical trial regulations, as currently written, the CCPA may impact our business activities. In addition, the California Privacy Rights Act ("CPRA") was recently enacted to strengthen elements of the CCPA and became effective on January 1, 2023. A number of other states have either enacted their own omnibus privacy laws or continued to deliberate and introduce similar privacy law proposals. These privacy laws may impact our business activities and exemplify the vulnerability of our business to the evolving regulatory environment related to personal data. In the European Union, we may be subject to the General Data Protection Regulation ("GDPR") which went into effect in May 2018 and which imposes obligations on companies that operate in our industry with respect to the processing of personal data and the cross-border transfer of such data. The GDPR applies to any company established in the EEA and to companies established outside the EEA that process personal data in connection with the offering of goods or services to data subjects in the EEA or the monitoring of the behavior of data subjects in the EEA. The GDPR establishes stringent requirements applicable to the processing of personal data, including strict requirements relating to the validity of consent of data subjects, expanded disclosures about how personal data is used, requirements to conduct data protection impact assessments for "high risk" processing, limitations on retention of personal data, special provisions affording greater protection to and requiring additional compliance measures for "special categories of personal data" including health and genetic information of data subjects, mandatory data breach notification (in certain circumstances), "privacy by design" requirements, and direct obligations on service providers acting as processors. The GDPR also prohibits the international transfer of personal data from the EEA to countries outside of the EEA unless made to a country deemed to have adequate data privacy laws by the European Commission or a data transfer mechanism has been put in place. If we or our partners' or service providers' privacy or data security measures fail to comply with the GDPR requirements, we may be subject to litigation, regulatory investigations, enforcement notices requiring us to change the way we use personal data and/or fines of up to 20 million Euros or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher, as well as compensation claims by affected individuals, negative publicity, reputational harm and a potential loss of business and goodwill. The GDPR may also impose additional compliance obligations relating to the transfer of data between us and our affiliates, collaborators, or other business partners. On July 10, 2023, the European Commission adopted an adequacy decision for a new mechanism for transferring data from the EU to the United States – the EU-US Data Privacy Framework (the "Framework"). The Framework provides EU individuals with several new rights, including the right to obtain access to their data, or obtain correction or deletion of incorrect or unlawfully handled data. The adequacy decision followed the signing of an executive order introducing new binding safeguards to address points raised by the Court of Justice of the European Union in a July 2020 decision that invalidated the previous EU-US data transfer framework. Notably, the new obligations were geared to ensure that data can be accessed by U.S. intelligence agencies only to the extent necessary and proportionate and to establish an independent and impartial redress mechanism to handle complaints from Europeans concerning the collection of their data for national security purposes. The Commission will continually review developments in the U.S. along with its adequacy decision. Adequacy decisions can be adapted or even withdrawn in the event of developments affecting the level of protection in the applicable jurisdiction. Future actions of EU data protection authorities are difficult to predict. Some patients or other service providers may respond to these evolving laws and regulations by asking us to make certain privacy or data-related contractual commitments that we are unable or unwilling to make. This could lead to the loss of current or prospective patients or other business relationships. Relatedly, following the United Kingdom's withdrawal from the European Union (i.e., Brexit), and the expiry of the Brexit transition period, which ended on December 31, 2020, the European Union GDPR has been implemented in the United Kingdom (as the "UK GDPR"). The UK GDPR sits alongside the UK Data Protection Act 2018 which implements certain derogations in the European Union GDPR into United Kingdom law. Under the UK GDPR, companies not established in the UK but who process personal data in relation to the offering of goods or services to individuals in the UK, or to monitor their behavior will be subject to the UK GDPR – the requirements of which are (at this time) largely aligned with those under the EU GDPR and as such, may lead to similar compliance and operational costs with potential fines of up to £17.5 million or 4% of global turnover.