Palvella Therapeutics (PVLA) Risk Analysis

The use of our product candidates in clinical trials, and the sale of any of our product candidates for which we obtain regulatory approval, exposes us to the risk of product liability claims. Product liability claims might be brought against us by consumers, healthcare providers, pharmaceutical companies or others selling or otherwise coming into contact with our products. For example, we may be sued if any product candidate we develop allegedly causes injury or is found to be otherwise unsuitable during clinical testing, manufacturing, marketing or sale. Any such product liability claims may include allegations of defects in manufacturing, defects in design, a failure to warn of dangers inherent in the product, negligence, strict liability or a breach of warranties. Claims could also be asserted under state consumer protection acts. If we cannot successfully defend ourselves against these claims, we will incur substantial liabilities or be required to limit development or commercialization of our product candidates for which we obtain regulatory approval. Even successful defense would require significant financial and management resources. Regardless of merit or eventual outcome, product liability claims may result in: - loss of revenue from decreased demand for our product candidates, if approved;- impairment of our business reputation or financial stability;- costs of related litigation;- substantial monetary awards to patients or other claimants;- exhaustion of any available insurance and our capital resources;- diversion of management attention;- withdrawal of clinical trial participants and potential termination of clinical trial sites or entire clinical programs;- the inability to commercialize our product candidates, if approved;- significant negative media attention;- decrease in our stock price; or - initiation of investigations, and enforcement actions by regulators; and product recalls, withdrawals, revocation of approvals, or labeling, marketing or promotional restrictions. We currently hold $5.0 million in product liability insurance coverage in the aggregate, which may not be adequate to cover all liabilities that we may incur. We may need to increase our insurance coverage as we initiate additional clinical trials. We will need to further increase our insurance coverage if we commence commercialization of any of our product candidates for which we obtain marketing approval. Insurance coverage is increasingly expensive. We may not be able to maintain insurance coverage at a reasonable cost or in an amount adequate to satisfy any liability that may arise. On occasion, large judgments have been awarded in class action lawsuits based on therapeutics that had unanticipated side effects. Our insurance policies also have various exclusions, and we may be subject to a product liability claim for which we have no coverage. A successful product liability claim or series of claims brought against us could cause our stock price to fall and, if judgments exceed our insurance coverage, could decrease our cash and adversely affect our business and our prospects.

Our information security systems and internal computer systems and those of our CROs and other contractors and consultants are vulnerable to damage from computer viruses, unauthorized access, natural disasters, terrorism, war, and telecommunication and electrical failures. Like other companies in our industry, we, and our third party vendors, have experienced threats and cybersecurity incidents relating to our information technology systems and infrastructure. If such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our product candidate development and, if such product candidates are approved, commercialization programs. Additionally, our business processes personal data, including some data related to health. When conducting clinical trials, we face risks associated with collecting trial participants' data, especially health data, in a manner consistent with applicable laws and regulations. Attempts to disrupt or gain unauthorized access to our and our third-party vendors' information systems from malicious third parties or insider threats may incorporate widely varying and frequently changing tactics, which may be enhanced or facilitated by artificial intelligence. We also face risks inherent in handling large volumes of data and in protecting the security of such data. We could be subject to attacks on our systems by outside parties or fraudulent, inadvertent, or other inappropriate behavior by our service providers and/or insider employees. Third parties may also gain access to the company's systems using stolen or inferred credentials, computer malware, denial-of-service attacks, ransomware viruses, spamming, social engineering fraud (including phishing attacks) or other means to threaten or compromise the security, confidentiality, integrity and availability of systems and information, and unauthorized third-parties may use such access to obtain personal data. A successful cyberattack could result in theft, destruction or misuse of intellectual property, data, or other misappropriation of assets, or otherwise compromise our confidential or proprietary information and disrupt our operations. We rely on our third-party service providers to implement effective security measures and identify and correct for any such failures, deficiencies, vulnerabilities, compromises, cybersecurity incidents or data breaches. We also rely on our employees and consultants to safeguard their security credentials and follow our policies and procedures regarding use and access of computers and other devices that may contain protected information and our sensitive information. If we, our third-party providers, or our employees and consultants fail to maintain or protect our information technology systems, infrastructure and data integrity effectively or fail to anticipate, plan for or manage significant disruptions to our information technology systems and infrastructure, we or our third-party providers could have difficulty preventing, detecting and controlling cyberattacks. Cyberattacks generally are increasing in their frequency, sophistication and intensity, and have become increasingly difficult to detect. Although we devote resources designed to protect our information systems and infrastructure, we realize that cyberattacks are a threat, and there can be no assurance that our efforts will prevent or adequately address information security compromises, cybersecurity incidents or data breaches that would result in business, legal, financial or reputational harm to us, or would have a material adverse effect on our results of operations and financial condition. Any failure to prevent or mitigate cybersecurity incidents, data breaches, or other security compromises could require us to notify relevant stakeholders (including affected individuals, investors and regulators), and subject us to individual or consumer class action litigation and governmental investigations and proceedings by federal, state and local regulatory entities in the United States and by international regulatory entities, resulting in exposure to material civil and/or criminal liability. As our operations and business grow, we may become subject to or affected by new or additional data protection laws and regulations and face increased scrutiny or attention from regulatory authorities, including various domestic and international privacy and security regulations. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our privacy and data security obligations. Further, although we maintain cyber liability insurance, this insurance may not provide adequate coverage against potential liabilities related to any experienced cybersecurity incident or data breach. The legislative and regulatory landscape for privacy and data protection continues to evolve. In the United States, numerous states have adopted privacy and security laws and regulations that may be more stringent than applicable federal law. These state laws allow for statutory fines for noncompliance. For example, California enacted the California Consumer Privacy Act of 2018 ("CCPA"), which creates individual privacy rights for California consumers and increases the privacy and security obligations of entities handling certain personal data. The CCPA requires covered companies to provide certain disclosures to consumers about its data collection, use and sharing practices, and to provide affected California residents with ways to opt-out of certain sales or transfers of personal information. While there is currently an exception for protected health information that is subject to HIPAA, as currently written, the CCPA may impact our business activities. In addition, the California Privacy Rights Act of 2020 ("CPRA"), which went into effect on January 1, 2023, imposes additional obligations on companies covered by the legislation and significantly modifies the CCPA, including by expanding consumers' rights with respect to certain sensitive personal information. The CPRA also creates a new state agency that is vested with authority to implement and enforce the CCPA and CPRA. Following California's lead, similar laws have been passed in numerous other states, including Virginia, Colorado, Connecticut, New Jersey, New Hampshire and other states have proposed such laws. While these laws incorporate many similar concepts to those in the CCPA and CPRA, there are also several key differences in the scope, application, and enforcement of the law that will change the operational practices of regulated businesses. The new laws will, among other things, impact how regulated businesses collect and process personal sensitive data, conduct data protection assessments, transfer personal data to affiliates, and respond to consumer rights requests. There are also states that are specifically regulating health information. For example, Washington's My Health My Data Act, which became effective on March 31, 2024, regulates the collection and sharing of health information and has a private right of action, which further increases the relevant compliance risk. Connecticut and Nevada have also passed similar laws regulating consumer health data. In addition, other states have proposed and/or passed legislation that regulates the privacy and/or security of certain specific types of information. For example, a small number of states have passed laws that regulate biometric data specifically. The existence of a patchwork of privacy laws in different states will make our compliance obligations more complex and costly and may increase the likelihood that we may be subject to enforcement actions or otherwise incur liability for noncompliance. We may also in the future be subject to data protection laws and regulations of other jurisdictions, such as the EU's GDPR, which provides data subjects with certain rights and requires organizations to adopt technical and organizational safeguards to protect personal data. At the federal level, failing to take appropriate steps to keep consumers' personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act, 15 U.S.C § 45(a). The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business and the cost of available tools to improve security and reduce vulnerabilities. Regulators and legislators in the U.S. are also increasingly scrutinizing and restricting certain personal data transfers and transactions involving foreign countries. For example, the Department of Justice's January 8, 2025, rule on "Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons," prohibits data brokerage transactions involving certain sensitive personal data categories, including health data, genetic data, and biospecimens, to countries of concern, including China. The regulations also restrict certain investment agreements, employment agreements and vendor agreements involving such data and countries of concern, absent specified cybersecurity controls. Actual or alleged violations of these regulations may be punishable by criminal and/or civil sanctions, and may result in exclusion from participation in federal and state programs. All of these evolving compliance and operational requirements impose significant costs, such as costs related to organizational changes, implementing additional protection technologies, training employees and engaging consultants and legal advisors, which are likely to increase over time. In addition, such requirements may require us to modify our data processing practices and policies, utilize management's time and/or divert resources from other initiatives and projects. Any failure or perceived failure by us to comply with any applicable federal, state or foreign laws and regulations relating to data privacy and security could result in damage to our reputation, as well as proceedings or litigation by governmental agencies or other third parties, including class action privacy litigation in certain jurisdictions, which would subject us to significant fines, sanctions, awards, injunctions, penalties or judgments. Any of the foregoing could have a material adverse effect on our business, financial condition, results of operations and prospects.

Our ability to compete in the highly competitive pharmaceuticals industry depends upon our ability to attract and retain highly qualified managerial, scientific, medical, sales and marketing and other personnel. We are highly dependent on our management and scientific personnel, including Wesley H. Kaupinen, our Chief Executive Officer, Matthew Korenberg, our Chief Financial Officer, Kathleen Goin, our Chief Operating Officer, Jeffrey Martini Ph.D., our Chief Scientific Officer, and Ashley Kline, our Chief Commercial Officer. The loss of the services of any of these individuals could impede, delay or prevent the successful development of our product candidates and otherwise negatively impact our ability to successfully implement our business plan. If we lose the services of any of these individuals, we might not be able to find suitable replacements on a timely basis or at all, and our business could be harmed as a result. We maintain "key person" insurance only for our Chief Executive Officer. Our employment agreement with Mr. Kaupinen may be terminated immediately by us for cause or by Mr. Kaupinen with good reason, or upon thirty days' notice if terminated for any other reason. In order to retain valuable employees at our company, in addition to salary and cash incentives, we provide stock options that vest over time. The value to employees and key consultants of stock options that vest over time will be significantly affected by movements in our stock price that are beyond our control and may at any time be insufficient to counteract offers from other companies. We might not be able to attract or retain qualified management and other key personnel in the future due to the intense competition for qualified personnel among biotechnology, pharmaceutical and other businesses, particularly in the eastern Pennsylvania area where we are headquartered. We could have difficulty attracting experienced personnel to our company and may be required to expend significant financial resources in our employee recruitment and retention efforts. Many of the other pharmaceutical companies with whom we compete for qualified personnel have greater financial and other resources, different risk profiles and longer histories in the industry than we do. They also may provide more diverse opportunities and better chances for career advancement. If we are not able to attract and retain the necessary personnel to accomplish our business objectives, we may experience constraints that will harm our ability to implement our business strategy and achieve our business objectives. In addition, we have scientific and clinical advisors who assist us in formulating our development and clinical strategies. These advisors are not our employees and may have commitments to, or consulting or advisory contracts with, other entities that may limit their availability to us. In addition, our advisors may have arrangements with other companies to assist those companies in developing products or technologies that may compete with us.

As to any of our product candidates that become available by prescription only, our success will depend on the availability of coverage and adequate reimbursement for our product from third-party payors. Because there are currently no products approved for the treatment of microcystic LM, cutaneous VMs, clinically significant angiokeratomas or DSAP, the pricing and reimbursement of our product candidates, if approved, is uncertain. Novel medical products, if covered at all, may be subject to enhanced utilization management controls designed to ensure that the products are used only when medically necessary. Such utilization management controls may discourage the prescription or use of a medical product by increasing the administrative burden associated with our prescription or creating coverage uncertainties for prescribers and patients. Moreover, our target patient populations are small, as a result of which the pricing and third-party payor reimbursement of our product candidates, if approved, must be adequate to support commercial infrastructure. Eligibility for reimbursement does not imply that a medical product will be paid for in all cases or at a rate that covers our costs, including research, development, manufacture, sale and distribution. If we are unable to obtain adequate levels of reimbursement, our ability to successfully market and sell our product candidates will be adversely affected. Patients who are prescribed medicine for the treatment of their diseases generally rely on third-party payors to reimburse all or part of the costs associated with their prescription drugs. The availability of coverage and adequate reimbursement from governmental healthcare programs, such as Medicare and Medicaid, and private third-party payors is critical to new product acceptance. If any of our product candidates fail to demonstrate attractive efficacy and safety profiles, they may not qualify for coverage and reimbursement. Even if we obtain coverage for a given product, the resulting reimbursement payment rates might not be adequate, particularly given the small patient populations for our targeted indications, or may require co-payments that patients find unacceptably high. Patients are unlikely to use our products unless coverage is provided and reimbursement is adequate to cover a significant portion of the cost of our products. In addition, third-party payors, whether foreign or domestic, or governmental or commercial, are developing increasingly sophisticated methods of controlling healthcare costs. In addition, in the United States, although private third-party payors tend to follow Medicare, no uniform policy of coverage and reimbursement for drug products exists among third-party payors. Therefore, coverage and reimbursement for drug products can differ significantly from payor to payor. As a result, the coverage determination process is often a time-consuming and costly process that will require us to provide scientific and clinical support for the use of our product candidates to each payor separately, with no assurance that coverage and adequate reimbursement will be obtained. We believe that future coverage and reimbursement will likely be subject to increased restrictions in both the United States and in international markets. Third-party coverage and reimbursement for any of our product candidates for which we may receive regulatory approval may not be available or adequate in either the United States or international markets, which could materially adversely affect our business, financial condition, results of operations and prospects.

The pharmaceutical and biotechnology industries are characterized by rapidly advancing technologies, intense competition and a strong emphasis on proprietary products. We face and will continue to face competition from many different sources, including major pharmaceutical, specialty pharmaceutical and biotechnology companies, academic institutions, government agencies and public and private research organizations that conduct research, seek patent protection and establish collaborative arrangements for research, development, manufacturing and commercialization. In addition, some of the market demand for topical rapamycin or pitavastatin may be satisfied by state-licensed compounding pharmacies lawfully operating under Section 503A of the FDCA. Although such pharmacies will be unable to compound any drug that is essentially a copy of QTORIN rapamycin or QTORIN pitavastatin, if approved, a compounded product would not be considered a copy of QTORIN rapamycin or QTORIN pitavastatin if there were a difference between the FDA-approved and commercially available product and the compounded product that was made for an individual patient and which the prescribing practitioner determines produces a significant difference for that patient. Physicians may determine that such a significant difference exists for some or all of their patients and may choose to prescribe compounded rapamycin or pitavastatin because, if QTORIN rapamycin or QTORIN pitavastatin is approved, it would be a component of an FDA-approved drug product. In addition, if the FDA-approved drug product is not commercially available and thus added to the FDA's published drug shortage list, compounders also would be able to copy it without the necessity of noting a significant difference between the compounded formulation and the FDA-approved drug. In the event compounders engage in the compounding of rapamycin or pitavastatin products if FDA approval of QTORIN rapamycin or QTORIN pitavastatin is obtained, we could be subject to significant competition from compounding pharmacies that prepare those compounded formulations. The companies against which we may compete may have significantly greater financial resources and expertise in research and development, manufacturing, preclinical testing, conducting clinical trials, obtaining regulatory approvals and marketing approved products than we do. These competitors also compete with us in recruiting and retaining qualified scientific and management personnel and establishing clinical trial sites and patient registration for clinical trials, as well as in acquiring technologies complementary to, or necessary for, our programs. Our commercial opportunity could be reduced or eliminated if our competitors develop and commercialize products that are safer, more effective, have fewer or less severe side effects, are more convenient or are less expensive than any products that we may develop. Our competitors also may obtain FDA or other regulatory approval for their products more rapidly than we may obtain approval for ourselves, which could result in our competitors establishing a strong market position before we are able to enter the market. In addition, our ability to compete may be affected in many cases by insurers or other third-party payors seeking to encourage the use of generic products. Because of our primary focus on rare diseases, if our product candidates achieve marketing approval, we expect to seek premium pricing. Mergers and acquisitions in the pharmaceutical and biotechnology industries may result in even more resources being concentrated among a smaller number of our competitors. Smaller and other early-stage companies may also prove to be significant competitors, particularly through collaborative arrangements with large and established companies. These third parties compete with us in recruiting and retaining qualified scientific and management personnel, establishing clinical trial sites and patient registration for clinical trials, as well as in acquiring technologies complementary to, or necessary for, our programs.

Our estimates of the annual total addressable markets for our product candidates are based on internal and third-party estimates, including, without limitation, estimated incidence and prevalence of these diseases, and estimated annual price per patient for our product candidates. In addition, because there are currently no FDA-approved therapies indicated for the treatment of microcystic LMs, cutaneous VMs, clinically significant angiokeratomas or DSAP those patients may not regularly seek care from a treating physician and consequently may not be prescribed our product candidates, if approved. While we believe our assumptions and the data underlying our estimates are reasonable, these assumptions and estimates may not be correct and the conditions supporting our assumptions or estimates may change at any time, thereby reducing the predictive accuracy of these underlying factors. As a result, our estimates of the annual total addressable market for our product candidates may prove to be incorrect. If the annual total addressable markets for our product candidates are smaller than we have estimated, this may have an adverse effect on our business, financial condition, results of operations, and prospects.

If any of our product candidates are approved for commercialization, we may enter into agreements with third parties to market them on a worldwide basis or in more limited geographical regions. We expect that we will be subject to additional risks related to conducting marketing and sales activities in international jurisdictions and entering into international business relationships, including: - different regulatory requirements for approval of drugs in foreign countries;- the potential for so-called parallel importing, which is what happens when a local seller, faced with high or higher local prices, opts to import goods from a foreign market (with low or lower prices) rather than buying them locally;- challenges enforcing our contractual and intellectual property rights, especially in those foreign countries that do not respect and protect intellectual property rights to the same extent as the United States;- the need to seek additional patent approvals, licenses to patents held by third parties and/or face claims of infringing third-party patent rights;- unexpected changes in tariffs, trade barriers and regulatory requirements;- economic weakness, including inflation, or political instability in particular foreign economies and markets; compliance with tax, employment, immigration and labor laws for employees living or traveling abroad;- foreign currency fluctuations, which could result in increased operating expenses and reduced revenues, and other obligations incident to doing business in another country;- differing reimbursement regimes and price controls in certain non-U.S. markets;- difficulties staffing and managing foreign operations;- workforce uncertainty in countries where labor unrest is more common than in the United States;- potential liability under the FCPA, the U.K. Bribery Act 2010 or other comparable foreign regulations;- production shortages resulting from any events affecting raw material supply or manufacturing capabilities abroad; and - business interruptions resulting from geopolitical actions, including war and terrorism, or natural disasters including pandemics, or other outbreaks of infectious disease, earthquakes, typhoons, floods and fires. These and other risks associated with international operations may materially adversely affect our ability to attain or maintain profitable operations.