Anika Therapeutics (ANIK) Risk Analysis

We and our third-party providers are subject to national, international, federal or state laws and regulations, regulatory guidance and industry standards relating to data protection, privacy and information security. This includes the European Union, or EU, GDPR, and the United Kingdom, or UK, equivalent of the same (the UK GDPR, together with the EU GDPR, referred to as the GDPR), as well as other national data protection legislation in force in relevant European Economic Area, or EEA, Member States and the UK (including the UK Data Protection Act 2018), which governs the collection, use, storage, disclosure, transfer, or other processing of personal data (including health data processed in the context of clinical trials): (i) regarding individuals in the EEA and UK; and/or (ii) carried out in the context of the activities of our establishment in any EEA Member State or the UK. The GDPR is wide-ranging in scope and imposes numerous additional requirements on companies that process personal data, including imposing special requirements in respect of the processing of health and other sensitive data, requiring that consent of individuals to whom the personal data relates is obtained in certain circumstances, requiring additional disclosures to individuals regarding data processing activities, requiring that safeguards are implemented to protect the security and confidentiality of personal data, creating mandatory data breach notification requirements in certain circumstances, requiring data protection impact assessments for high risk processing and requiring that certain measures (including contractual requirements) are put in place when engaging third-party processors. The GDPR also provide individuals with various rights in respect of their personal data. The GDPR defines personal data to include pseudonymized or coded data and requires different informed consent practices and more detailed notices for clinical trial participants and investigators than applies to clinical trials conducted in the United States. We are required to apply GDPR standards to any clinical trials that our EEA and UK established businesses carry out anywhere in the world. Significantly, the GDPR impose strict rules on the transfer of personal data out of the EEA or the UK to the U.S. or other regions that have not been deemed to offer "adequate" privacy protections. Currently, we rely mainly on Standard Contractual Clauses approved by the European Commission, or SCCs, to legitimize transfers of personal data out of the EEA and International Transfer Agreements approved the UK for transfers of personal data out of the UK, however, there continue to be concerns about whether the SCCs and other international transfer mechanisms will face additional legal challenges. Any inability to transfer personal data from the EEA to the U.S. in compliance with data protection laws may impede our ability to conduct trials and may adversely affect our business and financial position. The GDPR increases our responsibilities and may increase our liability in relation to personal data that we process where such processing is subject to the GDPR. While we have taken steps to comply with the GDPR, and implementing legislation in applicable EEA member states and the UK, including by seeking to establish appropriate lawful bases for the various processing activities we carry out, reviewing our security procedures and those of our service providers, and entering into data processing agreements with relevant service providers we cannot be certain that our efforts to achieve and remain in compliance have been, and/or will continue to be, fully successful. Given the breadth and depth of changes in data protection obligations, complying with the GDPR and similar laws' requirements are rigorous and time intensive and require significant resources and a review of our technologies, systems and practices, as well as those of any third-party service providers, contractors or consultants that process or transfer personal data. Although the EU GDPR and the UK GDPR currently impose substantially similar obligations, it is possible that over time the UK GDPR could become less aligned with the EU GDPR, particularly with the UK plans to reform the country's data protection legal framework in its Data Reform Bill introduced into the UK legislative process. In addition, EEA Member States have adopted implementing national laws to implement the GDPR which may partially deviate from the GDPR and the competent authorities in the EEA Member States may interpret GDPR obligations slightly differently from country to country, so that we do not expect to operate in a uniform legal landscape in the EEA and UK with respect to data protection regulations. The potential of the respective provisions and enforcement of the EU GDPR and UK GDPR further diverging in the future creates additional regulatory challenges and uncertainties for us. The lack of clarity on future UK laws and regulations and their interaction with EU laws and regulations could add legal risk, uncertainty, complexity and compliance cost to the handling of European personal data and our privacy and data security compliance and could require us to amend our processes and procedures to implement different compliance measures for the UK and the EEA. In the United States, numerous federal and state laws and regulations, including federal health information privacy laws, state data breach notification laws, state health information privacy laws and federal and state consumer protection laws that govern the collection, use, disclosure and protection of health-related and other personal information could apply to our operations or the operations of our collaborators and third-party providers. For example, California enacted the California Consumer Privacy Act, or the CCPA. This law, which became effective on January 1, 2020 gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used. It also provides for civil penalties for violations, as well as a private right of action for data breaches that are expected to increase data breach litigation. At this time, we do not collect personal data on residents of California but should we begin to do so, and in the context of doing so, become subject to the CCPA, the CCPA will impose new and burdensome privacy compliance obligations on our business and will raise new risks for potential fines and class actions. In addition, the California Privacy Rights Act, or CPRA, which became effective on January 1, 2023, imposes additional obligations on companies covered by the legislation and significantly modifies the CCPA, including by expanding consumers' rights with respect to certain sensitive personal information. The CPRA also created a new state agency that was vested with authority to implement and enforce the CCPA. The effects of the CCPA are potentially significant and, should we begin to process personal information concerning California residents may require us to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and/or litigation. Some observers have noted that the CCPA could mark the beginning of a trend toward more stringent privacy legislation in the United States, which could increase our potential liability and adversely affect our business. New consumer privacy laws similar to the CCPA have been passed in a number of states and many other states have proposed new privacy laws. Such proposed legislation, if enacted, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies. The existence of comprehensive privacy laws in different states in the country would make our compliance obligations more complex and costly and may increase the likelihood that we may be subject to enforcement actions or otherwise incur liability for noncompliance. In addition to these comprehensive laws and proposals, several other states have passed or proposed more limited privacy laws focused on particular privacy issues. In addition, many jurisdictions around the world have adopted legislation that regulates how businesses operate online and enforces information security, including measures relating to privacy, data security and data breaches. Many of these laws require businesses to notify data breaches to the regulators and/or data subjects. These laws are not consistent, and compliance in the event of a widespread data breach is costly and burdensome. In many jurisdictions, enforcement actions and consequences for non-compliance with protection, privacy and information security laws and regulations are rising. In the EEA and the UK, data protection authorities may impose large penalties for violations of the data protection laws, including potential fines of up to €20 million (£17.5 million in the UK) or 4% of annual global revenue, whichever is greater. The authorities have shown a willingness to impose significant fines and issue orders preventing the processing of personal data on non-compliant businesses. Data subjects also have a private right of action, as do consumer associations, to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of applicable data protection laws. In the United States, possible consequences for non-compliance include enforcement actions in response to rules and regulations promulgated under the authority of federal agencies and state attorneys general and legislatures and consumer protection agencies. The risk of our being found in violation of these laws is increased by the fact that the interpretation and enforcement of them is not entirely clear. Efforts to ensure that our business arrangements with third parties will comply with applicable healthcare laws and regulations will involve substantial costs. Any action against us for violation of these laws, even if we successfully defend against it, could cause us to incur significant legal expenses and divert our management's attention from the operation of our business. The shifting compliance environment and the need to build and maintain robust and expandable systems to comply with multiple jurisdictions with different compliance and/or reporting requirements increases the possibility that a healthcare company may run afoul of one or more of the requirements. Compliance with data protection laws and regulations could require us to take on more onerous obligations in our contracts, restrict our ability to collect, use and disclose data, or in some cases, impact our ability to operate in certain jurisdictions. It could also require us to change our business practices and put in place additional compliance mechanisms, which may interrupt or delay our development, regulatory and commercialization activities and increase our cost of doing business. Failure by us or our and third-party providers to comply with data protection laws and regulations could result in government enforcement actions (which could include civil or criminal penalties and orders preventing us from processing personal data), private litigation and result in significant fines and penalties against us. Claims that we have violated individuals' privacy rights, failed to comply with data protection laws or breached our contractual obligations, even if we are not found liable, could be expensive and time-consuming to defend, could result in adverse publicity and could have a material adverse effect on our business, financial condition, results of operations and prospects.

Through our acquisitions of Parcus Medical and Arthrosurface in early 2020, we significantly broadened our technology and development platforms and commercialization infrastructure and expanded our addressable market from the global OA pain management market to the substantially larger global joint preservation market. Our future success depends on growth in sales of both our legacy and acquired products. There can be no assurance that such growth can be achieved or, if achieved, sustained. There can be no assurance that, even if substantial growth in product sales and the demand for our products is achieved, we will be able to: - Gain acceptance of our broadened portfolio of existing products, as well as future products, by the medical community, hospitals, physicians, other health care providers, third-party payers, and end-users, which acceptance may depend upon the extent to which the medical community and end-users perceive our products as safer, more effective or more cost-competitive than other similar products.   - Maintain, manage, and develop the necessary manufacturing capabilities and inventory management practices;   - Develop, implement, and integrate the mix of appropriate sales channels needed to generate increased sales across our expanded product platform and to develop marketing partners and viable commercial strategies for the distribution of our expanded mix of products;   - Attract, retain, and integrate required key personnel; and   - Implement the financial, accounting, and management systems needed to manage our expanded business and growing demand for our products. There can be no assurance that our current and future products will achieve significant market acceptance on a timely basis, or at all. The failure of some or all of our products to achieve significant market acceptance, or our failure to successfully manage future growth, could have a material adverse effect on our business, financial condition, and results of operations.

In the United States and other foreign markets, health care providers, such as hospitals and physicians, that purchase health care products, such as our products, generally rely on third-party payers, including Medicare, Medicaid, and other health insurance and managed care plans, to provide coverage and to reimburse for all or part of the cost of the health care product or procedures that use such products. Coverage and reimbursement by third-party payers, both in the United States and internationally, may depend on several factors, including the individual payer's determination that our products or procedures that use our products are clinically useful and cost-effective, medically necessary, and not experimental or investigational. Since insurance coverage determinations and reimbursement decisions are made by each payer individually, seeking positive coverage and reimbursement decisions can be a time consuming and costly process, which could require us or our marketing partners to provide supporting scientific, clinical, and cost-effectiveness data for the use of our products to each payer separately. Significant uncertainty exists as to the insurance coverage and reimbursement status of newly approved health care products or procedures that use such products, and any failure or delay in obtaining reimbursement approvals can negatively impact sales of our new products. In addition, we cannot be certain that payers who currently provide reimbursement for our products or procedures that use our products will continue to provide such reimbursement in the future, and such payer decisions could negatively impact the sales of our current or future products. In addition, third-party payers are increasingly attempting to contain the costs of health care products and services by limiting both coverage and the level of reimbursement for new therapeutic products and by refusing, in some cases, to provide coverage for uses of approved products for disease indications for which the FDA, or the applicable foreign regulatory agency, has granted marketing approval. Also, the U.S. Congress, certain state legislatures, and certain foreign governments and regulatory agencies have considered reforms, including, among other items, any material changes to the ACA or the potential repeal of reference drug pricing in the United States, which may affect current reimbursement practices and create additional uncertainty about the pricing of our products, including the potential implementation of controls on health care spending through limitations on the growth of Medicare and Medicaid spending. For example, in 2010, the ACA was enacted and was intended to expand access to health insurance coverage and improve the quality of health care over time. There has been ongoing litigation and congressional efforts to modify or repeal all or certain provisions of the ACA. There may be uncertainties that result from modification or repeal of any of the provisions of the ACA, including as a result of current and future executive orders and legislative actions. We cannot predict what other health care programs and regulations will ultimately be implemented at the federal or state level or the effect that any future legislation or regulation in the United States may have on our business There can be no assurance that third-party coverage will be available or that reimbursement will be adequate for any products or services developed by us or procedures using our products or services. Outside the United States, the success of our products is also dependent in part upon the availability of reimbursement and health care payment systems. Domestic and international reimbursement laws and regulations may change from time to time. Lack of adequate coverage and reimbursement provided by governments and other third-party payers for our products and services, including continuing coverage for Monovisc and Orthovisc in the United States, and any change of classification by the Centers for Medicare and Medicaid Services for reimbursement of Orthovisc and Monovisc, could have a material adverse effect on our business, financial condition, and results of operations.

Although we believe that alternative sources for many of these and other components and raw materials that we use in our manufacturing processes are available, we cannot be certain that the supply of key raw materials will continue to be available at current levels or will be sufficient to meet our future needs. We continue to see impacts on our supply chain as the companies that produce our products, product components or otherwise support our manufacturing processes, the distribution centers where we manage our inventory, or the operations of our logistics and other service providers, including third parties that sterilize and store our products, were disrupted, temporarily closed or experienced worker shortages for a sustained period of time during and following the global pandemic or due to other supply chain disruptions. For example, for the manufacture of Arthrosurface joint solutions products, we engage a single third-party organization as a contract manufacturer. This contract manufacturer has noted that there could be lead times up to a year or more to deliver product. Any supply interruption could harm our ability to manufacture our products until a new source of supply is identified and qualified. We may not be able to find sufficient alternative suppliers in a reasonable time period, or on commercially reasonable terms, if at all, and our ability to produce and supply our products could be impaired.

Other entities have filed patent applications for, or have been issued patents concerning, various products or processes in the segments in which we do business. There can be no assurance that the products or processes developed by us will not infringe on the patent rights of others in the future. The cost of defending infringement suits is typically large, and there is no guarantee that any future defense would be successful. In addition, infringement could lead to substantial damages payouts or our inability to produce or market certain of our current or future products. As a result, any such infringement may have a material adverse effect on our business, financial condition, and results of operations.