Aslan Pharmaceuticals (ASLN) Risk Analysis

Our business and future success is substantially dependent on our ability to successfully develop, obtain regulatory approval for, and successfully commercialize eblasakimab and farudodstat. Any delay or setback in the development of eblasakimab or farudodstat could materially and adversely affect our business and operations and cause the price of our ADSs or ordinary shares to decline. Should our planned clinical development of eblasakimab and farudodstat fail to be completed in a timely manner or at all, we will need to acquire new preclinical product candidates, which will require additional time and resources to obtain regulatory approval and proceed with commercialization. We cannot assure you that our planned clinical development for our product candidates will be completed in a timely manner in our current indications, or at all, or that we will be able to obtain approval for any of our product candidates from the U.S. FDA, or any comparable foreign regulatory authority.

The degree of future protection afforded by our intellectual property rights is uncertain because intellectual property rights have limitations and may not adequately protect our business or permit us to maintain our competitive advantage. For example: - Others may be able to make products that are similar to any product candidates we may develop or utilize similar technology but that are not covered by the claims of the patents that we license or may own in the future;- We, or our license partners or current or future collaborators, might not have been the first to make the inventions covered by the issued patent or pending patent application that we license or may own in the future;- We, or our license partners or current or future collaborators, might not have been the first to file patent applications covering certain of our or their inventions;- Others may independently develop similar or alternative technologies or duplicate any of our technologies without infringing our owned or licensed intellectual property rights;- It is possible that our pending licensed patent applications or those that we may own in the future will not lead to issued patents;- Issued patents that we hold rights to may be held invalid or unenforceable, including as a result of legal challenges by our competitors;- Our competitors might conduct research and development activities in countries where we do not have patent rights and then use the information learned from such activities to develop competitive products for sale in our major commercial markets;- We may not develop additional proprietary technologies that are patentable;- The patents of others may harm our business; and - We may choose not to file a patent in order to maintain certain trade secrets or know-how, and a third party may subsequently file a patent covering such intellectual property. Should any of these events occur, they could have a material adverse effect on our business, financial condition, results of operations, and prospects.

In the ordinary course of business, we collect, receive, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, share and store (collectively, process) personal data and other sensitive data, including proprietary and confidential business data, trade secrets, intellectual property, data we collect about trial participants in connection with clinical trials, sensitive third-party data, and employee and patient data (collectively, sensitive data). Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including health information privacy laws, data breach notification laws, personal data privacy laws, and consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH), imposes specific requirements relating to the privacy, security, and transmission of individually identifiable health data. In the past few years, numerous U.S. states-including California, Virginia, Colorado, Connecticut, and Utah-have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (CPRA) (collectively, CCPA) applies to personal data of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for fines up to $7,500 per intentional violation and allows private litigants affected by certain data breaches to recover significant statutory damages. Although the CCPA exempts some data processed in the context of clinical trials, the CCPA may increase compliance costs and potential liability with respect to other personal data we maintain about California residents. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. While these states, like the CCPA, also exempt some data processed in the context of clinical trials, these developments may further complicate compliance efforts, and increase legal risk and compliance costs for us and the third parties upon whom we rely. Outside the United States, an increasing number of laws, regulations, and industry standards may govern data privacy and security. For example, because we are headquartered in Singapore, we may be subject to Singapore's Personal Data Protection Act of 2012 (PDPA), which generally requires covered organizations to provide notice and obtain consents prior to the collection, use, or disclosure of personal data. The PDPA also provides individuals with certain rights regarding their personal data and imposes certain compliance obligations related to accountability, protection, transfer, and permitted uses of personal data. Other foreign jurisdictions have enacted statutes imposing strict requirements for processing personal data, such as the European Union's General Data Protection Regulation (EU GDPR), the United Kingdom's GDPR (UK GDPR), Singapore's Personal Data Protection Act, and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). For example, under the EU GDPR, companies may face temporary or definitive bans on data processing, other corrective actions, fines of up to 20 million Euros or 4% of annual global revenue, whichever is greater, or private litigation related to processing of personal data brought by classes of data subject or consumer protection groups authorized at law to represent their interests. In addition, we may be unable to transfer personal data from Europe and other jurisdictions to the United States or other countries due to data localization requirements or limitations on cross-border data flows. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area (EEA) and the United Kingdom (UK) have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it generally believes are inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA's standard contractual clauses, the UK's International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. If there is no lawful manner for us to transfer personal data from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we may face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors, and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers of personal data out of Europe for allegedly violating cross-border data transfer limitations. We publish privacy policies and other statements regarding data privacy and security. If these policies or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators, or other adverse consequences. Our employees and personnel may use generative AI technologies to perform their work, and the disclosure and use of personal data in generative AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages. In addition to data privacy and security laws, we are contractually subject to industry standards adopted by industry groups and may become subject to such obligations in the future. We are also bound by other contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. Obligations related to data privacy and security (and consumers' data privacy expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third parties on whom we rely may fail to comply with such obligations, which could negatively impact our business operations. If we or the third parties on which we rely fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations we could face significant consequences, including but not limited to: government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar), litigation (including class-action claims) and mass arbitration demands, additional reporting requirements and/or oversight, orders to destroy or not use personal data, the inability to process sensitive data, regulatory scrutiny, disruptions to our operations (including our ability to conduct clinical trials), diversion of time and effort, and/or adverse publicity and could negatively affect our operating results and business. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business operations (including, as relevant, clinical trials); inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations.

Government agencies promulgate regulations and guidelines directly applicable to us and to our product candidates. In addition, professional societies, such as practice management groups, private health and science foundations and organizations involved in various diseases from time to time may also publish guidelines or recommendations to the healthcare and patient communities. Recommendations of government agencies or these other groups or organizations may relate to such matters as usage, dosage, route of administration and use of concomitant therapies. Recommendations or guidelines suggesting the reduced use of our product candidates or the use of competitive or alternative products as the standard of care to be followed by patients and healthcare providers could result in decreased use of our product candidates.

We have never, as an organization, commercialized a product and there is no guarantee that we will be able to do so successfully. We will need to establish a commercial team and hire sales forces in the geographies where we are permitted and intend to market our drugs. We will also need to develop a marketing team and strategy in order to successfully market and sell our product candidates, which will require significant time and resources and the development of our ability to market and sell our product and generate revenues from our product candidates may be delayed or limited. We cannot assure you that our sales efforts will be effective or produce the results we expect. We will be competing with other pharmaceutical and biotechnology companies to recruit, hire, train and retain marketing and sales personnel. Further, we may face difficulties or delays in obtaining and maintaining the required licenses and permits to sell our product candidates in individual states and jurisdictions. If the commercialization of any of our product candidates is unsuccessful or perceived as disappointing, the price of our ADSs or ordinary shares could decline significantly and the long-term success of the product and our company could be harmed. We may also seek to establish collaborations with pharmaceutical companies to maximize the potential of our products in other markets. For example, we have conducted a Phase 2b clinical trial to develop eblasakimab as a treatment for AD, and, we are seeking a global partner to support Phase 3 clinical trials and potential commercialization. We may not be successful in establishing development and commercialization collaborations which could adversely affect, and potentially prohibit, our ability to develop our product candidates.

We employ individuals, and work with consultants or independent contractors, who were previously employed at other biotechnology or pharmaceutical companies, including our competitors or potential competitors. We may be subject to claims that we or our employees, consultants or independent contractors have inadvertently or otherwise used or disclosed confidential information, including trade secrets, of any such individual's former employers or other third parties. We may also be subject to claims that former employers or other third parties have an ownership interest in our patents. Litigation may be necessary to defend against these claims. If we fail in defending any such claims, in addition to paying monetary damages, we may lose valuable intellectual property rights or personnel. There is no guarantee of success in defending these claims, and even if we are successful, litigation could result in substantial cost and be a distraction to our management and other employees. In addition, while it is our policy to require our employees, consultants and independent contractors who may be involved in the conception or development of intellectual property to execute agreements assigning such intellectual property to us, we may be unsuccessful in executing such an agreement with each party who, in fact, conceives or develops intellectual property that we regard as our own. The assignment of intellectual property rights may not be self-executing (and may require further action), or the assignment agreements may be breached, and we may be forced to bring claims against third parties, or defend claims that they may bring against us, to determine the ownership of what we regard as our intellectual property. Such claims could have a material adverse effect on our business, financial condition, results of operations, and prospects.

We have relied upon and plan to continue to rely upon third-party CROs to conduct our preclinical studies and clinical trials, including investigator-initiated studies sponsored by the investigator's institution, and control only certain aspects of their activities. Nevertheless, we are responsible for ensuring that each of our trials is conducted in accordance with the applicable protocol, legal, regulatory and scientific standards and our reliance on the CROs does not relieve us of our regulatory responsibilities. We and our CROs are required to comply with U.S. FDA laws and regulations regarding current good clinical practice (cGCP) which are also required by the Competent Authorities of the Member States of the European Economic Area and comparable foreign regulatory authorities in the form of International Council for Harmonization (ICH) guidelines for all of our products in clinical development. Regulatory authorities enforce cGCP through periodic inspections of trial sponsors, principal investigators and trial sites. If we or any of our CROs fail to comply with applicable cGCP, the clinical data generated in our clinical trials may be deemed unreliable and the U.S. FDA or comparable foreign regulatory authorities may require us to perform additional clinical trials before approving our marketing applications. We cannot assure you that upon inspection by a given regulatory authority, such regulatory authority will determine that any of our clinical trials comply with cGCP regulations. In addition, our U.S. clinical trials must be conducted with product produced under cGMP regulations. While we have agreements governing activities of our CROs, we have limited influence over their actual performance. In addition, portions of the clinical trials for our product candidates are expected to be conducted at various locations great distances from where our operations are located in the U.S. and Singapore, which will make it more difficult for us to monitor CROs and perform visits of our clinical trial sites and will force us to rely heavily on CROs to ensure the proper and timely conduct of our clinical trials and compliance with applicable regulations, including cGCP. Failure to comply with applicable regulations in the conduct of the clinical trials for our product candidates may require us to repeat clinical trials, which would delay the regulatory approval process. Some of our CROs have an ability to terminate their respective agreements with us if, among other reasons, it can be reasonably demonstrated that the safety of the subjects participating in our clinical trials warrants such termination, if we make a general assignment for the benefit of our creditors or if we are liquidated. If any of our relationships with these third-party CROs terminate, we may not be able to enter into arrangements with alternative CROs or to do so on commercially reasonable terms. In addition, our CROs are not our employees, and except for remedies available to us under our agreements with such CROs, we cannot control whether or not they devote sufficient time and resources to our preclinical and clinical programs. If CROs do not successfully carry out their contractual duties or obligations or meet expected deadlines, if they need to be replaced or if the quality or accuracy of the clinical data they obtain is compromised due to the failure to adhere to our clinical protocols, regulatory requirements or for other reasons, our clinical trials may be extended, delayed or terminated and we may not be able to obtain regulatory approval for or successfully commercialize our product candidates. Consequently, our results of operations and the commercial prospects for our product candidates would be harmed, our costs could increase substantially and our ability to generate revenue could be delayed significantly. Switching or adding additional CROs involves additional cost and requires management time and focus. In addition, there is a natural transition period when a new CRO commences work. As a result, delays occur, which can materially impact our ability to meet our desired clinical development timelines. Though we carefully manage our relationships with our CROs, there can be no assurance that we will not encounter challenges or delays in the future or that these delays or challenges will not have a material adverse impact on our business, financial condition and prospects.

Some of our operations, including in particular some of our clinical trials, are being conducted across areas that may be prone to natural disasters, such as earthquakes, cyclones, monsoons and floods, which could cause interruptions to our operations. We do not have a disaster recovery or business continuity plan in place to cover such natural disasters and may incur substantial expenses as a result of the absence or limited nature of our internal or third-party service providers' disaster recovery and business continuity plans, which could have a material adverse effect on our business. Any occurrence of these natural disasters or pandemic diseases or other adverse public health developments in the areas in which we operate our clinical trials could disrupt or delay our business operations or clinical development, which could materially adversely affect our business.