Co-Diagnostics (CODX) Risk Factors

The market price of our common stock may be subject to wide fluctuation in response to various factors, some of which are beyond our control. Some factors that may cause the market price of our common stock to fluctuate, in addition to the other risks mentioned in this "Risk Factors" section and elsewhere in this report, are: - sales or purchases of our common stock by our shareholders, executives, and directors;         - our ability to obtain regulatory approval to commercialize our PCR platform on a timely basis or at all;         - our ability to enter new markets;         - actual or unanticipated fluctuations in our annual and quarterly financial results;         - our ability to obtain financings to continue and expand our commercial activities, expand our manufacturing operations, conduct research and development activities including, but not limited to, human clinical trials, and other business activities;         - our ability to secure resources and the necessary personnel to continue and expand our commercial activities, develop additional diagnostic tests, conduct clinical trials and gain approval for our diagnostic tests on our desired schedule;         - commencement, enrollment or results of our clinical trials of our diagnostic tests or any future clinical trials we may conduct;         - changes in the development status of our diagnostic tests;         - any delays or adverse developments or perceived adverse developments with respect to review by the FDA or other similar foreign regulatory authorities of our planned clinical trials;         - any delay in our submission for studies or test approvals or adverse regulatory decisions, including failure to receive regulatory approval or clearance for our diagnostic tests;         - our announcements or our competitors' announcements regarding new tests, enhancements, significant contracts, acquisitions or strategic investments;         - failures to meet external expectations or management guidance;         - changes in our capital structure or dividend policy, including as a result of future issuances of securities and sales of large blocks of common stock by our shareholders;         - announcements and events surrounding financing efforts, including debt and equity securities;         - competition from existing technologies and diagnostic tests or new technologies and diagnostic tests that may emerge;         - announcements of acquisitions, partnerships, collaborations, joint ventures, new diagnostic tests, capital commitments, or other events by us or our competitors;         - changes in general economic, political and market conditions in any of the regions in which we conduct our business;         - changes in industry conditions or perceptions;         - changes in valuations of similar companies or groups of companies;         - analyst research reports, recommendations and changes in recommendations, price targets and withdrawals of coverage;         - departures and additions of key personnel;         - disputes and litigations related to intellectual properties, proprietary rights, and contractual obligations;         - changes in applicable laws, rules, regulations, or accounting practices and other dynamics;         - other events or factors, many of which may be out of our control. In addition, if the market for stocks in our industry or industries related to our industry, or the stock market in general, experiences a loss of investor confidence, the trading price of our common stock could decline for reasons unrelated to our business, financial condition and results of operations. If any of the foregoing occurs, it could cause our stock price to fall and may expose us to lawsuits that, even if unsuccessful, could be costly to defend and a distraction to management.

We do not expect to pay cash dividends on our common stock. Any future dividend payments are within the absolute discretion of our board of directors and will depend on, among other things, our results of operations, working capital requirements, capital expenditure requirements, financial condition, contractual restrictions, business opportunities, anticipated cash needs, provisions of applicable law and other factors that our board of directors may deem relevant. We may not generate sufficient cash from operations in the future to pay dividends on our common stock.

The process of obtaining regulatory clearances or approvals to market a medical diagnostic from the FDA or similar regulatory authorities outside of the United States can be costly and time consuming, and there can be no assurance that such clearances or approvals will be granted on a timely basis, or at all. The FDA's 510(k) clearance process generally takes one to six months from the date of submission, depending on whether a special or traditional 510(k) premarket notification has been submitted, but can take significantly longer. An application for premarket approval, or PMA, must be submitted to the FDA if the device cannot be cleared through the 510(k) clearance process or is not exempt from premarket review by the FDA. The PMA process almost always requires one or more clinical trials and can take two to three years from the date of filing, or even longer. If we are required to obtain approval of any of our products through the PMA process, the costs associated with such a process will be significant, which could adversely affect our financial performance and results of operations. In addition, a submission through the PMA process would require us to delay commercialization of such product candidates until after approval is received, if ever. If we are unable to commercialize our product candidates in a timely manner, or at all, our business will be adversely affected. Similar to our compliance with U.S. regulatory requirements, we must obtain and comply with international requirements, in order to market and sell our products outside of the United States and we may only promote and market our products, if approved, as permitted by applicable regulatory authorities. There is no guarantee that we will receive the necessary regulatory approvals for our product candidates either inside the United States or internationally. If our product candidates do not receive necessary regulatory approvals, our business could be materially and adversely affected.

Our business exposes us to potential product liability claims that are inherent in the design, testing, manufacture, sale and distribution of our currently marketed products and each of our product candidates that we are seeking to introduce to the market. Someone may allege that our diagnostic tests identified inaccurate or incomplete information or otherwise failed to perform as designed. We may also be subject to liability for errors in, a misunderstanding of or inappropriate reliance upon, the information we provide in the ordinary course of our business activities. In addition, we may be subject to product liability claims resulting from misuse or off-label use of our products and product candidates. Any product liability claim brought against us, with or without merit, could result in an increase of our product liability insurance rates or in our inability to secure coverage in the future on commercially reasonable terms, if at all. In addition, if our product liability insurance proves to be inadequate to pay a damage award, we may have to pay the excess of this award out of our cash reserves, which could significantly harm our financial condition. A product liability claim, even one without merit, could harm our reputation in the industry, lead to significant legal fees, and result in the diversion of management's attention from managing our business.

We are subject to numerous data protection laws that govern the processing of individually identifiable information and health information and other sensitive and personal information in the jurisdictions in which we operate. In many instances, these data protection laws, regulations and standards apply not only to disclosures to third parties, but also to transfers of information between or among us and other parties with which we have commercial relationships. The regulatory framework for data privacy, data security and data transfers worldwide is rapidly evolving and, as a result, interpretation and implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. These data protection laws may be interpreted and applied differently over time and from jurisdiction to jurisdiction, and it is possible that they will be interpreted and applied in ways that will materially and adversely affect our business, financial condition and results of operations. Failure to comply with any of these data protection laws could result in enforcement actions against us, including fines, imprisonment of company officials and public censure, claims for damages by affected individuals, damage to our reputation and loss of goodwill, any of which could have a material adverse effect on our business. There are numerous U.S. federal and state laws and regulations related to the privacy and security of personal information. These laws and regulations include the Health Insurance Portability and Accountability Act of 1996, or HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, or HITECH, and their implementing regulations, or collectively referred to as the HIPAA Rules, which establish a set of national privacy and security standards to safeguard Protected Health Information, or PHI, by health plans, healthcare clearinghouses and certain healthcare providers, referred to as covered entities, and the business associates and their subcontractors with whom such covered entities contract for services that involve the creation, receipt, maintenance or transmission of PHI for or on behalf of a covered entity or another business associate. HIPAA requires covered entities and business associates to, among other things, develop and maintain policies and procedures with respect to PHI that is used or disclosed, including the adoption of administrative, physical and technical safeguards to protect such information and ensure the confidentiality, integrity and availability of electronic PHI. As this applies to our business, we are required to maintain security standards for any PHI that we create, receive, maintain or transmit. For example, we plan to offer cloud-based portal software to help our customers more efficiently use our products. The software will maintain security safeguards that are designed to be consistent with the HIPAA Rules, but we cannot guarantee that these safeguards will not fail or that they will not be deemed inadequate in the future. In addition, we could be subject to periodic audits for compliance with the HIPAA Privacy and Security Standards by the U.S. HHS, and our customers. The U.S. HHS Office for Civil Rights may impose significant penalties on entities subject to HIPAA for a failure to comply with a requirement of the HIPAA Rules. If we are unable to properly protect the privacy and security of the PHI of our customers, we could be found to have breached our contracts. Determining whether PHI has been handled in compliance with applicable privacy standards and our contractual obligations can be complex and we cannot be sure how these regulations will be interpreted, enforced or applied to our operations. In addition, many states in which we operate have laws that protect the privacy and security of sensitive and personal information, including health-related information. Certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to sensitive and personal information than federal, international or other state laws, and such laws may differ from each other, which may complicate compliance efforts. Laws, regulations and standards in many other jurisdictions also apply broadly to the Processing of personal information, which impose significant compliance obligations. Complying with these numerous, complex and often changing regulations is expensive and difficult, and failure to comply with any Data Protection Laws or any security incident or breach involving the misappropriation, loss or other unauthorized use or disclosure of sensitive or confidential information, whether by us, one of our service providers or another third party, could negatively affect our business, financial condition and results of operations, including but not limited to: investigation costs, material fines and penalties; compensatory, special, punitive and statutory damages; litigation; consent orders regarding our privacy and security practices; requirements that we provide notices, credit monitoring services or credit restoration services or other relevant services to impacted individuals; adverse actions against our licenses to do business; and injunctive relief. Many statutory requirements, both in the United States and abroad, include obligations for companies to notify individuals of security breaches involving certain personal information, which could result from breaches experienced by us or our third-party service providers. For example, laws in all 50 U.S. states and the District of Columbia require businesses to provide notice to consumers whose unencrypted personal information has been disclosed as a result of a data breach. These laws are not consistent, and compliance in the event of a widespread data breach is difficult and may be costly. Moreover, states have been frequently amending existing laws, requiring attention to changing regulatory requirements. We also may be contractually required to notify affected customers, regulators, credit reporting agencies or other affected individuals of a security breach. Such notifications are costly, and the disclosures or the failure to comply with such requirements, could lead to material adverse effects, including without limitation, negative publicity, a loss of customer confidence in our services or security measures or breach of contract claims. There can be no assurance that the limitations of liability in our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages if we fail to comply with applicable Data Protection Laws, Data Protection Obligations or other legal obligations. In addition, although we may have contractual protections with our third-party service providers, contractors and consultants, any actual or perceived security breach by our subcontractors could harm our reputation and brand, expose us to potential liability or require us to expend significant resources on data security and in responding to any such actual or perceived breach. Any contractual protections we may have from our third-party service providers, contractors or consultants may not be sufficient to adequately protect us from any such liabilities and losses, and we may be unable to enforce any such contractual protections. We expect that there will continue to be new proposed laws and regulations concerning data privacy and security, and we cannot yet determine the impact such future laws, regulations and standards may have on our business. New laws, amendments to or re-interpretations of existing laws, regulations, standards and other obligations may require us to incur additional costs and restrict our business operations. Because the interpretation and application of health-related and Data Protection Laws and other obligations are still uncertain, and often contradictory and in flux, it is possible that the scope and requirements of these laws may be interpreted and applied in a manner that is inconsistent with our practices and our efforts to comply with the evolving data protection rules may be unsuccessful. If so, this could result in government-imposed fines or orders requiring that we change our practices, which could adversely affect our business. We cannot assure you that our third-party partners and service providers with access to our or our customers', suppliers' and employees' personally identifiable and other sensitive or confidential information in relation to which we are responsible will not breach contractual obligations imposed by us or violate Data Protection Laws, or that they will not experience security breaches or attempts thereof, which could have a corresponding effect on our business, including putting us in breach of our obligations under the Data Protection Laws, which could in turn adversely affect our business, results of operations and financial condition. We cannot assure you that our contractual measures and our own privacy- and security-related safeguards will protect us from the risks associated with the third-party processing, storage and transmission of such information. We may receive inquiries or be subject to investigations, proceedings or actions, by various government entities regarding our privacy and information security practices and Processing ("Regulatory Proceedings"). These Regulatory Proceedings could result in a material adverse effect, including without limitation, interruptions of, or required changes to, our business practices, the diversion resources and the attention of management from our business, regulatory oversights and audits, discontinuance of necessary Processing, or other remedies that adversely affect our business. In addition to the possibility of fines, lawsuits, regulatory investigations, public censure, other claims and penalties, and significant costs for remediation and damage to our reputation, we could be materially and adversely affected if legislation or regulations are expanded to require changes in our data processing practices and policies or if governing jurisdictions interpret or implement their legislation or regulations in ways that negatively impact our business. Complying with these various laws could cause us to incur substantial costs or require us to change our business practices and compliance procedures in a manner adverse to our business. Any inability to adequately address data privacy or security-related concerns, even if unfounded, or to comply with applicable laws, regulations, standards and other obligations relating to data privacy and security, could result in additional cost and liability to us, harm our reputation and brand, damage our relationships with customers and have a material and adverse impact on our business. While we maintain general liability insurance coverage, cyber insurance coverage and other insurance, we cannot assure that such coverage will be adequate or otherwise protect us from or adequately mitigate liabilities or damages with respect to claims, costs, expenses, litigation, fines, penalties, business loss, data loss, regulatory actions or material adverse effects arising out of our privacy and security practices, Processing or security breaches we may experience, or that such coverage will continue to be available on acceptable terms or at all. The successful assertion of one or more large claims against us that exceeds our available insurance coverage, or results in changes to our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements), could have an adverse effect on our business. In addition, we cannot be sure that our existing insurance coverage will continue to be available on acceptable terms or that our insurers will not deny coverage as to any future claim.