Dyne Therapeutics (DYN) Risk Analysis

We will face an inherent risk of clinical trial and product liability exposure related to the testing of our product candidates in clinical trials, and we will face an even greater risk if we commercially sell any products that we may develop. While we currently have no product candidates that have been approved for commercial sale, the use of product candidates by us in clinical trials, and the sale of any approved products in the future, may expose us to liability claims. These claims might be made by patients that use the product, healthcare providers, pharmaceutical companies or others selling such products. If we cannot successfully defend ourselves against claims that our product candidates or products caused injuries, we will incur substantial liabilities. Regardless of merit or eventual outcome, liability claims may result in: - decreased demand for any product candidates we may develop;- injury to our reputation and significant negative media attention;- withdrawal of clinical trial participants;- significant costs to defend any related litigation;- substantial monetary awards to trial participants or patients;- loss of revenue;- reduced resources of our management to pursue our business strategy; and - the inability to commercialize any product candidates we may develop. We have increased our insurance coverage in countries in which we plan to conduct clinical trials and will need to increase our insurance coverage if we conduct clinical trials in additional countries or of additional product candidates or if we commence commercialization of any product candidates. Insurance coverage is increasingly expensive. We may not be able to maintain insurance coverage at a reasonable cost or in an amount adequate to satisfy any liability that may arise. If a successful clinical trial or product liability claim or series of claims is brought against us for uninsured liabilities or in excess of insured liabilities, our assets may not be sufficient to cover such claims and our business operations could be impaired.

We are subject to data privacy and protection laws, regulations, policies and contractual obligations that apply to the collection, transmission, storage and use of personally-identifying information, which among other things, impose certain requirements relating to the privacy, security and transmission of personal information, including comprehensive regulatory systems in the U.S., European Union and United Kingdom. The legislative and regulatory landscape for privacy and data protection continues to evolve in jurisdictions worldwide, and there has been an increasing focus on privacy and data protection issues with the potential to affect our business. Failure to comply with any of these laws and regulations could result in enforcement action against us, including fines, claims for damages by affected individuals, damage to our reputation and loss of goodwill, any of which could have a material adverse effect on our business, financial condition, results of operations or prospects. There are numerous U.S. federal and state laws and regulations related to the privacy and security of personal information. In particular, regulations promulgated pursuant to HIPAA establish privacy and security standards that limit the use and disclosure of individually identifiable health information, or protected health information, and require the implementation of administrative, physical and technological safeguards to protect the privacy of protected health information and ensure the confidentiality, integrity and availability of electronic protected health information. Determining whether protected health information has been handled in compliance with applicable privacy standards and our contractual obligations can be complex and may be subject to changing interpretation. These obligations may be applicable to some or all of our business activities now or in the future. If we are unable to properly protect the privacy and security of protected health information, we could be found to have violated these privacy and security laws and/or breached certain contracts. Further, if we fail to comply with applicable privacy laws, including applicable HIPAA privacy and security standards, we could face significant civil and criminal penalties. HHS enforcement activity can result in financial liability and reputational harm, and responses to such enforcement activity can consume significant internal resources. In addition, state attorneys general are authorized to bring civil actions seeking either injunctions or damages in response to violations that threaten the privacy of state residents. We cannot be sure how these regulations will be interpreted, enforced or applied to our operations. In addition to the risks associated with enforcement activities and potential contractual liabilities, our ongoing efforts to comply with evolving laws and regulations at the federal and state level may be costly and require ongoing modifications to our policies, procedures and systems. In addition to potential enforcement by HHS, we are also potentially subject to privacy enforcement from the Federal Trade Commission, or the FTC. The FTC has been particularly focused on the unpermitted processing of health and genetic data through its recent enforcement actions and is expanding the types of privacy violations that it interprets to be "unfair" under Section 5 of the Federal Trade Commission Act, as well as the types of activities it views to trigger the Health Breach Notification Rule, which the FTC also has the authority to enforce. The FTC is also in the process of developing rules related to commercial surveillance and data security that may impact our business. We will need to account for the FTC's evolving rules and guidance for proper privacy and data security practices in order to mitigate our risk for a potential enforcement action, which may be costly. If we are subject to a potential FTC enforcement action, we may be subject to a settlement order that requires us to adhere to very specific privacy and data security practices, which may impact our business. We may also be required to pay fines as part of a settlement, depending on the nature of the alleged violations. If we violate any consent order that we reach with the FTC, we may be subject to additional fines and compliance requirements. States are also active in creating specific rules relating to the processing of personal information. In 2018, California passed into law the California Consumer Privacy Act, or the CCPA, which took effect on January 1, 2020 and imposed many requirements on businesses that process the personal information of California residents. Many of the CCPA's requirements are similar to those found in the General Data Protection Regulation, or the GDPR, which is further described below, including requiring businesses to provide notice to data subjects regarding the information collected about them and how such information is used and shared, and providing data subjects the right to request access to such personal information and, in certain cases, request the erasure of such personal information. The CCPA also affords California residents the right to opt-out of the "sale" of their personal information. The CCPA contains significant penalties for companies that violate its requirements. In November 2020, California voters passed a ballot initiative for the California Privacy Rights Act, or the CPRA, which went into effect on January 1, 2023 and significantly expanded the CCPA to incorporate additional GDPR-like provisions including requiring that the use, retention and sharing of personal information of California residents be reasonably necessary and proportionate to the purposes of collection or processing, granting additional protections for sensitive personal information, and requiring greater disclosures related to notice to residents regarding retention of information. The CPRA also created a new enforcement agency – the California Privacy Protection Agency – whose sole responsibility is to enforce the CPRA and other California privacy laws, which will further increase compliance risk. The provisions in the CPRA may apply to some of our business activities. In addition to California, at least eighteen other states have passed comprehensive privacy laws similar to the CCPA and CPRA. These laws are either in effect or will go into effect over the next few years. Like the CCPA and CPRA, these laws create obligations related to the processing of personal information, as well as special obligations for the processing of "sensitive" data, which includes health data in some cases. Some of the provisions of these laws may apply to our business activities. There are also states that are strongly considering or have already passed comprehensive privacy laws during the 2024 legislative sessions that will go into effect in 2025 and beyond. Other states will be considering similar laws in the future, and Congress has also been debating passing a federal privacy law. There are also states that are specifically regulating health information that may affect our business. For example, Washington state passed a health privacy law in 2023 that regulates the collection and sharing of health information, and the law also has a private right of action, which further increases the relevant compliance risk. Connecticut and Nevada have also passed similar laws regulating consumer health data and additional states are considering such legislation. These laws may impact our business activities, including our identification of research subjects, relationships with business partners and ultimately the marketing and distribution of our products. Similar to the laws in the U.S., there are significant privacy and data security laws that apply in Europe and other countries. The collection, use, disclosure, transfer, or other processing of personal data, including personal health data, regarding individuals who are located in the European Economic Area, or the EEA, and the processing of personal data that takes place in the EEA, is regulated by the GDPR, which went into effect in May 2018 and which imposes obligations on companies that operate in our industry with respect to the processing of personal data and the cross-border transfer of such data. The GDPR imposes onerous accountability obligations requiring data controllers and processors to maintain a record of their data processing and policies. If our or our service providers' privacy or data security measures fail to comply with the GDPR requirements, we may be subject to litigation, regulatory investigations, enforcement notices requiring us to change the way we use personal data and/or fines of up to 20 million Euros or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher, as well as compensation claims by affected individuals, negative publicity, reputational harm and a potential loss of business and goodwill. The GDPR places restrictions on the cross-border transfer of personal data from the European Union to countries that have not been found by the European Union to offer adequate data protection legislation, such as the U.S. There are ongoing concerns about the ability of companies to transfer personal data from the European Union to other countries. In July 2020, the Court of Justice of the European Union, or the CJEU, invalidated the EU-U.S. Privacy Shield, one of the mechanisms used to legitimize the transfer of personal data from the EEA to the U.S. The CJEU decision also drew into question the long-term viability of an alternative means of data transfer, the standard contractual clauses, for transfers of personal data from the EEA to the U.S. Additionally, in October 2022, President Biden signed an executive order to implement the EU-U.S. Data Privacy Framework, which serves as a replacement to the EU-U.S. Privacy Shield. The European Union initiated the process to adopt an adequacy decision for the EU-U.S. Data Privacy Framework in December 2022, and the European Commission adopted the adequacy decision on July 10, 2023. The adequacy decision permits U.S. companies who self-certify to the EU-U.S. Data Privacy Framework to rely on it as a valid data transfer mechanism for data transfers from the European Union to the United States. However, some privacy advocacy groups have already suggested that they will be challenging the EU-U.S. Data Privacy Framework. If these challenges are successful, they may not only impact the EU-U.S. Data Privacy Framework, but also further limit the viability of the standard contractual clauses and other data transfer mechanisms. The uncertainty around this issue has the potential to impact our business. Following the withdrawal of the UK from the European Union, the UK Data Protection Act 2018 applies to the processing of personal data that takes place in the UK and includes parallel obligations to those set forth by GDPR. In relation to data transfers, both the UK and the European Union have determined, through separate "adequacy" decisions, that data transfers between the two jurisdictions are in compliance with the UK Data Protection Act and the GDPR, respectively. The UK and the U.S. have also agreed to a to develop a U.S.-UK "Data Bridge", which functions similarly to the EU-U.S. Data Privacy Framework and provides an additional legal mechanism for companies to transfer data from the UK to the United States. In addition to the UK, Switzerland is also in the process of approving an adequacy decision in relation to the Swiss-U.S. Data Privacy Framework (which would function similarly to the EU-U.S. Data Privacy Framework and the U.S.-UK Data Bridge in relation to data transfers from Switzerland to the United States). Any changes or updates to these developments have the potential to impact our business. Beyond GDPR and similar laws in the United States, there are privacy and data security laws in a growing number of countries around the world. While many loosely follow GDPR as a model, other laws contain different or conflicting provisions. These laws may impact our ability to conduct our business activities. While we continue to address the implications of the recent changes to data privacy regulations, data privacy remains an evolving landscape at both the domestic and international level, with new regulations coming into effect and continued legal challenges, and our efforts to comply with the evolving data protection rules may be unsuccessful. It is possible that these laws may be interpreted and applied in a manner that is inconsistent with our practices, which could adversely affect our business. We must devote significant resources to understanding and complying with this changing landscape. Failure to comply with federal, state and international laws regarding privacy and security of personal information could expose us to fines and penalties under such laws. Any such failure to comply with data protection and privacy laws could result in government-imposed fines, penalties or orders requiring that we change our practices, claims for damages or other liabilities, regulatory investigations and enforcement actions, litigation and significant costs for remediation, reputational harm, diminished profits and earnings, additional reporting requirements and/or oversight, any of which could adversely affect our business, our results of operations or prospects. We also face a threat of consumer class actions related to these laws and the overall protection of personal data. Even if we are not determined to have violated these laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity, which could harm our reputation and our business, financial condition, results of operations or prospects.

We focus our research and product development on treatments for rare diseases. Given the small number of patients who have the diseases that we are targeting, it is critical to our ability to grow and become profitable that we continue to successfully identify patients with these rare diseases. Our projections of both the number of people who have these diseases, as well as the subset of people with these diseases who have the potential to benefit from treatment with any product candidates we may develop, are based on our beliefs and estimates. These estimates have been derived from a variety of sources, including the scientific literature, surveys of clinics, patient foundations or market research that we conducted, and may prove to be incorrect or contain errors. New studies may change the estimated incidence or prevalence of these diseases. The number of patients may turn out to be lower than expected. The effort to identify patients with diseases we seek to treat is in early stages, and we cannot accurately predict the number of patients for whom treatment might be possible. Additionally, the potentially addressable patient population for each of our product candidates may be limited or may not be amenable to treatment with our product candidates, and new patients may become increasingly difficult to identify or gain access to, which would adversely affect our results of operations and our business. Further, even if we obtain significant market share for our product candidates, because the potential target populations are very small, we may never achieve profitability despite obtaining such significant market share. Our target patient populations are relatively small, and there is currently no standard of care treatment directed at some of our target indications, such as FSHD. As a result, the pricing and reimbursement of any product candidates we may develop, if approved, is uncertain, but must be adequate to support commercial infrastructure. If we are unable to obtain adequate levels of reimbursement, our ability to successfully market and sell product candidates will be adversely affected.

Our results of operations could be adversely affected by general conditions in the global economy and in the global financial markets. For example, the 2008 global financial crisis caused extreme volatility and disruptions in the capital and credit markets. A severe or prolonged economic downturn resulting from a pandemic, such as the COVID-19 pandemic, could result in a variety of risks to our business, including weakened demand for any product candidates we may develop. A weak or declining economy could also strain our suppliers, possibly resulting in supply disruption. If the current equity and credit markets deteriorate, it may make any necessary debt or equity financing more difficult, more costly, and more dilutive. Failure to secure any necessary financing in a timely manner and on favorable terms could impair our ability to achieve our growth strategy, could harm our financial performance and stock price and could require us to delay or abandon clinical development plans. In addition, there is a risk that our current or future service providers, manufacturers or other collaborators may not survive such difficult economic times, which could directly affect our ability to attain our operating goals on schedule and on budget. We cannot anticipate all of the ways in which the current economic climate and financial market conditions could adversely impact our business.

We depend on our employees, consultants, CMOs and CROs, as well as regulatory agencies and other parties, for the continued operation of our business. Although we maintain disaster recovery plans, they might not adequately protect us. Despite any precautions we take for natural disasters or other catastrophic events, these events, including terrorist attack,pandemics, hurricanes, fire, floods and ice and snowstorms, could result in significant disruptions to our research and development, preclinical studies, clinical trials, and, ultimately, commercialization of our products. Long-term disruptions in the infrastructure caused by events, such as natural disasters, the outbreak of war, the escalation of hostilities and acts of terrorism or other ‘‘acts of God,'' particularly involving cities in which we have offices, manufacturing or clinical trial sites, could adversely affect our businesses. Although we carry business interruption insurance policies and typically have provisions in our contracts that protect us in certain events, our coverage might not respond or be adequate to compensate us for all losses that may occur. Any natural disaster or catastrophic event affecting us, our CMOs or CROs, regulatory agencies or other parties with which we are engaged could have a significant negative impact on our operations and financial performance.