HeartCore Enterprises, Inc. (HTCR) Risk Factors

To increase total customers and achieve broader market acceptance of our software, we will need to expand our digital marketing, task and process mining, content management, customer experience management, and robotic process automation operations, including our sales force and third-party channel partners. We will continue to dedicate significant resources to inbound sales and marketing programs. The effectiveness of our inbound sales and marketing and third-party channel partners has varied over time and may vary in the future and depends on our ability to maintain and improve our digital marketing, task and process mining, content management, customer experience management, and robotic process automation capabilities. All of these efforts will require us to invest significant financial and other resources. Our business will be seriously harmed if our efforts do not generate a correspondingly significant increase in revenue. We may not achieve anticipated revenue growth from expanding our sales force if we are unable to hire, develop and retain talented sales personnel, if our new sales personnel are unable to achieve desired productivity levels in a reasonable period of time or if our sales and marketing programs are not effective.

Our success is dependent, in part, upon protecting our proprietary technology. We rely on a combination of copyrights, trademarks, service marks, trade secret laws and contractual restrictions to establish and protect our proprietary rights in our products and services. However, the steps we take to protect our intellectual property may be inadequate. We will not be able to protect our intellectual property if we are unable to enforce our rights or if we do not detect unauthorized use of our intellectual property. Any of our trademarks or other intellectual property rights may be challenged by others or invalidated through administrative process or litigation. Furthermore, legal standards relating to the validity, enforceability and scope of protection of intellectual property rights are uncertain. Despite our precautions, it may be possible for unauthorized third parties to copy our technology and use information that we regard as proprietary to create products and services that compete with ours. Some license provisions protecting against unauthorized use, copying, transfer and disclosure of our offerings may be unenforceable under the laws of certain jurisdictions and foreign countries. In addition, the laws of some countries do not protect proprietary rights to the same extent as the laws of Japan or the United States. To the extent we expand our international activities, our exposure to unauthorized copying and use of our technology and proprietary information may increase. We enter into confidentiality and invention assignment agreements with our employees and consultants and enter into confidentiality agreements with the parties with whom we have strategic relationships and business alliances. No assurance can be given that these agreements will be effective in controlling access to and distribution of our products and proprietary information. Further, these agreements may not prevent our competitors from independently developing technologies that are substantially equivalent or superior to our software and offerings. We may be required to spend significant resources to monitor and protect our intellectual property rights. Litigation may be necessary in the future to enforce our intellectual property rights and to protect our trade secrets. Such litigation could be costly, time consuming and distracting to management and could result in the impairment or loss of portions of our intellectual property. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights. Our inability to protect our proprietary technology against unauthorized copying or use, as well as any costly litigation, could delay further sales or the implementation of our software and offerings, impair the functionality of our software and offerings, delay introductions of new features or enhancements, result in our substituting inferior or more costly technologies into our software and offerings, or injure our reputation.

Our software and its underlying infrastructure are inherently complex and may contain material defects or errors. We release modifications, updates, bug fixes and other changes to our software several times per day, without traditional human-performed quality control reviews for each release. We have from time to time found defects in our software and may discover additional defects in the future. We may not be able to detect and correct defects or errors before customers begin to use our software or its applications. Consequently, we or our customers may discover defects or errors after our software has been implemented. In the past, we have experienced software outages caused by power supply failures. Although no data was lost due to the outages, our customers experienced disruptions in using our software as our website stopped operating as well as our marketing campaigns, e-mail newsletters and other functions were shut down. Notwithstanding, the outages were short in duration and we are not aware of any negative customer reviews and negative press as a result of the outages. We believe there was no significant damage to our customer relationships, reputation and brand due to these outages. We believe the outage did not compromise our ability to meet customer expectations, manage our software, or meet our operating efficiency and profitability goals. Defects or errors could result in product outages and could also cause inaccuracies in the data we collect and process for our customers, or even the loss, damage or inadvertent release of such confidential data. We implement bug fixes and upgrades as part of our regular system maintenance, which may lead to system downtime. Even if we are able to implement the bug fixes and upgrades in a timely manner, any history of product outages, defects or inaccuracies in the data we collect for our customers, or the loss, damage or inadvertent release of confidential data could cause our reputation to be harmed, and customers may elect not to purchase or renew their agreements with us. Furthermore, these issues could subject us to service performance credits (whether offered by us or required by contract), warranty claims or increased insurance costs. The costs associated with product outages, any material defects or errors in our software or other performance problems may be substantial and could materially adversely affect our operating results. In addition, third-party apps and features on our software may not meet the same quality standards that we apply to our own development efforts and, to the extent they contain bugs, vulnerabilities or defects, they may create disruptions in our customers' use of our products, lead to data loss, unauthorized access to customer data, damage our brand and reputation and affect the continued use of our products, any of which could harm our business, results of operations and financial condition.

Our business activities are subject to various restrictions under U.S. export controls and trade and economic sanctions laws, including the U.S. Commerce Department's Export Administration Regulations and economic and trade sanctions regulations maintained by the U.S. Treasury Department's Office of Foreign Assets Control. If we fail to comply with these laws and regulations, we and certain of our employees could be subject to civil or criminal penalties and reputational harm. Obtaining the necessary authorizations, including any required license, for a particular transaction may be time-consuming, is not guaranteed, and may result in the delay or loss of sales opportunities. Furthermore, U.S. export control laws and economic sanctions laws prohibit certain transactions with U.S. embargoed or sanctioned countries, governments, persons and entities. Although we take precautions to prevent transactions with U.S. sanction targets, the possibility exists that we could inadvertently provide our solutions to persons prohibited by U.S. sanctions. This could result in negative consequences to us, including government investigations, penalties and reputational harm.

As a multinational organization, we may be subject to taxation in several jurisdictions around the world with increasingly complex tax laws, the application of which can be uncertain. The amount of taxes we pay in these jurisdictions could increase substantially as a result of changes in the applicable tax principles, including increased tax rates, new tax laws or revised interpretations of existing tax laws and precedents, which could have a material adverse effect on our liquidity and operating results. In addition, the authorities in these jurisdictions could review our tax returns and impose additional tax, interest and penalties, and the authorities could claim that various withholding requirements apply to us or our subsidiary or assert that benefits of tax treaties are not available to us or our subsidiary, any of which could have a material impact on us and the results of our operations.

Our handling of data is subject to a variety of laws and regulations, including regulation by various government agencies, including the Ministry of Internal Affairs and Communications, Personal Information Protection Commission Japan (the "PPCJ"), the U.S. Federal Trade Commission (the "FTC"), and various state, local and foreign agencies. We collect personally identifiable information and other data from our customers and leads. We also handle personally identifiable information about our customers' customers. We use this information to provide services to our customers, to support, expand and improve our business. We may also share customers' personally identifiable information with third parties as authorized by the customer or as described in our privacy policy. The Japanese and U.S. federal and various state and foreign governments have adopted or proposed limitations on the collection, distribution, use and storage of personal information of individuals. In the United States, the FTC and many state attorneys general are applying federal and state consumer protection laws, and in Japan, the PPCJ are issuing orders and guidelines based on the Personal Information Protection Act, as imposing standards for the online collection, use and dissemination of data. However, these obligations may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other requirements or our practices. Any failure or perceived failure by us to comply with privacy or security laws, policies, legal obligations or industry standards or any security incident that results in the unauthorized release or transfer of personally identifiable information or other customer data may result in governmental enforcement actions, litigation, fines and penalties and/or adverse publicity, and could cause our customers to lose trust in us, which could have an adverse effect on our reputation and business. Laws and regulations concerning privacy, data protection and information security are evolving, and changes to such laws and regulations could require us to change features of our software or restrict our customers' ability to collect and use email addresses, page viewing data and personal information, which may reduce demand for our software. Our failure to comply with national, federal, state and international data privacy laws and regulations could harm our ability to successfully operate our business and pursue our business goals. For example, California recently enacted the California Consumer Privacy Act (the "CCPA") that, among other things, require covered companies to provide new disclosures to California consumers and afford such consumers new abilities to opt-out of certain sales of personal information. The CCPA recently was amended and it is not yet fully clear how the CCPA will be enforced and how certain of its requirements will be interpreted. We cannot yet predict the impact of the CCPA on our business or operations, but it may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply. Additionally, a new California ballot initiative, the California Privacy Rights Act (the "CPRA") was passed in November 2020 and became effective starting on January 1, 2023, the CPRA imposes additional obligations on companies covered by the legislation and will significantly modify the CCPA, including by expanding consumers' rights with respect to certain sensitive personal information. The CPRA also creates a new state agency that will be vested with authority to implement and enforce the CCPA and the CPRA. The effects of the CCPA and the CPRA are potentially significant and may require us to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and/or litigation. Certain other state laws impose similar privacy obligations and we also expect anticipate that more states to may enact legislation similar to the CCPA, which provides consumers with new privacy rights and increases the privacy and security obligations of entities handling certain personal information of such consumers. The CCPA has prompted a number of proposals for new federal and state-level privacy legislation. Such proposed legislation, if enacted, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies. In addition, on March 2, 2021, Virginia enacted the Consumer Data Protection Act (the "CDPA"), which become effective on January 1, 2023. The CDPA regulates how businesses (which the CDPA refers to as "controllers") collect and share personal information. While the CDPA incorporates many similar concepts of the CCPA and CPRA, there are also several key differences in the scope, application, and enforcement of the law that will change the operational practices of controllers. The new law impacts how controllers collect and process personal sensitive data, conduct data protection assessments, transfer personal data to affiliates, and respond to consumer rights requests. In addition, several foreign jurisdictions, including the European Union and Canada, have regulations dealing with the collection and use of personal information obtained from their residents, which are often more restrictive than those in the U.S. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, disclosure and security of personal information that identifies or may be used to identify an individual. In relevant part, these laws and regulations may affect our ability to engage in lead generation activities by imposing heightened requirements, such as affirmative opt-ins or consent prior to sending commercial correspondence or engaging in electronic tracking activities. For example, a recent ruling of the European Court of Justice in Case C-673/17 provides that a pre-checked opt-in is insufficient to constitute a valid active consumer consent to cookie storage. In order to obtain "the adequate protection" status under the European Union's General Data Protection Regulation (the "GDPR"), the Japanese laws and regulations in this area were amended as much as practically possible by January 23, 2019 and thus the collection, use and transfer of personal data is similarly restricted. Within the European Union, legislators have adopted the GDPR and which became effective in May 2018 which may impose additional obligations and risk upon our business and which may increase substantially the penalties to which we could be subject in the event of any non-compliance. In addition, further to the United Kingdom's exit from the European Union on January 31, 2020, the GDPR ceased to apply in the United Kingdom at the end of the transition period on December 31, 2020. However, as of January 1, 2021, the United Kingdom's European Union (Withdrawal) Act 2018 incorporated the GDPR (as it existed on December 31, 2020 but subject to certain United Kingdom specific amendments) into United Kingdom law (the "UK GDPR"). The UK GDPR and the UK Data Protection Act 2018 set out the United Kingdom's data protection regime, which is independent from but aligned to the European Union's data protection regime. Non-compliance with the UK GDPR may result in monetary penalties of up to £17.5 million or 4% of worldwide revenue, whichever is higher. The United Kingdom, however, is now regarded as a third country under the European Union's GDPR which means that transfers of personal data from the European Economic Area to the United Kingdom will be restricted unless an appropriate safeguard, as recognized by the European Union's GDPR, has been put in place. However, under the EU-UK Trade Cooperation Agreement it is lawful to transfer personal data between the United Kingdom and the European Economic Area for a 6 month period following the end of the transition period, with a view to achieving an adequacy decision from the European Commission during that period. Like the GDPR, the UK GDPR restricts personal data transfers outside the United Kingdom to countries not regarded by the United Kingdom as providing adequate protection (this means that personal data transfers from the United Kingdom to the European Economic Area remain free flowing). On July 12, 2016, the European Commission adopted the EU-US Privacy Shield, a framework for the transfer of personal data from the European Union to the United States, as a successor to the Safe Harbor framework that was invalidated by the European Court of Justice in October 2015. On July 16, 2020, the European Court of Justice invalidated the EU–US Privacy Shield ruling that it failed to offer adequate protections for European Union personal data transferred to the United States. The European Court of Justice, in the same decision, deemed that the Standard Contractual Clauses ("SCCs"), approved by the European Commission for transfers of personal data between European Union controllers and non-European Union processors are valid, however the European Court of Justice deemed that transfers made pursuant to the SCCs need to be analyzed on a case-by-case basis to ensure the European Union's standards of data protection are met. Our customer agreements include SCCs. However, as a result of this decision, companies may be required to adopt additional measures to accomplish transfers of personal data to the United States and other third countries in compliance with the GDPR, and there continue to be concerns about whether the SCCs will face additional challenges. Until the remaining legal uncertainties regarding how to legally continue these transfers are settled, we will continue to face uncertainty as to whether our customers will be permitted to transfer personal data to the United States for processing by us as part of our software services. If such data transfer to the United States is not permitted, it could have a negative effect on our existing business and on our ability to attract and retain new customers. Our customers may view alternative data transfer mechanisms as being too costly, too burdensome, too legally uncertain or otherwise objectionable and therefore decide not to do business with us. For example, some of our customers or potential customers who do business in the European Union may require their vendors to host all personal data within the European Union and may decide to do business with one of our competitors who hosts personal data within the European Union instead of doing business with us. The regulatory framework governing the collection, processing, storage, use and sharing of certain information, particularly financial and other personal information, is rapidly evolving and is likely to continue to be subject to uncertainty and varying interpretations. It is possible that these laws may be interpreted and applied in a manner that is inconsistent with our existing data management practices or the features of our services and software capabilities. Any failure or perceived failure by us, or any third parties with which we do business, to comply with our posted privacy policies, changing consumer expectations, evolving laws, rules and regulations, industry standards, or contractual obligations to which we or such third parties are or may become subject, may result in actions or other claims against us by governmental entities or private actors, the expenditure of substantial costs, time and other resources or the incurrence of significant fines, penalties or other liabilities. In addition, any such action, particularly to the extent we were found to be guilty of violations or otherwise liable for damages, would damage our reputation and adversely affect our business, financial condition and results of operations. We publicly post documentation regarding our practices concerning the collection, processing, use and disclosure of data. Although we endeavor to comply with our published policies and documentation, we may at times fail to do so or be alleged to have failed to do so. Any failure or perceived failure by us to comply with our privacy policies or any applicable privacy, security or data protection, information security or consumer-protection related laws, regulations, orders or industry standards could expose us to costly litigation, significant awards, fines or judgments, civil and/or criminal penalties or negative publicity, and could materially and adversely affect our business, financial condition and results of operations. The publication of our privacy policy and other documentation that provide promises and assurances about privacy and security can subject us to potential state and federal action if they are found to be deceptive, unfair, or misrepresentative of our actual practices, which could, individually or in the aggregate, materially and adversely affect our business, financial condition and results of operations. If our privacy or data security measures fail to comply with current or future laws and regulations, we may be subject to claims, legal proceedings or other actions by individuals or governmental authorities based on privacy or data protection regulations and our commitments to customers or others, as well as negative publicity and a potential loss of business. Moreover, if future laws and regulations limit our subscribers' ability to use and share personal information or our ability to store, process and share personal information, demand for our solutions could decrease, our costs could increase, and our business, results of operations and financial condition could be harmed.

If our customers fail to pay us in accordance with the terms of our agreements, we may be adversely affected both from the inability to collect amounts due and the cost of enforcing the terms of our agreements, including litigation and arbitration costs. The risk of these issues increases with the term length of our customer arrangements. Furthermore, some of our customers may seek bankruptcy protection or other similar relief and fail to pay amounts due to us, or pay those amounts more slowly, either of which could adversely affect our results of operations, financial condition and cash flow.

To execute our business strategy, we must attract and retain highly qualified personnel. In particular, we compete with many other companies for software developers with high levels of experience in designing, developing and managing cloud-based software, as well as for skilled information technology, marketing, sales and operations professionals, and we may not be successful in attracting and retaining the professionals we need. Also, inbound sales, marketing, services, and content management domain experts are very important to our success and are difficult to replace. We have from time to time in the past experienced, and we expect to continue to experience in the future, difficulty in hiring and difficulty in retaining highly skilled employees with appropriate qualifications. In particular, we have experienced a competitive hiring environment in Japan, where we are headquartered and will continue to experience a competitive hiring environment as we recruit for remote talent worldwide. Many of the companies with which we compete for experienced personnel have greater resources than we do. In addition, in making employment decisions, particularly in the software industry, job candidates often consider the value of the stock options or other equity incentives they are to receive in connection with their employment. If the price of our stock declines, or experiences significant volatility, our ability to attract or retain key employees will be adversely affected. If we fail to attract new personnel or fail to retain and motivate our current personnel, our growth prospects could be severely harmed.