InMode (INMD) Risk Factors

The ability of the FDA to review and approve new products can be affected by a variety of factors, including government budget and funding levels, ability to hire and retain key personnel and accept the payment of user fees, and statutory, regulatory, and policy changes. Average review times at the agency have fluctuated in recent years as a result. In addition, government funding of other government agencies that fund research and development activities is subject to the political process, which is inherently fluid and unpredictable. Disruptions at the FDA and other agencies may also slow the time necessary for new devices to be reviewed and/or cleared by necessary government agencies, which would adversely affect our business. For example, over the last several years, including for 35 days beginning on December 22, 2018, the U.S. government has shut down several times and certain regulatory agencies, such as the FDA, have had to furlough critical FDA employees and stop critical activities. Separately, in response to the global COVID-19 pandemic, on March 10, 2020, the FDA announced its intention to postpone most foreign inspections of manufacturing facilities and products through April 2020, and subsequently, on March 18, 2020, the FDA temporarily postponed routine surveillance inspections of domestic manufacturing facilities. Subsequently, on July 10, 2020, the FDA announced its intention to resume certain on-site inspections of domestic manufacturing facilities subject to a risk-based prioritization system. The FDA intends to use this risk-based assessment system to identify the categories of regulatory activity that can occur within a given geographic area, ranging from mission critical inspections to resumption of all regulatory activities. Regulatory authorities outside the United States may adopt similar restrictions or other policy measures in response to the COVID-19 pandemic. If a prolonged government shutdown occurs, or if global health concerns continue to prevent the FDA or other regulatory authorities from conducting their regular inspections, reviews, or other regulatory activities, it could significantly impact the ability of the FDA or other regulatory authorities to timely review and process our regulatory submissions, which could have a material adverse effect on our business.

We have experienced significant growth in our operations, and the number of our employees has significantly increased since inception. This growth has placed significant demands on our management, as well as our financial and operational resources. In order to achieve our business objectives, we will need to continue to grow our business. Continued growth would increase the challenges involved in: - implementing appropriate operational and financial systems;- expanding our sales and marketing infrastructure and capabilities;- ensuring compliance with applicable Food and Drug Administration, or FDA, and other regulatory requirements;- providing adequate training and supervision to maintain high quality standards; and - preserving our culture and values. If our growth continues, it will require that we continue to develop and improve our operational, financial and other internal controls. If we cannot scale and manage our business appropriately, we will not realize our projected growth and our financial results will suffer.

Our business is heavily dependent on the security of our IT networks. Internal or external attacks on any of those could disrupt the normal operations of our engagements and impede our ability to provide services to our customers, thereby subjecting us to liability under our contracts. Additionally, our business involves the use, storage and transmission of information about our employees, our customers and clients of our customers. Attacks upon information technology systems are increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise. Furthermore, because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. We may also experience security breaches that may remain undetected for an extended period. While we take measures to protect the security of, and unauthorized access to, our systems, as well as the privacy of personal and proprietary information, it is possible that our security controls of our systems, as well as other security practices we follow or those systems of our customers which we rely upon, may not prevent the improper access to or disclosure of personally identifiable or proprietary information. Such disclosure could harm our reputation and subject us to liability under our contracts and laws that protect personal data, resulting in increased costs or loss of revenue. Further, the global data protection landscape is rapidly evolving, and we are or may become subject to numerous state, federal and foreign laws, requirements and regulations governing the collection, use, disclosure, retention, and security of personal data, such as information that we may collect about individuals in the U.S. and abroad. Implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, standards, or perception of their requirements may have on our business. This evolution may create uncertainty in our business, affect our ability to operate in certain jurisdictions or to collect, store, transfer use and share personal information, necessitate the acceptance of more onerous obligations in our contracts, result in liability or impose additional costs on us. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the future. Any failure or perceived failure by us to comply with federal, state or foreign laws or regulation, our internal policies and procedures or our contracts governing our processing of personal information could result in negative publicity, government investigations and enforcement actions, claims by third parties and damage to our reputation, any of which could have a material adverse effect on our operations, financial performance and business. As our operations and business grow, we may become subject to or affected by new or additional data protection laws and regulations and face increased scrutiny or attention from regulatory authorities. We are subject to U.S. federal and state laws regarding data privacy and security including Section 5 of the Federal Trade Commission Act, or FTC Act, the California Consumer Privacy Act, or the CCPA and the California Privacy Rights Act, or the CPRA. Further, the Health Insurance Portability and Accountability Act of 1996, as amended, and regulations implemented thereunder, or HIPAA, imposes, among other things, certain standards relating to the privacy, security, transmission and breach reporting of individually identifiable health information. Even when HIPAA does not apply, according to the FTC, failing to take appropriate steps to keep consumers' personal information secure may constitute unfair acts or practices in or affecting commerce in violation of the Federal Trade Commission Act. The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Federal and state consumer protection laws are increasingly being applied by the FTC, and states' attorneys general to regulate the collection, use, storage and disclosure of personal or personally identifiable information, through websites or otherwise, and to regulate the presentation of website content. Certain states have also adopted comparable privacy and security laws and regulations, some of which may be more stringent than HIPAA. In addition, the CCPA went into effect on January 1, 2020. The CCPA creates individual privacy rights for California consumers and increases the privacy and security obligations of entities handling certain personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA may increase our compliance costs and potential liability, and many similar laws have been proposed at the federal level and in other states. Further, the CPRA, recently passed in California. The CPRA will impose additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It will also create a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. The majority of the provisions will go into effect on January 1, 2023, and additional compliance investment and potential business process changes may be required. In the event that we are subject to or affected by HIPAA, the CCPA, the CPRA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition. We are also subject to foreign data privacy and security laws, including the Israeli Protection of Privacy Law of 1981 and the Privacy Protection Regulations (Data Security) 5777-2017 and the General Data Protection Regulation, or GDPR. The GDPR went into effect in May 2018 and imposes strict requirements for processing the personal data of individuals within the European Economic Area, or the EEA. Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and significant penalties for non-compliance, including potential fines for noncompliance of up to €20 million or 4% of the annual global revenues of the noncompliant company, whichever is greater. Since January 1, 2021, we have been subject to the GDPR and also the United Kingdom GDPR, which, together with the amended United Kingdom Data Protection Act 2018, retains the GDPR in UK national law. The UK GDPR mirrors the fines under the GDPR, e.g., fines up to the greater of €20 million (£17.5 million) or 4% of global turnover. The relationship between the United Kingdom and the European Union in relation to certain aspects of data protection law remains unclear, and it is unclear how United Kingdom data protection laws and regulations will develop in the medium to longer term, and how data transfers to and from the United Kingdom will be regulated in the long term. It is not clear whether (and when) an adequate decision may be granted by the European Commission enabling data transfers from European Union member states to the United Kingdom long term without additional measures. These changes will lead to additional costs and increase our overall risk exposure. Legal developments in Europe have created complexity and uncertainty regarding transfers of personal data from the EEA and the United Kingdom to the United States. On July 16, 2020, the Court of Justice of the European Union, or the CJEU, invalidated the EU-US Privacy Shield Framework, or the Privacy Shield, under which personal data could be transferred from the EEA to US entities who had self-certified under the Privacy Shield scheme. While the CJEU upheld the adequacy of the standard contractual clauses (a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism, and potential alternative to the Privacy Shield), it made clear that reliance on them alone may not necessarily be sufficient in all circumstances. Use of the standard contractual clauses must now be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals and additional measures and/or contractual provisions may need to be put in place, however, the nature of these additional measures is currently uncertain. The CJEU went on to state that if a competent supervisory authority believes that the standard contractual clauses cannot be complied with in the destination country and the required level of protection cannot be secured by other means, such supervisory authority is under an obligation to suspend or prohibit that transfer. These recent developments may require us to review and amend the legal mechanisms by which we make and/or receive personal data transfers to/in the U.S. As supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the standard contractual clauses cannot be used, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results. Our failure to adhere to or successfully implement processes in response to changing regulatory requirements in this area could result in legal liability or impairment to our reputation in the marketplace, which could have a material adverse effect on our business, financial condition and results of operations. In the course of providing services to our customers, we may have access to confidential customer information, including nonpublic personal data. We are bound by certain agreements to use and disclose this information in a manner consistent with the privacy standards under regulations applicable to our customers and are subject to numerous U.S. and foreign jurisdiction laws and regulations designed to protect this information, such as the GDPR and various U.S. federal and state laws governing the protection of health or other individually identifiable information. If any person, including a team member of ours, misappropriates customer confidential information, or if customer confidential information is inappropriately disclosed due to a security breach of our computer systems, system failures or otherwise, we may have substantial liabilities to our customers or our customers' clients and may incur substantial liability and penalties in connection with any violation of applicable privacy laws and/or criminal prosecution. In addition, in the event of any breach or alleged breach of our confidentiality agreements with our customers, these customers may terminate their engagements with us or sue us for breach of contract, resulting in the associated loss of revenue and increased costs and damaged reputation. We may also be subject to civil or criminal liability if we are deemed to have violated applicable regulations. We cannot assure you that we will adequately address the risks created by the regulations to which we may be contractually obligated to abide. Although we work to comply with applicable laws, regulations and standards, our contractual obligations and other legal obligations, these requirements are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another or other legal obligations with which we must comply. Any failure or perceived failure by us or our employees, representatives, contractors, consultants, collaborators, or other third parties to comply with such requirements or adequately address privacy and security concerns, even if unfounded, could result in additional cost and liability to us, damage our reputation, and adversely affect our business and results of operations.

The outbreak of the COVID-19 global pandemic is evolving and ongoing. The extent to which the coronavirus, as it evolves, impacts our business and operating results will depend on future developments that are highly uncertain and cannot be accurately predicted, including new information that may emerge concerning the coronavirus and the actions to contain the coronavirus or treat its impact, among others. The spread of the evolving and ongoing coronavirus and its variants, which has caused and continues to cause a broad impact globally, including recurring restrictions on travel, a shifting workforce to working remotely and quarantine policies put into place by businesses and governments, may have a material economic effect on our business. Also, healthcare facilities in many countries may ban or restrict elective procedures in areas hard hit with rising infection rates. Many of our products are used in aesthetic elective procedures, and, as such, the bans on elective procedures may substantially affect our sales and marketing efforts. While we have a distributed workforce and our employees are accustomed to working remotely or working with other remote employees, our workforce was not trained to be fully remote. Our employees travel frequently to establish and maintain relationships with one another, as well as with our customers and distributors. Much of that travel has been halted intermittently as many countries have implemented restrictions that prevented our salespersons from attending conferences or meeting customers in person. In response, we have been required to continue sales effort by using remote tools. We continue to monitor the situation and may adjust our current policies as more information and public health guidance become available. The continued suspension of travel and doing business in person may negatively affect our customer success efforts and sales and marketing efforts, slow down our recruiting efforts, or create operational or other challenges, any of which could harm our business and results of operations. It is possible that continued widespread remote work arrangements may have a negative impact on our operations, the execution of our business plans, the productivity and availability of key personnel and other employees necessary to conduct our business, and on third-party service providers who perform critical services for us, or otherwise cause operational failures due to changes in our normal business practices necessitated by the outbreak and related governmental actions. If a natural disaster, power outage, connectivity issue or other event occurred that impacted our employees' ability to work remotely, it may be difficult or, in certain cases, impossible for us to continue our business for a substantial period of time. The continuation of remote working may also result in privacy, data protection, data security and fraud risks, and our understanding of applicable legal and regulatory requirements, as well as the latest guidance from regulatory authorities in connection with the COVID-19 pandemic, may be subject to legal or regulatory challenge, particularly as regulatory guidance evolves in response to future developments. While the potential economic impact brought by and the duration of the pandemic may be difficult to assess or predict, it has already caused, and is likely to result in further, significant disruption of global financial markets, which may reduce our ability to access capital either at all or on favorable terms. In addition, a recession, depression or other sustained adverse market event resulting from the spread of the coronavirus could materially and adversely affect our business and the value of our ordinary shares. The ultimate impact of the pandemic, or any other health epidemic, is highly uncertain and will depend on future developments, such as the ultimate duration and scope of the outbreak (including any future waves or strains of the virus), the continued development, distribution and adoption of effective vaccines and medicines, the improvement of healthcare outcomes, its impact on our customers, and suppliers, and how quickly normal economic conditions can resume. We do not yet know the full extent of potential delays or impacts on our business, our clinical trials, our research programs, healthcare systems or the global economy as a whole. However, these effects could have a material adverse effect on our business, financial condition and results of operations, and cash flows.

A majority of our revenues and a substantial portion of our expenses are denominated in U.S. dollars. However, a portion of our revenues and a portion of our costs, including personnel and some marketing and facilities expenses, are incurred in NIS, Canadian dollars and Euros. Inflation in Israel or Europe may have the effect of increasing the U.S. dollar cost of our operations in that country. If the U.S. dollar declines in value in relation to one or more of these currencies, it will become more expensive for us to fund our operations in the countries that use those other currencies. To date, we have not found it necessary to hedge the risks associated with fluctuations in currency exchange rates. In the future, if we do not successfully engage in hedging transactions, our results of operations may be subject to losses from fluctuations in foreign currency exchange rates.

The use, misuse or off-label use of our products may harm our reputation or the image of our products in the marketplace, result in injuries that lead to product liability suits, which could be costly to our business, or result in legal sanctions if we are deemed or alleged to have engaged in off-label promotion. A medical device may be authorized by the FDA for marketing through several regulatory mechanisms. The FDA classifies medical devices as Class I, Class II, or Class III, in increasing order of risk. Most of our products are Class I or Class II medical devices. As such, they are either exempt from premarketing authorization requirements or are subject to the 510(k) clearance process, and all are listed with the FDA pursuant to FDA's medical device listing requirements. Under FDA regulations, for each of our products we must only use labeling, including advertising and promotional materials, that is consistent with the specific indication(s) for use included in the FDA exemption regulation, clearance, or approval, that is applicable to the specific product. If the FDA or other authorities determine that our promotional or training materials constitute the unlawful promotion of an off-label use, they could request that we modify our training or promotional materials and/or subject us to regulatory or enforcement actions, including the issuance of an untitled letter, a warning letter, civil money penalties, seizure, injunction or criminal fines and penalties. For example, on July 30, 2018, we received a letter, dated July 24, 2018, from the FDA seeking information as to the regulatory bases for marketing of our FormaV and FractoraV handpieces based on our promotion and labeling of these devices for use in certain women's health conditions and procedures. We informed the FDA that the FormaV had received 510(k) clearance for the temporary relief of minor muscle aches and pain, temporary relief of muscle spasm, and temporary improvement of local blood circulation and that we had determined that the device also fell within a Class II premarketing exemption enabling marketing of the device for therapeutic use in the treatment of sexual dysfunction or as an adjunct to Kegel's exercise (tightening of the muscles of the pelvic floor to increase muscle tone) without the need to obtain a 510(k) clearance. We also informed the FDA that the FractoraV has received 510(k) clearance for use in dermatologic and general surgical procedures for electrocoagulation and hemostasis. In addition, we advised the FDA that we have modified our promotional and labeling materials to remove statements using the terms "sexual dysfunction," "vaginal rejuvenation" or "urinary stress incontinence," which were the subject of the agency's letter to us. The FDA responded in September 2018 by stating that the agency had reviewed our response letter and verified the changes in terminology made to our website. Moreover, the FDA further responded in November 2018 and confirmed we addressed all items raised by the agency in its letter, and that the FDA continued to expect us to conduct a review of our marketing and promotional materials to make appropriate changes and remove materials containing uncleared claims regarding this matter. We have received no further communications from the agency regarding this matter. We cannot be certain whether any further information may be requested by the FDA in the future and/or any further action may be required on our part, and we cannot guarantee that the FDA will continue to deem our response and actions to have addressed all items raised by the agency in this matter. If the FDA issues a further communication finding that some or all of our modifications to our marketing and labeling materials are insufficient, or otherwise takes the position that our products are being marketed for off-label uses, we could be subject to further discussions with and/or action by the agency, including the possibility of a warning letter or other enforcement activity. Other federal, state or foreign governmental authorities might also take action if they consider our promotion or training materials to constitute promotion of an uncleared or unapproved use, which could result in significant fines or penalties under other statutory authorities, such as laws prohibiting false claims for reimbursement, or exclusion from participation in federal health programs. In each event, our reputation could be damaged and the use of our products in the marketplace could be impaired, or our business could face significant hardship. While no third-party claims have been brought against us to date, it is possible that the FDA letter may lead to private litigation by third parties, potentially including purchasers of FormaV and FractoraV handpieces or patients who were treated using those handpieces. In addition, there may be increased risk of injury if physicians or others attempt to use our products off-label. The FDA does not restrict or regulate a physician's use of a medical product within the practice of medicine, and we cannot prevent a physician from using our products for an off-label use. The use of our products for indications other than those for which our products have been approved or cleared by the FDA may not effectively treat the conditions not referenced in product indications, which could harm our reputation in the marketplace among physicians and patients. Physicians may also misuse our products or use improper techniques if they are not adequately trained in the particular use, potentially leading to injury and an increased risk of product liability. Product liability claims are expensive to defend and could divert management's attention from our primary business and result in substantial damage awards against us. Any of these events could harm our business, results of operations and financial condition.