iSpecimen (ISPC) Risk Analysis

We have limited directors' and officers' liability insurance and commercial liability insurance policies. Claims by third parties against us may exceed policy amounts and we may not have amounts to cover these claims. Also, due to high self-insured retention costs and deductibles, we may incur significant costs from any claim made against us before insurance policies provide coverage. Any significant claims would have a material adverse effect on our business, financial condition, and results of operations. In addition, our limited directors' and officers' liability insurance may affect our ability to attract and retain directors and officers.

Should our officers and/or directors require us to contribute to their defense, we may be required to spend significant amounts of our capital. Our certificate of incorporation, as amended, and bylaws, as amended, also provide for the indemnification of our directors, officers, employees, and agents, under certain circumstances, against attorney's fees and other expenses incurred by them in any litigation to which they become a party arising from their association with or activities on behalf of our Company. This indemnification policy could result in substantial expenditures, which we may be unable to recoup. If these expenditures are significant or involve issues which result in significant liability for our key personnel, we may be unable to continue operating as a going concern.

States and other jurisdictions have varying policies regarding when a company has a taxable presence in their locale. We are required to collect taxes on taxable sales in prior years but we failed to do so and thus have incurred losses from sales tax obligations owed to various jurisdictions. We are in discussions with those tax jurisdictions to rectify and have made tax payments to some of those jurisdictions. We have also reached out to our customers who owe sales taxes and recovered partial tax payments from certain customers. However, we may never be able to recover the prior sales taxes from all the customers, which could have a material adverse effect on our financial condition.

Our iSpecimen Marketplace technology consists of four major functional areas: data ingestion and harmonization, search, workflow management, and administration, compliance and reporting. Each of these functional areas need continual development to both enable our current business to scale and to enable us to enter new markets. As financial resources become available, our intention is to focus most of our engineering resources on the development of the iSpecimen Marketplace platform for the foreseeable future. In fiscal year 2023, we incurred $5,386,165 in technology expenses, and capitalized $3,767,332 for internally developed software. While we have spent a significant amount of time and resources on the development of this platform, we cannot provide any assurances of our iSpecimen Marketplace's short or long-term success or growth and there is no assurance that the resources being allocated for the platform will be sufficient to complete planned additional capabilities, or that such completion will result in significant revenues or profit for us. If our customers or suppliers do not perceive this platform to be of high value and quality, we may not be able to retain them or acquire new customers or suppliers.

Our platforms and the network infrastructure that are hosted by third-party providers involve the storage and transmission of healthcare data as well as proprietary information about organizations and programs, and security breaches could expose us to a risk of loss of this information, litigation, and potential liability. Our security measures may be breached due to the actions of outside parties, employee error, malfeasance, security flaws in the third party hosting service that we rely upon, or any number of other reasons and, as a result, an unauthorized party may obtain access to our suppliers' or customers' data. Although we have never had any breach of data in our third-party provider's environment, any future breach or unauthorized access could result in significant legal and financial exposure, damage to our reputation, and a loss of confidence in the security of our platforms and applications that could potentially have an adverse effect on our business. Because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or to implement adequate preventative measures on a timely basis. If an actual or perceived breach of our security occurs, the market perception of the effectiveness of our security measures could be harmed and we could lose suppliers and customers and we may have difficulty obtaining merchant processors or insurance coverage essential for our operations. We, and the third-party providers upon which we rely, have experienced, and may in the future experience, cybersecurity threats, including threats or attempts to disrupt our information technology infrastructure and unauthorized attempts to gain access to sensitive or confidential information. Our and our third-party vendors' technology systems may be damaged or compromised by malicious events, such as cyberattacks (including computer viruses, malicious and destructive code, phishing attacks, and denial of service attacks), physical or electronic security breaches, natural disasters, fire, power loss, telecommunications failures, personnel misconduct, and human error. Such attacks or security breaches may be perpetrated by internal bad actors, such as employees or contractors, or by third parties (including traditional computer hackers, persons involved with organized crime, or foreign state or foreign state-supported actors). Cybersecurity threats can employ a wide variety of methods and techniques, which may include the use of social engineering techniques, are constantly evolving, and have become increasingly complex and sophisticated; all of which increase the difficulty of detecting and successfully defending against them. Furthermore, because the techniques used to obtain unauthorized access or sabotage systems change frequently and generally are not identified until after they are launched against a target, we and our third-party providers may be unable to anticipate these techniques or implement adequate preventative measures. Although prior cyberattacks directed at us have not had a material impact on our financial results, and we are continuing to bolster our threat detection and mitigation processes and procedures, we cannot guarantee that future cyberattacks, if successful, will not have a material impact on our business or financial results. While we have security measures in place to protect our information and our customers' and suppliers' information and to prevent data loss and other security breaches, there can be no assurance that in the future we will be able to anticipate or prevent security breaches or unauthorized access of our information technology systems or the information technology systems of the third-party providers upon which we rely. Despite our implementation of network security measures and internal information security policies, data stored on personnel computer systems is also vulnerable to similar security breaches, unauthorized tampering or human error. Many governments and other regulatory bodies including the SEC have enacted laws requiring companies to provide notice of data security incidents involving certain types of data, including personal data. If an actual or perceived breach of security measures, unauthorized access to our system or the systems of the third-party providers that we rely upon, or any other cybersecurity threat occurs, we may face direct or indirect liability, costs, or damages, contract termination, our reputation in the industry and with current and potential customers may be compromised, our ability to attract new customers could be negatively affected, and our business, financial condition, and results of operations could be materially and adversely affected. We maintain cybersecurity insurance and other types of insurance, subject to applicable deductibles and policy limits, but our insurance may not be sufficient to cover all costs associated with a potential data security incident. We also cannot be sure that our existing general liability insurance coverage and coverage for cyber liability or errors or omissions will continue to be available on acceptable terms or will be available in sufficient amounts to cover one or more large claims or that the insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could harm our financial condition.

We operate internationally and expect to expand internationally. For example, we procure specimens from sites outside of the United States and we also distribute samples to organizations located around the world. As of December 31, 2023, we had customers in 23 countries, supply sites in 19 countries, and two international distributors. International expansion exposes us to additional risks, including: Øchanges in local political, economic, social, and labor conditions, which may adversely affect our business; Ørisks associated with trade restrictions and foreign import requirements, including the importation and exportation of our solutions, as well as changes in trade, tariffs, restrictions or requirements; Øheightened risks of unethical, unfair or corrupt business practices, actual or claimed, in certain geographies; Øfluctuations in currency exchange rates, which may make doing business with us less appealing as our contracts are generally denominated in U.S. dollars; Øgreater difficulty in enforcing contracts; Ølack of brand awareness that can make commercializing our products more difficult and expensive; Ømanagement communication and integration problems resulting from cultural differences and geographic dispersion; Øthe uncertainty and limitation of protection for intellectual property rights in some countries; Øincreased financial accounting and reporting burdens and complexities as a result of being a public company; Ølack of familiarity with local laws, customs and practices, and laws and business practices favoring local competitors or partners; Øpotentially different pricing environments, longer payment cycles in some countries, increased credit risk, and higher levels of payment fraud; Øuncertainty regarding liability for products and services, including uncertainty as a result of local laws and lack of legal precedent; Ødifferent employee/employer relationships, existence of workers' councils and labor unions, and other challenges caused by distance, language, and cultural differences, making it harder to do business in certain jurisdictions; Øcompliance with complex foreign and U.S. laws and regulations applicable to international operations may increase the cost of doing business in international jurisdictions. These numerous and sometimes conflicting laws and regulations include internal control and disclosure rules, data privacy requirements, research ethics and compliance laws, anti-corruption laws, and anti-competition regulations, among others. Violations of these laws and regulations could result in fines and penalties, criminal sanctions against us, our officers, or our employees, prohibitions on the conduct of our business and on our ability to offer our products and services in one or more countries, and could also materially affect our brand, our international expansion efforts, our ability to attract and retain employees, our business, and our operating results; and Øinstability, disruption or destruction in a significant geographic region, regardless of cause, including war, terrorism, riot, civil insurrection or social unrest; and natural or man-made disasters, including famine, flood, fire, earthquake, storm or disease, including without limitation, the war between Russia and Ukraine which started in February 2022, regions from which we obtain specimen supplies. The occurrence of any one of these risks could harm our international business and, consequently, our results of operations. Additionally, operating in international markets requires significant management attention and financial resources. We cannot be certain that the investment and additional resources required to operate in other countries will produce desired levels of revenue or profitability.