MEI Pharma (MEIP) Risk Factors

Patent protection and trade secret protection are important to our business and our future will depend, in part on our ability to maintain trade secret protection, obtain patents and operate without infringing the proprietary rights of others both in the U.S. and abroad. Litigation or other legal proceedings may be necessary to defend against claims of infringement, to enforce our patents or to protect our trade secrets. Such litigation could result in substantial costs and diversion of our management's attention. The patent positions of pharmaceutical and biotechnology companies can be highly uncertain and involve complex legal and factual questions. We acquired patents and patent applications related to voruciclib from Presage in 2017, and acquired both issued patents and pending patent applications related to ME-344 from Novogen in relation to its Isoflavone-based compounds, which we previously licensed from Novogen, in 2011. Additionally, Novogen had previously applied for patents in a number of countries with respect to the use of their isoflavone compounds, including ME-344. Finally, in September 2013, we acquired patents and patent applications related to zandelisib from Pathway Therapeutics, Inc. The patent applications may not proceed to grant or may be amended to reduce the scope of protection of any patent granted. The applications and patents may also be opposed or challenged by third parties. Should we resume development of our drug candidate or any future drug candidates, our commercial success will depend, in part, on our ability to obtain and maintain effective patent protection for our compounds and their use in treating, preventing, or curing cancer, and to successfully defend patent rights in those technologies against third-party challenges. As patent applications in the U.S. are maintained in secrecy until published or issued and as publication of discoveries in the scientific or patent literature often lag behind the actual discoveries, we cannot be certain that we or Presage were the first to make the inventions covered by the pending patent applications or issued patents referred to above or that we or they were the first to file patent applications for such inventions. Additionally, the breadth of claims allowed in biotechnology and pharmaceutical patents or their enforceability cannot be predicted. We cannot be sure that, should any patents issue, we will be provided with adequate protection against potentially competitive products. Furthermore, we cannot be sure that should patents issue, they will be of commercial value to us, or that private parties, including competitors, will not successfully challenge our patents or circumvent our patent position in the U.S. or abroad.

In the ordinary course of our business, we collect and store sensitive data, including intellectual property, our proprietary business information and that of our suppliers, as well as personally identifiable information of clinical trial participants and employees. Similarly, our third-party providers possess certain of our sensitive protected health data. The secure maintenance of this information is critical to our operations and business strategy. Despite our reasonable security measures, our information technology and infrastructure may be vulnerable to cyber-attacks or breached due to employee error, malfeasance or other disruptions. Cyber-attacks and other security incidents are increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise. Although we develop and maintain systems and controls designed to prevent these events from occurring, and we have a process to identify and mitigate threats, the development and maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change and efforts to overcome security measures become more sophisticated, and such systems, controls and processes may not be successful in preventing a breach or other incident. Any such security incident could compromise our networks and the information stored there could be accessed, publicly disclosed, encrypted, lost or stolen. We could be required to expend significant amounts of money and other resources to repair or replace information systems or networks. In addition, our liability insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related security incidents. The legislative and regulatory landscape for privacy and data protection continues to evolve, and there has been an increasing amount of focus on privacy and data protection issues with the potential to affect our business, including compliance with the Health Insurance Portability and Accountability Act of 1996 and state laws requiring security breach notification. The collection and use of personal health data of individuals in the European Union is also governed by strict data protection laws. In addition to existing laws, since May 25, 2018, the General Data Protection Regulation (GDPR) has imposed obligations with respect to European Union data and substantial fines for breaches of the data protection rules. The GDPR increased our responsibility and potential liability in relation to personal data that we process, and we were required to implement additional mechanisms to comply with the GDPR and related European Union data protection rules. Enforcement uncertainty and the costs associated with ensuring GDPR compliance may be onerous and adversely affect our business, operating results, prospects and financial condition. We continue to evaluate the legal issues that arise concerning transfer of personal data of residents of the European Economic Area (EEA) member states or the U.K. to the U.S. or other jurisdictions that are not deemed adequate by the European Commission. Among other steps, we are implementing the new standard contractual clauses issued on June 4, 2021 by the European Commission. It remains uncertain how these standard contractual clauses will be implemented by the data exporters and data importers and whether they will ultimately be deemed sufficient by European courts. MEI Pharma observes the developments and will agree to the appropriate data transfer mechanism. In addition to standard contractual clauses, we may rely on individual contents of the patients where appropriate and necessary to safeguard the data flow from the EU to the U.S. Present solutions to legitimize transfers of personal data from the EEA may be challenged or deemed insufficient. We may, in addition to other impacts, experience additional costs associated with increased compliance burdens, and we and our customers face the potential for regulators in the EEA or U.K. to apply different standards to the transfer of personal data from the EEA/U.K. to the U.S., and to block, or require ad hoc verification of measures taken with respect to, certain data flows from the EEA or U.K. to the U.S. We also may be required to engage in new contract negotiations with third parties that aid in processing data on our behalf. We may experience reluctance or refusal by current or prospective European clinical trial sites and CROs to use our products, and we may find it necessary or desirable to make further changes to our processing of personal data of EEA or U.K. data subjects. Additionally, California has the California Consumer Privacy Act (CCPA), which creates individual privacy rights for consumers (as that word is broadly defined in the law) and places increased privacy and security obligations on entities handling personal data of consumers or households. The CCPA may significantly impact our business activities and require substantial compliance costs that adversely affect business, operating results, prospects and financial condition. Amendments to the CCPA mandated by the California Privacy Rights Act (CPRA) will impose additional privacy requirements, effective on January 1, 2023. Similarly comprehensive state consumer privacy laws in other states, such as Virginia, Utah, Connecticut and Colorado will also become effective in 2023. These new state privacy measures may reflect the start of a movement in other state legislatures to enact more comprehensive privacy laws, which would create a more complex privacy regulatory landscape for our business in the U.S. In addition, there is privacy legislation and rule making efforts at the federal level which may increase our privacy obligations in the U.S. Thus, any access, disclosure or other loss of information, including our data being breached at our partners or third-party providers, along with violations of privacy laws that exist and are increasing around the world, could result in legal claims or proceedings and liability under laws that protect the privacy of personal information, disrupt our operations and damage our reputation, which could adversely affect our business.

Our internal computer systems and those of our CROs and other contractors and consultants are vulnerable to damage from computer viruses, unauthorized access, natural disasters, terrorism, war, and telecommunication and electrical failures. If such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our drug candidate development and, if such drug candidates are approved commercialization programs. For example, the loss of clinical trial data from completed, ongoing or planned clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. To the extent that any disruption or security breach were to result in a loss of or damage to our data or applications, or inappropriate disclosure of personal, confidential or proprietary information, we could incur liability and regulatory enforcement actions, and the further development of any of our drug candidates could be delayed.

In the past, litigation, including securities class action litigation, has often followed certain significant business transactions, such as the sale of a company or announcement of any other strategic transaction, or the announcement of negative events. These events may also result in investigations by the SEC. We may be exposed to such litigation even if no wrongdoing occurred. Litigation is usually expensive and diverts management's attention and resources, which could adversely affect our business and cash resources and our ability to consummate a potential strategic transaction or the ultimate value our stockholders receive in any such transaction.

We are subject to numerous environmental, health and safety laws and regulations, including those governing laboratory procedures and the handling, use, storage, treatment and disposal of hazardous materials and wastes. From time to time and in the future, our operations may involve the use of hazardous and flammable materials, including chemicals and biological materials, and may also produce hazardous waste. Even if we contract with third parties for the disposal of these materials and waste, we cannot completely eliminate the risk of contamination or injury resulting from these materials. In the event of contamination or injury resulting from the use or disposal of our hazardous materials, we could be held liable for any resulting damages, and any liability could exceed our resources. We also could incur significant costs associated with civil or criminal fines and penalties for failure to comply with such laws and regulations. We maintain workers' compensation insurance to cover us for costs and expenses we may incur due to injuries to our employees resulting from the use of hazardous materials, but this insurance may not provide adequate coverage against potential liabilities. However, we do not maintain insurance for environmental liability or toxic tort claims that may be asserted against us. In addition, we may incur substantial costs in order to comply with current or future environmental, health and safety laws and regulations. Current or future environmental laws and regulations may impair our research, development or production efforts. In addition, failure to comply with these laws and regulations may result in substantial fines, penalties or other sanctions.

Events outside of our control, including natural disasters and public health emergencies, could severely disrupt our operations and have a material adverse effect on our business, operating results, prospects or financial condition. If a natural disaster, or public health emergency such as COVID-19, power outage or other event occurred that prevented us from conducting our clinical trials, including by damaging our critical infrastructure, such as third-party facilities, or that otherwise disrupted operations and travel, it may be difficult or, in certain cases, impossible for us to continue our business for a substantial period of time. The disaster recovery and business continuity plans we have in place may prove inadequate in the event of a serious disaster or similar event. We may incur substantial expenses as a result of the limited nature of our disaster recovery and business continuity plans, which could have a material adverse effect on our business, operating results, prospects or financial condition.