The sale, distribution and marketing of human therapeutics and the relationship with healthcare providers are strictly regulated by laws in the U.S. and most other jurisdictions in which we intend to seek approval for our product candidates. In addition, the collection and use of personally identifiable information, including health-related information, is regulated by federal, state and foreign privacy, data security and data protection laws. Failure to comply with these laws could impair our ability to properly sell our product candidates in particular jurisdictions and subject us to liability from private and governmental entities. In addition, addressing these diverse and sometimes contradictory requirements in myriad jurisdictions may necessitate that we expend significant resources on compliance efforts. Any failure to comply with these requirements may leave us exposed to possible enforcement actions and potential liability. The laws that may affect our ability to operate include: • the federal Anti-Kickback Statute, which generally prohibits, among other things, knowingly and willfully soliciting, receiving, offering or paying any remuneration (including any kickback, bribe, or certain rebates) for referring an individual or inducing a transaction for which payment may be made under a federal healthcare program, such as the Medicare and Medicaid programs. A person or entity does not need to have actual knowledge of the statute or specific intent to violate it in order to have committed a violation. Violators are subject to civil and criminal fines and penalties, as well as imprisonment and exclusion from government healthcare programs; • federal civil and criminal false claims laws, including the federal False Claims Act (“FCA”), which generally prohibit knowingly making false or fraudulent claims for payment or approval from the federal government, including Medicare, Medicaid and other government payors, or knowingly seeking to conceal, decrease or avoid an obligation to pay money to the federal government. Certain indirect acts, such as promoting products off-label, can be deemed FCA violations by a manufacturer even it did not submit the claim directly to the government payor. Further, under the Patient Protection and Affordable Care Act, as amended by the Health Care and Education Reconciliation Act of 2010 (collectively, the “Affordable Care Act” or “ACA”), a violation of the federal Anti-Kickback Statute may also constitute a false or fraudulent claim under the FCA. These laws impose criminal and civil penalties on violators. Private individuals may bring civil whistleblower or qui tam actions for alleged FCA violations on behalf of the federal government; • the U.S. federal physician payment transparency requirements, sometimes referred to as the “Physician Payments Sunshine Act,” created under the ACA, and their implementing regulations, which require manufacturers of certain products paid under Medicare, Medicaid or the Children’s Health Insurance Program, including biopharmaceutical products, to report information related to payments or other consideration made to physicians (defined to include doctors, dentists, optometrists, podiatrists and chiropractors), other healthcare providers and teaching hospitals, as well as ownership and investment interests held by these healthcare providers and their immediate family members in the manufacturer. Failure to comply could result in civil monetary penalties. Effective January 1, 2022, the U.S. federal physician transparency reporting requirements extend to include transfers of value made to certain non-physician providers (physician assistants, nurse practitioners, clinical nurse specialists, certified registered nurse anesthetists & anesthesiologist assistants, and certified nurse-midwives); • the Foreign Corrupt Practices Act (“FCPA”) and other laws, which generally prohibit improper payments or offers of payments to foreign governments and their officials and political parties by U.S. persons and entities to obtain or retain business. In the U.K., for example, the U.K. Bribery Act 2010 prohibits giving financial or other advantages to encourage persons to perform their functions improperly; • the Federal Food, Drug and Cosmetic Act, which prohibits the commercialization of adulterated or misbranded drugs, and the Public Health Service Act, which prohibits the commercialization of biological products without a biologics license; • analogous state and foreign legal requirements that: • may apply to sales or marketing arrangements and claims involving healthcare items or services reimbursed by non-governmental third party payors, including private insurers, and may be broader in scope than their federal equivalents, such as state anti-kickback and false claims laws; • require following the pharmaceutical industry’s voluntary compliance guidelines and the federal government’s relevant compliance guidance, or otherwise restrict payments to healthcare providers; • require reporting information related to payments and other consideration to physicians and other healthcare providers or marketing expenditures; and • other national and local laws that govern the distribution and sale of pharmaceuticals, including imposing requirements regarding licensing, record-keeping, storage and security requirements. The scope and enforcement of each of these laws is not always certain and is subject to legislative, judicial or prosecutorial changes. Further, because of the breadth of these laws, it is possible that some of our business activities could be subject to challenge under one or more of such laws. Indeed, U.S. federal and state enforcement bodies have increasingly scrutinized healthcare companies and providers interactions, which has led to a number of investigations, prosecutions, convictions and settlements in the industry. Ensuring business arrangements comply with applicable laws, as well as responding to possible investigations by government authorities, can be time- and resource-consuming and can divert a company’s attention from its business. The increasingly global nature of our business operations, including clinical development efforts, subjects us to domestic and foreign anti-bribery and anti-corruption laws and regulations, such as the FCPA and the U.K. Bribery Act. These activities create the risk of unauthorized payments or offers of payments that are prohibited under the FCPA, the U.K. Bribery Act or similar laws. It is our policy to implement safeguards to discourage these practices by our employees and agents. However, these safeguards may ultimately prove ineffective, and our employees, consultants, and agents may engage in conduct for which we might be held responsible. Violations of the FCPA may result in severe criminal or civil sanctions, and we may be subject to other liabilities, which could negatively affect our business, operating results and financial condition. Further, the U.S. federal and state government, as well as other jurisdictions, have myriad laws regulating the collection, storage, distribution and use of data of employees, patients, agents, and others. These different laws governing the privacy and security of health and other personal information often differ from each other in significant ways and may not have the same effective requirements, thus complicating efforts to comply with their respective provisions. For example: • in the U.S., the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”), imposes requirements relating to the privacy, security and transmission of individually identifiable health information on certain covered healthcare providers, health plans, and healthcare clearinghouses, and their respective business associates that perform services for them that involve the use or disclosure of such information. These laws impose civil and criminal monetary penalties, and give state attorneys general the authority to file civil actions for damages or injunctions, and attorney’s fees, in federal courts to enforce the laws; • the California Consumer Privacy Act (“CCPA”) requires covered companies to provide new disclosures to California consumers and afford such consumers new rights with respect to their personal information, including the rights to: request deletion of their information, receive the information on record for them, know what categories of information are being maintained about them, and opt-out of certain sales of their information. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of personal information, which may increase the likelihood of, and risks associated with, data breach litigation. The CCPA became effective in January 2020 and enforceable in July 2020; • other U.S. states, such as Massachusetts, Nevada, Illinois, Colorado, Virginia, Pennsylvania, Ohio, North Carolina, New Jersey and New York, have enacted and/or are considering laws that impose stringent privacy and/or data security requirements and, most notably, stringent new privacy laws will become effective in Colorado, Virginia, Utah, Connecticut and California in 2023; and • around the world, many countries have enacted laws that regulate data protection. In the EU and European Economic Area (“EEA”) the collection and use of personal data is regulated by the General Data Protection Regulation (“GDPR”) and the member states’ related data protection and privacy laws, and in the U.K. by its Data Protection Act 2018 and, as of January 1, 2021, the U.K. GDPR (such laws collectively being described as “European Data Protection Law”). Because the European Data Protection Law applies not only to businesses that are established within the EU but also to any business that offers goods or services to individuals in the EU or U.K., it could apply to us. European Data Protection Law imposes strict requirements, including special protections for “sensitive” personal data which includes health and genetic information of individuals in the EU or the U.K.; expanded disclosures about the personal data use; information retention limitations; mandatory data breach notification requirements; and additional oversight obligations relating to third-parties retained to process the personal data. European Data Protection Law grants or enhances the rights of individuals with respect to their personal data, including the rights to object to the processing of the data and request deletion of the same. It also has strict requirements on the transfer of personal data out of the EU or the U.K. to jurisdictions that have not been deemed to offer “adequate” privacy protections, such as the U.S. Failure to comply with the requirements of the European Data Protection Law may result in warning letters, mandatory audits, orders to cease/change the use of data, and financial penalties, including fines of up to 4% of global revenues, or 20,000,000 Euro (£17.5 million in the U.K.), whichever is greater. Moreover, data subjects can seek damages for violations, and non-profit organizations can bring claims on behalf of data subjects. The costs associated with ensuring compliance with these laws, including in particular European Data Protection Law, may be onerous and adversely affect our business, financial condition, results of operations and prospects. Further, due to Brexit, we may have additional costs and operational challenges in complying with the U.K. GDPR and any other developments regulating the transfer of personal data between the U.K. and EU. We may also need to rely on multiple third parties to meet these legal requirements, which could result in additional liability for us if they do not comply. Efforts to ensure that we comply with all applicable healthcare and data privacy laws and regulations, as well as other domestic and foreign legal requirements, will involve substantial costs. It is possible that governmental and enforcement authorities in the U.S. or outside the U.S. will conclude that our business practices do not comply with current or future legal requirements. If any noncompliance actions are instituted against us, and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business, including the imposition of significant civil, criminal and administrative penalties, damages, disgorgement, monetary fines, individual imprisonment, exclusion from participation in federal healthcare programs (such as Medicare and Medicaid), contractual damages, reputational harm, diminished profits and future earnings, and curtailment or restructuring of our operations, as well as additional reporting obligations and oversight if we become subject to a corporate integrity agreement or similar agreement to resolve allegations of non-compliance with these laws, any of which could adversely affect our ability to operate our business and our results of operations. Any action for violation of these laws, even if successfully defended, could result in significant legal expenses and divert management’s attention from the operation of the business. Prohibitions or restrictions on sales (including importation or exportation) or withdrawal of future marketed products could materially affect business in an adverse way.