Orchestra BioMed Holdings (OBIO) Risk Factors

Because we have limited financial and managerial resources, we focus on specific products and product candidates, indications and discovery programs. As a result, we may forgo or delay pursuit of other opportunities with others that could have had greater commercial potential. Our resource allocation decisions may cause us to fail to capitalize on viable commercial products or profitable market opportunities. Our spending on current and future research and development programs for specific indications may not yield any commercially viable products. If we do not accurately anticipate physician and patient needs, as well as evaluate the commercial potential or target market for a particular potential product, we may miss valuable product development opportunities or we may relinquish valuable rights to that potential product through future collaborations, licenses and other similar arrangements in cases in which it would have been more advantageous for us to further advance development or to retain sole development and commercialization rights to such potential product.

The medical innovation market in which we participate is largely technology driven. Physicians historically have moved quickly to new products and new technologies. As a result, intellectual property rights, particularly patents and trade secrets, play a significant role in product development and differentiation. Patents enable us to stop unauthorized third parties from making, using, selling, offering for sale or importing products that are covered under valid and enforceable patents. Trade secrets enable us to protect information that we do not wish to divulge to the public. Trademarks also play a role in product differentiation. If we are unable to adequately protect our intellectual property and proprietary technology, competitors may be able to use our technologies or the goodwill we have acquired in the marketplace and erode or negate any competitive advantage we may have, which could ultimately harm our business and ability to achieve profitability. In order to protect our intellectual property, we may be involved in intellectual property litigation, which is inherently complex, expensive and unpredictable. We hold patents and pending patent applications. Our patents cover inventions, which include features of our technologies or products. However, our competitors may seek to produce products that include our technologies that are not subject to patent protection, which may negatively affect our business. The patents we own may not be sufficiently broad to protect our technology or to give us any competitive advantage. We are unable to provide any assurances that any of our patents, or patents to which we have rights through licensing agreements, have, or that any of our pending patent applications that mature into issued patents will include, claims with a scope sufficient to protect our technology or products, any additional features we develop with respect to our technology or products, or any new technology or products that we seek to develop in the future. Our patents could be challenged as invalid or unenforceable, or circumvented by competitors. Medical device patents involve complex legal, scientific and factual questions, and therefore, the issuance, scope, validity and enforceability of any patent claims that we may obtain cannot be predicted with certainty. Any patents for which we have applied may not be granted. Third parties own numerous U.S. and foreign issued patents and pending patent applications in the fields in which we have developed our technology or manufacture and sell our products. Third party-owned patents, as well as other prior art, can be an obstacle to our ability to obtain patent protection for our technology. Because patent applications in the United States and most other countries are confidential for a period of time after filing, we cannot be certain that we were the first to file any patent application related to our products. Furthermore, for United States applications in which all claims are entitled to a priority date before March 16, 2013 (the date when United States patent law changed from granting rights to the first-to-invent to the first-to-file), an interference proceeding can be provoked by a third-party or instituted by the USPTO, to determine who was the first to invent any of the subject matter covered by the patent claims of our applications. We cannot be certain that we are the first to invent the inventions covered by pending patent applications entitled to a priority date before March 16, 2013, and, if we are not, we may be subject to priority disputes. We may be required to disclaim part or all of the term of certain patents or all of the term of certain patent applications. There may be prior art of which we are not aware that may affect the validity or enforceability of a patent claim, and we may be subject to a third-party pre-issuance submission of prior art to the USPTO. There also may be prior art of which we are aware, but which we do not believe affects the validity or enforceability of a claim, which may, nonetheless, ultimately be found to affect the validity or enforceability of a claim through a post-issuance proceeding or in litigation. No assurance can be given that if challenged, our patents would be declared by a court to be valid or enforceable, or that even if found valid and enforceable, a competitor's technology or product would be found by a court to infringe our patents. We may analyze patents or patent applications of our competitors that we believe are relevant to our activities and consider that we are free to operate in relation to our products, but our competitors may obtain issued claims, including in patents we considered to be unrelated, which block our efforts or may potentially result in our technology or products or our activities infringing such claims. The possibility exists that others will develop technology or products which have the same effect as our technology or products on an independent basis which do not infringe our patents or other intellectual property rights or will design around the claims of patents that we have had issued that cover our technology or products. Challenges raised in patent infringement litigation may cause determinations that our patents or licensed patents are invalid, unenforceable, or otherwise subject to limitations. In such events, third parties may use the discoveries or technologies covered by our patents or licensed patents without paying damages, licensing fees or royalties to us, which could significantly diminish the value of our patents or licensed patents. We could also be adversely affected if our licensors terminate licenses granted to us to use their patented technology. Thus, any patents that we may own, or to which we have rights through licensing agreements, may not provide sufficient protection against competitors. Furthermore, an adverse decision in a judicial or administrative proceeding can result in a third party receiving the patent right sought by us, which, in turn, could affect our ability to commercialize our technology or products. We hold trademark applications or registrations relating to our products. Our trademarks may also be opposed, cancelled, or challenged as invalid or not distinctive by competitors or third parties. Registration of a trademark is not conclusive as to its validity or the right to use such trademark. Third parties own numerous U.S. and foreign trademark registrations and trademark applications in the fields in which we manufacture and sell our products. We may be found to infringe a third party's trademark registrations or common law trademark rights.

Despite the implementation of security measures, our information technology systems and those of our current and any future CROs and other contractors, consultants, collaborators and third-party service providers, are vulnerable to attack and damage from computer viruses and malware (e.g., ransomware), malicious code, hacking, cyberattacks, phishing attacks and other social engineering schemes, cybersecurity threats, unauthorized access, natural disasters, terrorism, war, telecommunication and electrical failure, employee theft or misuse, human error, fraud, denial or degradation of service attacks, sophisticated nation-state and nation-state-supported actors or unauthorized access or use by persons inside our organization, or persons with access to systems inside our organization. Attacks upon information technology systems are increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise. As a result of more people working remotely since the COVID-19 pandemic, we may also face increased cybersecurity risks due to our reliance on internet technology and the number of our employees who are working remotely, which may create additional opportunities for cybercriminals to exploit vulnerabilities. Furthermore, because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. We may also experience security breaches that may remain undetected for an extended period. Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers increasingly using tools and techniques that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence. We and certain of our service providers are, from time to time, subject to cyberattacks and security incidents. While we do not believe that we have experienced any significant system failure, accident or security breach to date, if such an event were to occur and cause interruptions in our operations or result in the unauthorized acquisition of, or access to, personally identifiable information or individually identifiable health information, it could result in a material disruption of our development programs and our business operations, whether due to a loss of our trade secrets or other similar disruptions. Some of the federal, state and foreign government requirements include obligations of companies to notify individuals of security breaches involving particular personally identifiable information, which could result from breaches experienced by us or by our vendors, contractors or organizations with which we have formed strategic relationships. Notifications and follow-up actions related to a security breach could impact our reputation, cause us to incur significant costs, including legal expenses and remediation costs. For example, the loss of clinical study data from completed or future clinical studies could result in delays in our regulatory approval or certification efforts and significantly increase our costs to recover or reproduce the lost data. We also rely on third parties to manufacture our product candidates, and similar events relating to their computer systems could also have a material adverse effect on our business. To the extent that any disruption or security breach were to result in a loss of, or damage to, our data, or inappropriate disclosure of confidential or proprietary information, we could be exposed to litigation and governmental investigations, the further development and commercialization of our product candidates could be delayed, and we could be subject to significant fines or penalties for any noncompliance with certain state, federal and/or international privacy and security laws. Our insurance policies may not be adequate to compensate us for the potential losses arising from any such disruption, failure or security breach. In addition, such insurance may not be available to us in the future on economically reasonable terms, or at all. Further, our insurance may not cover all claims made against us and could have high deductibles in any event, and defending a suit, regardless of its merit, could be costly and divert management attention.

Even if we obtain FDA approval of our product candidates, or new indications for our products, market acceptance of our products in the healthcare community, including physicians, patients and third-party payors, will depend on many factors, including: - our ability to provide incremental clinical and economic data that shows the safety and clinical efficacy and cost-effectiveness of, and patient benefits from, our products;- the availability of alternative treatments;- whether our products are included on insurance company formularies or coverage plans;- the willingness and ability of patients and the healthcare community to adopt new technologies;- customer demand;- liability risks generally associated with the use of new product candidates;- the training required to use a new product candidate;- perceived inadequacy of evidence supporting clinical benefits or cost-effectiveness over existing alternatives;- the convenience and ease of use of our products relative to other treatment methods;- the pricing and reimbursement of our products relative to other treatment methods; and - the marketing and distribution support for our products. Even if we obtain all necessary FDA approvals, our products may fail to achieve market acceptance. If our products achieve market acceptance, they may not maintain that market acceptance over time if competing products or technologies are introduced that are received more favorably or are more cost-effective. Failure to achieve or maintain market acceptance would limit our ability to generate revenue and would have a material adverse effect on our business, financial condition, results of operations and prospects. Further, our products are subject to ongoing regulatory oversight and may require additional clinical data to support maintenance of regulatory approvals.

From time to time we may be involved in various litigation matters, which could have an adverse impact on our reputation, business and financial condition and divert the attention of our management from the operation of our business. Claims arising out of actual or alleged violations of the law could be asserted against us by individuals, either individually or through class actions, by governmental entities in civil or criminal investigations and proceedings by other entities. These claims could be asserted under a variety of laws, including but not limited to patent, trade secret and other intellectual property matters, product liability claims, employee claims, tort or contract claims, and federal regulatory investigations. These actions could expose us to adverse publicity and to substantial monetary damages and legal defense costs, injunctive relief and criminal and civil fines and penalties.

Tax laws, regulations, and administrative practices may be subject to significant change, with or without notice, due to economic, political and/or other conditions, and significant judgment is required in applying the relevant provisions of tax law. If such changes were to be adopted or if the tax authorities were to challenge our application of relevant provisions of applicable tax laws, our financial condition and results of operations could be adversely affected. In particular, the U.S. government may enact significant changes to the taxation of business entities including, among others, an increase in the corporate income tax rate, the imposition of minimum taxes or surtaxes on certain types of income, significant changes to the taxation of income derived from international operations, and an addition of further limitations on the deductibility of business interest. For example, the Inflation Reduction Act of 2022 enacted on August 16, 2022, among other provisions, imposes a 15% minimum tax on the adjusted financial statement income of certain large corporations, as well as a 1% excise tax on corporate stock repurchases by publicly traded companies. This act, as well as any other changes to tax laws that are enacted, could adversely affect our tax liability. While certain other draft legislation has been publicly released and is under development in Congress at this time, the likelihood of these changes being enacted or implemented is unclear. We are currently unable to predict whether such changes will occur. If such changes are enacted or implemented, we are currently unable to predict the ultimate impact on our business and therefore there can be no assurance our business will not be adversely affected.

We are subject to or affected by numerous federal, state and foreign laws and regulations, as well as regulatory guidance, governing the collection, use, disclosure, retention and security of personal data, such as information that we collect about patients and healthcare providers in connection with clinical studies in the United States and abroad. The global data protection landscape is rapidly evolving, and implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. This evolution may create uncertainty in our business, affect our or our collaborators', service providers' and contractors' ability to operate in certain jurisdictions or to collect, store, transfer use and share personal information, necessitate the acceptance of more onerous obligations in our contracts, result in liability or impose additional costs on us. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the future. Any failure or perceived failure by us or our collaborators, service providers and contractors to comply with federal, state or foreign laws or regulation, our internal policies and procedures or our contracts governing processing of personal information could result in negative publicity, diversion of management time and effort and proceedings against us by governmental entities or others. In many jurisdictions, enforcement actions and consequences for noncompliance are rising. In the United States, HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act and its implementing regulations, imposes privacy, security and breach notification obligations on certain healthcare providers, health plans, and healthcare clearinghouses, known as covered entities, as well as their business associates that perform certain services that involve creating, receiving, maintaining or transmitting individually identifiable health information for or on behalf of such covered entities, and their covered subcontractors. HIPAA establishes privacy and security standards that limit the use and disclosure of individually identifiable health information and protected health information ("PHI") and requires the implementation of administrative, physical and technological safeguards to protect the privacy of PHI and ensure the confidentiality, integrity and availability of electronic PHI. Most healthcare providers, including research institutions from which we obtain patient health information, are subject to privacy and security regulations promulgated under HIPAA. Covered entities are those that electronically transmit health information in connection with transactions susceptible to standards set by the U.S. Department of Health and Human Services and may concern billing and payment for services or insurance coverage. Business associates may perform or assist in performance of a function or activity involving the use or disclosure of individually identifiable health information, or other activities that may involve disclosure of individually identifiable health information by the covered entity. While we do not believe that we are currently acting as a covered entity or business associate under HIPAA and, thus, are not directly regulated under HIPAA, federal and state regulators may disagree and bring an enforcement action under HIPAA against us. In addition, certain state laws govern the privacy and security of health-related and other personal information, many of which differ from each other in significant ways and often are not preempted by HIPAA, thus complicating compliance efforts. By way of example, the California Consumer Privacy Act (the "CCPA"), which went into effect on January 1, 2020, gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA may increase our compliance costs and potential liability. Further, the California Privacy Rights Act (the "CPRA") passed in California in 2020, significantly amending the CCPA and imposing additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data and opt outs for certain uses of sensitive data. The CPRA also creates a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. The majority of the provisions went into effect on January 1, 2023, and additional compliance investment and potential business process changes may be required. Similar laws have taken effect in Virginia, Colorado, Connecticut and Utah, and been enacted or proposed in other states, reflecting a trend toward more stringent privacy legislation in the United States. Numerous data privacy related legislative proposals remain pending at the federal level as well. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging. In the event that we are subject to or affected by HIPAA, the CCPA, the CPRA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition. Our operations abroad may also be subject to increased scrutiny or attention from data protection authorities. For example, the EU and the UK General Data Protection Regulations (respectively, the "EU GDPR" and the "UK GDPR," together, the "GDPR") each impose strict requirements for processing the personal data of individuals within the EEA, and/or the UK and to processing that occurs in the context of an establishment in, respectively, the EEA and/or UK. The EU GDPR, which went into effect in May 2018 and introduces strict requirements for processing the personal information of EU subjects, including clinical study data. The GDPR has and will continue to increase compliance burdens on us, including by mandating potentially burdensome documentation requirements and granting certain rights to individuals to control how we collect, use, disclose, retain and process information about them. The processing of sensitive personal data, such as physical health condition, may impose heightened compliance burdens under the GDPR and is a topic of active interest among foreign regulators. Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance of up to €20 million under the EU GDPR and £17.5 million under the UK GDPR or 4% of the annual global revenues of the noncompliant company, whichever is greater. In addition to these fines, supervisory authorities have extensive audit and inspection rights, and powers to order temporary or permanent bans on all or some processing of personal data carried out by noncompliant actors; the GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints, seek judicial remedies and obtain compensation for damages resulting from violations of the GDPR. The existence of parallel regimes under the EU GDPR and UK GDPR, and divergence in respect of implementing or supplementary laws across the EEA and UK in certain areas, means that we could be subject to potentially overlapping or divergent enforcement actions for certain actual or perceived violations. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States; in July 2020, the Court of Justice of the EU, (the "CJEU"), limited how organizations could lawfully transfer personal data from the EEA and UK to the United States by invalidating the Privacy Shield for purposes of international transfers and imposing further restrictions on the use of standard contractual clauses ("SCCs"). The European Commission issued revised SCCs on June 4, 2021 to account for the decision of the CJEU and recommendations made by the European Data Protection Board. The revised SCCs must be used for relevant new data transfers from September 27, 2021; existing standard contractual clauses arrangements had to be migrated to the revised clauses by December 27, 2022. The revised SCCs cannot be used for transfers to non-EEA entities whose processing is already subject to the GDPR; however, no equivalent standard data protection clauses have been issued and approved by the European Commission and, therefore, current market practice is largely to use the SCCs notwithstanding this issue. The new SCCs apply only to the transfer of personal data outside of the EEA and not the UK. The UK's Information Commissioner's Office has published new data transfer standard contracts for transfers from the UK under the UK GDPR. This new documentation became mandatory for relevant data transfers from September 21, 2022; existing standard contractual clauses arrangements must be migrated to the new documentation by March 21, 2024. The relationship between the UK and the EU in relation to certain aspects of data protection law remains unclear, and the European Commission has adopted an adequacy decision in favor of the UK, enabling data transfers from EU member states to the UK without additional safeguards. However, the UK adequacy decision will automatically expire in June 2025 unless the European Commission re-assesses and renews or extends that decision. In September 2021, the UK government launched a consultation on its proposals for wide-ranging reform of UK data protection laws following Brexit and the response to this consultation was published in June 2022. There is a risk that any material changes which are made to the UK data protection regime could result in the European Commission reviewing the UK adequacy decision and the UK losing its adequacy decision if the European Commission deems the UK no longer provides adequate protection of personal data. As supervisory authorities issue further guidance on personal data export mechanisms, including the aforementioned ‘supplementary measures,' and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations. The GDPR may impose additional responsibility and liability in relation to personal data that we process and we may be required to put in place additional mechanisms, at significant cost and diversion of management attention, to ensure compliance with the new data protection rules. This may be onerous and may adversely affect our business, operations and financial performance. The EU has also proposed a Regulation on Privacy and Electronic Communications, or ePrivacy Regulation, which, if adopted, would impose new obligations on the use of personal data in the context of electronic communications, particularly with respect to online tracking technologies and direct marketing. Additionally, the EU adopted the EU Clinical Trials Regulation, which came into effect on January 31, 2022. This regulation imposes new obligations on the use of data generated from clinical trials and enables European patients to have the opportunity to access information about clinical trials. Failure or perceived failure to comply with the GDPR, the EU Clinical Trials Regulations or other countries' privacy or data security-related laws, rules or regulations could result in significant regulatory penalties and fines, affect our compliance with contracts entered into with our partners, collaborators and other third-party payors, and could have an adverse effect on our reputation, business and financial condition.

We are responsible for the manufacture of the proprietary SirolimusEFR used in our Virtue SAB product candidate. We have already experienced substantial delays and other challenges in the manufacture of SirolimusEFR as a result of supply chain and personnel issues experienced by the single source CMO that produces SirolimusEFR for us. Many of the processes, ingredients and components required for manufacture of SirolimusEFR are also required for manufacture of COVID-19 vaccines and tests and, as such, supply chains continue to be adversely impacted. Further, the manufacture of SirolimusEFR involves certain novel processes that we continue to develop to achieve consistent reproducibility as well as increase scale to support large clinical studies and future commercialization. In the event that we do not have sufficient SirolimusEFR, our planned clinical studies could be prevented or delayed. Further delays in our trial timelines will result in additional expenses to us and potentially risk or damage our partnership with Terumo and the future competitiveness of our Virtue SAB solution. If approved for use in connection with our medical device product candidates or as a stand-alone product, we currently expect to remain responsible for the manufacture and supplying of SirolimusEFR at clinical and/or commercial scale for our partner, Terumo. We have limited experience in manufacturing pharmaceutical products and no experience manufacturing SirolimusEFR in the volume that we anticipate will be required if we achieve planned levels needed for clinical studies and/or commercial sales. We do not currently have, nor do we currently have plans to acquire, the infrastructure or capability internally to manufacture or test SirolimusEFR on a clinical and/or commercial scale. Instead, we rely on contract manufacturers for current production of SirolimusEFR for clinical study supplies and currently plan to continue to use contract manufacturers for supply and testing. Our reliance on third-party suppliers and manufacturers, including certain single-source suppliers, could harm our ability to fulfill our supply obligations to Terumo. If our third-party suppliers fail to deliver the required quantities of materials on a timely basis and at reasonable prices, and we are unable to find one or more replacement suppliers capable of production at a substantially equivalent cost in substantially equivalent volumes and quality on a timely basis, the supply of our products or product candidates to customers and the development of any future products will be delayed, limited or prevented, which could have material adverse effect on our business, financial condition and results of operations. The facilities used by our CMOs to manufacture our product candidates must be authorized by the applicable regulatory authorities, including the FDA, pursuant to inspections that will be conducted after a PMA, NDA or comparable foreign regulatory marketing application is submitted. We depend on our contract manufacturing partners for compliance with the FDA's cGMP or similar foreign requirements for manufacture of both the active drug substances and finished drug product. If our contract manufacturers cannot successfully manufacture material that conforms to our specifications and the FDA's or foreign regulatory authorities' strict regulatory requirements, they will not be able to secure or maintain FDA or foreign approval for use of their manufacturing facilities with respect to our product candidates. In addition, if the FDA or any other applicable regulatory authority does not approve these facilities for the manufacture of our product candidates or if it withdraws any such approval in the future, or if our suppliers or contract manufacturers decide they no longer want to supply or manufacture for us, we may need to find alternative manufacturing facilities, in which case we might not be able to identify manufacturers for clinical or commercial supply on acceptable terms, without delay, or at all, which would significantly impact our ability to fulfill our supply obligations for SirolimusEFR for Virtue SAB, as well as sales of SirolimusEFR for other potential clinical applications. In addition, the manufacture of pharmaceutical products is complex and requires significant expertise and capital investment, including the development of advanced manufacturing techniques and process controls. Manufacturers of pharmaceutical products often encounter difficulties in production, particularly in scaling up and validating initial production and absence of contamination. They may also encounter equipment breakdowns requiring lengthy repairs or the need to replace equipment. These problems include difficulties with production costs and yields, quality control, including stability of the product, quality assurance testing, operator error, shortages of qualified personnel, as well as compliance with strictly enforced federal, state and foreign regulations. Furthermore, if contaminants are discovered in our supply or in the manufacturing facilities, such manufacturing facilities may need to be closed for an extended period of time to investigate and remedy the contamination and could require that affected supplies be withdrawn or withheld from the market. Any stability or other issues relating to the manufacture of our product candidates may occur in the future. Additionally, our manufacturers may experience manufacturing difficulties due to resource constraints or as a result of labor disputes or unstable political environments. If our manufacturers were to encounter any of these difficulties, or otherwise fail to comply with their contractual obligations, our ability to provide SirolimusEFR to Terumo would be jeopardized, which would result in a material adverse effect on our business, financial condition, results of operations and prospects.

We are highly dependent on our senior management and other key personnel. Our success depends on our continued ability to attract, retain, develop and motivate highly qualified management, clinical, scientific and sales and marketing personnel. Although we have entered into employment agreements with certain of our executive officers, our employees, including our executive officers, are employed "at will," and each employee can terminate his or her employment with us at any time. We also do not maintain "key person" insurance policies on any of our officers or our other employees. The competition for qualified personnel in the medical innovation industry is intense, and we may incur significant costs to attract and retain them. We will need to hire additional personnel as we continue to expand our development activities and drive sales of our products or product candidates. We may not attract, retain and develop quality personnel on acceptable terms due to the competition for such personnel. If we are not able to attract and retain necessary personnel to accomplish our business objectives, we may experience constraints that will significantly impede the achievement of our development objectives, our ability to raise additional capital and our ability to implement our business strategy.

We purchase many of the components and raw materials used in manufacturing our products from numerous suppliers in various countries. Generally, we have been able to obtain adequate supplies of such raw materials and components. However, for reasons of quality assurance, unique processes, or specialty item availability, we may procure certain components and raw materials from a sole supplier. For example, for our Virtue SAB product candidate, we source sirolimus from a single manufacturer in China, we source porous angioplasty balloons from a single manufacturer in Germany with unique processes and expertise, and we source custom specialty polymers from a single manufacturer in the United States. We work closely with our suppliers to try to ensure continuity of supply while maintaining high quality and reliability. However, we cannot guarantee that these efforts will be successful. In addition, due to the stringent regulations and requirements of the FDA, comparable regulatory bodies in countries in the EU and similar regulatory bodies elsewhere around the world regarding the manufacture of our products or product candidates, we may not be able to quickly establish additional or replacement sources for certain components or materials. A reduction in or an interruption to supply, and an inability to develop alternative sources for such supply, could adversely affect our ability to manufacture our products in a timely or cost-effective manner and to make our related product sales. Manufacturing facilities used to make our balloons or other components may be shut down, sold or otherwise become unavailable and it will take time and money for us to identify and requalify new facilities. In addition, assuming our BackBeat CNT product candidate is approved, we will be reliant on Medtronic, Inc. (an affiliate of Medtronic plc) ("Medtronic") and its ability to obtain supplies for and to produce its BackBeat CNT-enabled pacemaker systems. If Medtronic is unable or unwilling to obtain such supplies or is otherwise unable or unwilling to produce its BackBeat CNT-enabled pacemaker systems, it could adversely affect our results of operations.

We are exposed to trade and economic sanctions and other restrictions imposed by the United States and other governments and organizations. The U.S. Departments of Justice, Commerce, State and Treasury and other federal agencies and authorities have a broad range of civil and criminal penalties they may seek to impose against corporations and individuals for violations of economic sanctions laws, export control laws, and other federal statutes and regulations, including sanctions laws administered by the Office of Foreign Assets Control and other U.S. governmental agencies. Governmental regulation of the import or export of our products, or our failure to obtain any required import or export authorization for our products under the laws of the United States or other countries, could harm our ability to engage in international trade and adversely affect our revenue. Moreover, any new export or import restrictions, new legislation or shifting approaches in the enforcement or scope of existing regulations, or in the countries, persons or technologies targeted by such regulations, could result in decreased use of our products by, or in our decreased ability to export our products to, existing or potential customers or to conduct business with foreign parties. The FCPA, the UK Bribery Act of 2010 (the "Bribery Act"), and similar laws around the world generally prohibit U.S. companies and their employees and intermediaries from offering, promising, authorizing or making improper payments to foreign government officials for the purpose of obtaining or retaining business or gaining any advantage. We face significant risks if we, which includes our third party business partners and intermediaries, fail to comply with the FCPA or other anti-corruption and anti-bribery laws. In addition, the Bribery Act prohibits both domestic and international bribery, as well as bribery across both private and public sectors. An organization that "fails to prevent bribery" by anyone associated with the organization can be charged under the Bribery Act unless the organization can establish the defense of having implemented "adequate procedures" to prevent bribery. We have implemented policies, procedures, and internal controls to help ensure compliance with these laws, though such compliance measures ultimately may not be effective in preventing our employees, contractors, business partners, intermediaries or agents from violating or circumventing our policies and/or the law. Under these laws and regulations, as well as other anti-corruption laws, anti-money laundering laws, export control laws, customs laws, sanctions laws and other laws governing our operations, various government agencies may require export licenses, may seek to impose modifications to business practices, including cessation of business activities in sanctioned countries or with sanctioned persons or entities and modifications to compliance programs, which may increase compliance costs. An actual or alleged violation of these laws or regulations could result in internal, independent, or government investigations and severe criminal or civil sanctions, fines or penalties, as well as legal expenses, and could negatively affect our reputation, business, financial condition and results of operations.