Phathom Pharmaceuticals (PHAT) Risk Factors

The global data protection landscape is rapidly evolving, and we are or may become subject to numerous state, federal and foreign laws, requirements and regulations governing the collection, use, disclosure, retention, and security of personal data, such as information that we may collect in connection with clinical trials in the U.S. and abroad. Implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, standards, or perception of their requirements may have on our business. This evolution may create uncertainty in our business, affect our ability to operate in certain jurisdictions or to collect, store, transfer use and share personal information, necessitate the acceptance of more onerous obligations in our contracts, result in liability or impose additional costs on us. The cost of compliance with these laws, regulations and standards is high and is likely to increase in the future. Any failure or perceived failure by us to comply with federal, state or foreign laws or regulations, our internal policies and procedures or our contracts governing our processing of personal information could result in negative publicity, government investigations and enforcement actions, claims by third parties and damage to our reputation, any of which could have a material adverse effect on our operations, financial performance and business. As our operations and business grow, we may become subject to or affected by new or additional data protection laws and regulations and face increased scrutiny or attention from regulatory authorities. In the U.S., HIPAA imposes, among other things, certain standards relating to the privacy, security, transmission and breach reporting of individually identifiable health information. Certain states have also adopted comparable privacy and security laws and regulations, some of which may be more stringent than HIPAA. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. In addition, California enacted the CCPA on June 28, 2018, which went into effect on January 1, 2020. The CCPA creates individual privacy rights for California consumers and increases the privacy and security obligations of entities handling certain personal information. It provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. Further, the CPRA recently passed in California. The CPRA will impose additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It will also create a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. The majority of the provisions will go into effect on January 1, 2023, and additional compliance investment and potential business process changes may be required. Similar laws have passed in Virginia, Connecticut, Colorado and Utah and have been proposed in other states and at the federal level, reflecting a trend toward more stringent privacy legislation in the United States. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging. In the event that we are subject to or affected by HIPAA, the CCPA, the CPRA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition. Furthermore, the FTC and many state Attorneys General continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive. For example, according to the FTC, failing to take appropriate steps to keep consumers' personal information secure can constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. In Europe, GDPR, went into effect in May 2018 and imposes strict requirements for processing the personal data of individuals within the EEA. Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance of up to €20 million or 4% of the annual global revenues of the noncompliant company, whichever is greater. In addition, the GDPR increases the scrutiny of transfers of personal data from the EEA to the United States and other jurisdictions that the European Commission does not recognize as having "adequate" data protection laws. In 2016, the EU and United States agreed to a transfer framework for data transferred from the EU to the United States called the Privacy Shield, but in July 2020 the Court of Justice of the EU, or the CJEU, limited how organizations could lawfully transfer personal data from the EEA to the United States by invalidating the Privacy Shield for purposes of international transfers and imposing further restrictions on use of the standard contractual clauses, or SCCs. While the CJEU upheld the adequacy of the SCCs, it made clear that reliance on them alone may not necessarily be sufficient in all circumstances. Use of the SCCs must now be assessed on a case-by-case basis taking into account the legal regime applicable in the destination country, in particular applicable surveillance laws and rights of individuals and additional measures and/or contractual provisions may need to be put in place, however, the nature of these additional measures is currently uncertain. The CJEU went on to state that if a competent supervisory authority believes that the SCCs cannot be complied with in the destination country and the required level of protection cannot be secured by other means, such supervisory authority is under an obligation to suspend or prohibit that transfer. The European Commission issued revised SCCs on June 4, 2021 to account for the decision of the CJEU and recommendations made by the European Data Protection Board. The revised SCCs must be used for relevant new data transfers from September 27, 2021; existing standard contractual clauses arrangements must be migrated to the revised clauses by December 27, 2022. There is some uncertainty around whether the revised clauses can be used for all types of data transfers, particularly whether they can be relied on for data transfers to non-EEA entities subject to the GDPR. The revised SCCs apply only to the transfer of personal data outside of the EEA and not the UK; the UK's Information Commissioner's Office launched a public consultation on its draft revised data transfers mechanisms in August 2021. As supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the SCCs cannot be used, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results. The European Commission issued revised SCCs on June 4, 2021 to account for the decision of the CJEU and recommendations made by the European Data Protection Board. The revised SCCs must be used for relevant new data transfers from September 27, 2021; existing standard contractual clauses arrangements must be migrated to the revised clauses by December 27, 2022. The new SCCs apply only to the transfer of personal data outside of the EEA and not the United Kingdom; the United Kingdom's Information Commissioner's Office launched a public consultation on its draft revised data transfers mechanisms in August 2021. There is some uncertainty around whether the revised clauses can be used for all types of data transfers, particularly whether they can be relied on for data transfers to non-EEA entities subject to the GDPR. As supervisory authorities issue further guidance on personal data export mechanisms, including circumstances where the SCCs cannot be used, and/or start taking enforcement action, we could suffer additional costs, complaints and/or regulatory investigations or fines, and/or if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.

We and any of our third-party manufacturers or suppliers will use biological materials, potent chemical agents and may use hazardous materials, including chemicals and biological agents and compounds that could be dangerous to human health and safety of the environment. Our operations and the operations of our third-party manufacturers and suppliers also produce hazardous waste products. Federal, state and local laws and regulations govern the use, generation, manufacture, storage, handling and disposal of these materials and wastes. Compliance with applicable environmental laws and regulations may be expensive, and current or future environmental laws and regulations may impair our product development efforts. In addition, we cannot eliminate the risk of accidental injury or contamination from these materials or wastes. We do not carry specific biological or hazardous waste insurance coverage, and our property, casualty and general liability insurance policies specifically exclude coverage for damages and fines arising from biological or hazardous waste exposure or contamination. In the event of contamination or injury, we could be held liable for damages or be penalized with fines in an amount exceeding our resources, and our clinical trials or regulatory approvals could be suspended. Although we maintain workers' compensation insurance for certain costs and expenses we may incur due to injuries to our employees resulting from the use of hazardous materials or other work- related injuries, this insurance may not provide adequate coverage against potential liabilities. We do not maintain insurance for toxic tort claims that may be asserted against us in connection with our storage or disposal of biologic, hazardous or radioactive materials. In addition, we may incur substantial costs in order to comply with current or future environmental, health and safety laws and regulations, which have tended to become more stringent over time. These current or future laws and regulations may impair our research, development or production efforts. Failure to comply with these laws and regulations also may result in substantial fines, penalties or other sanctions or liabilities, which could materially adversely affect our business, financial condition, results of operations and prospects.

The biotechnology and pharmaceutical industries are characterized by rapidly advancing technologies, intense competition and a strong emphasis on proprietary and novel products and product candidates. Our competitors have developed, are developing or may develop products, product candidates and processes competitive with vonoprazan. Any product candidates that we successfully develop and commercialize will compete with existing therapies and new therapies that may become available in the future. We believe that a significant number of products are currently under development, and may become commercially available in the future, for the treatment of GI diseases for which we may attempt to develop vonoprazan or any future product candidates. Our competitors include larger and better funded pharmaceutical, biopharmaceutical, biotechnological and therapeutics companies. Moreover, we may also compete with universities and other research institutions who may be active in the indications we are targeting and could be in direct competition with us. We also compete with these organizations to recruit management, scientists and clinical development personnel, which could negatively affect our level of expertise and our ability to execute our business plan. We will also face competition in establishing clinical trial sites, enrolling patients for clinical trials and in identifying and in-licensing new product candidates. Smaller or early-stage companies may also prove to be significant competitors, particularly through collaborative arrangements with large and established companies. We expect that VOQUEZNA TRIPLE PAK and VOQUEZNA DUAL PAK for the treatment of H. pylori infection, and, if approved, VOQUEZNA, for the treatment of erosive GERD, will primarily compete with generic PPIs marketed by multiple pharmaceutical companies in both the prescription and OTC markets. Additionally, in March 2020, RedHill Biopharma Ltd. launched Talicia, a co-formulated capsule comprising generic omeprazole, amoxicillin, and rifabutin for the treatment of H. pylori infection. We are aware of other PCABs in development in the United States, as well as a number of other PCABs in territories outside of the United States that if developed and approved in our territories may compete with vonoprazan. In the United States, Neurogastrx previously announced its intention to commence a Phase 3 erosive GERD trial for fexuprazan, under an exclusive license from Daewoong Pharmaceutical Co., Ltd., or Daewoong. In addition, Cinclus Pharma AG, or Cinclus, received QIDP designation for linaprazan glurate in combination with antibiotics for the treatment of H. pylori infection, completed a Phase 2 dose selection study for erosive GERD in November 2022, and plans to initiate Phase 3 studies in 2023 for the treatment of GERD and H. pylori infection. Finally, Sebela Pharmaceuticals, which acquired development and commercialization rights in United States and Canada to tegoprazan from HK inno.N, a South Korean company, has initiated two Phase 3 studies in the United States, one for non-erosive GERD and the other for healing and maintenance of healing of erosive GERD. The estimated completion date for these studies is May 2024 and December 2024, respectively. Outside the United States, in 2022 Daewoong launched fexuprazan in South Korea for the treatment of erosive GERD under the brand name Fexuclue, has submitted applications for regulatory approval in additional countries in Asia and Latin America, and has out-licensed rights to develop fexuprazan in China to Shanghai Haini, a subsidiary of China's Yangtze River Pharmaceutical Group. Also outside the United States, revaprazan is marketed by Yuhan Corporation in South Korea, and tegoprazan is marketed by HK inno.N in South Korea, is also marketed in China and Indonesia, and is currently in development by RaQualia Pharma, Inc. in Japan. Additionally, Jeil Pharm has initiated a Phase 3 trial in South Korea of its PCAB candidate, JP-1366, in erosive GERD, and Cinclus' linaprazan glurate has completed a Phase 2 clinical trial in Europe. To our knowledge, none of these compounds have demonstrated superiority to PPIs in a Phase 3 clinical trial. Additionally, we are aware of several clinical-stage PPIs in territories outside of the United States that if developed and approved in our licensed territories may compete with vonoprazan. These include Dexa Medica's DLBS-2411, currently launched in the Philippines and in Phase 3 in Indonesia, Sihuan Pharmaceutical's anaprazole, currently in Phase 3 in China, and Eisai's azeloprazole, currently in a Phase 2 in China. In July 2012, the Food and Drug Administration Safety and Innovation Act was passed, which included the GAIN Act. The GAIN Act is intended to provide incentives for the development of new, qualified infectious disease products. In December 2016, the 21st Century Cures Act was passed, providing additional support for the development of new infectious disease products. These incentives may result in more competition in the market for new antibiotics and may cause pharmaceutical and biotechnology companies with more resources than we have to shift their efforts towards the development of product candidates that could be competitive with vonoprazan or any future product candidates. Many of our competitors have significantly greater financial, technical, manufacturing, marketing, sales and supply resources or experience than we do. If we initial commercial launch of VOQUEZNA TRIPLE PAK, VOQUEZNA DUAL PAK, or if approved, VOQUEZNA or any future product candidate, we will face competition based on many different factors, including the safety and effectiveness of our products, the ease with which our products can be administered and the extent to which patients accept relatively new routes of administration, the timing and scope of regulatory approvals for these products, the availability and cost of manufacturing, marketing and sales capabilities, price, reimbursement coverage and patent position. Competing products could present superior treatment alternatives, including by being more effective, safer, more convenient, less expensive or marketed and sold more effectively than any products we may develop. Competitive products may make any products we develop obsolete or noncompetitive before we recover the expense of developing and commercializing vonoprazan or any future product candidates. If we are unable to compete effectively, our opportunity to generate revenue from the sale of our products we may develop, if approved, could be adversely affected.

The precise incidence and prevalence for all the conditions we aim to address with vonoprazan or any future product candidates are unknown. Our projections of both the number of people who have these diseases, as well as the subset of people with these diseases who have the potential to benefit from treatment of vonoprazan or any future product candidates, are based on our beliefs and estimates. These estimates have been derived from a variety of sources, including the scientific literature, surveys of clinics or market research, and may prove to be incorrect. Further, new trials may change the estimated incidence or prevalence of these diseases. The total addressable market across vonoprazan and any future product candidates will ultimately depend upon, among other things, the diagnosis criteria included in the final label for each of vonoprazan and any future product candidates approved for sale for these indications, the availability of alternative treatments and the safety, convenience, cost and efficacy of vonoprazan and any future product candidates relative to such alternative treatments, acceptance by the medical community and patient access, drug pricing and reimbursement. The number of patients in the United States and other major markets and elsewhere may turn out to be lower than expected, patients may not be otherwise amenable to treatment with our products or new patients may become increasingly difficult to identify or gain access to, all of which would adversely affect our results of operations and our business.

Our future growth may depend, in part, on our ability to develop and commercialize vonoprazan and any future product candidates in foreign markets, particularly Europe and Canada. We are not permitted to market or promote vonoprazan and any future product candidates before we receive regulatory approval from applicable regulatory authorities in foreign markets, and we may never receive such regulatory approvals for vonoprazan or any future product candidates. To obtain separate regulatory approval in any other countries we must comply with numerous and varying regulatory requirements regarding safety and efficacy and governing, among other things, clinical trials, commercial sales, pricing and distribution of vonoprazan and any future product candidates. If we obtain regulatory approval of vonoprazan and any future product candidates and ultimately commercialize our products in foreign markets, we would be subject to additional risks and uncertainties, including: - different regulatory requirements for approval of drugs in foreign countries;- reduced protection for intellectual property rights;- the existence of additional third-party patent rights of potential relevance to our business;- unexpected changes in tariffs, trade barriers and regulatory requirements;- economic weakness, including inflation, public health emergencies or political instability in particular foreign economies and markets;- compliance with tax, employment, immigration and labor laws for employees living or traveling internationally;- foreign currency fluctuations, which could result in increased operating expenses and reduced revenues, and other obligations incident to doing business in another country;- foreign reimbursement, pricing and insurance regimes;- workforce uncertainty in countries where labor unrest is common;- production shortages resulting from any events affecting raw material supply or manufacturing capabilities internationally; and - business interruptions resulting from geopolitical actions, including war and terrorism, or natural disasters including earthquakes, typhoons, floods and fires.