Prenetics Group (PRE) Risk Factors

We collect and store sensitive data, including personally identifiable information, genetic information, payment information, intellectual property and proprietary business information owned or controlled by ourselves, our customers, or other parties. We manage and maintain our data and applications utilizing cloud-based systems. We also protect sensitive customer data by logically segregating access and storage of personally identifiable and genetic data from other business operations involving data processing. We identify a variety of risks in connection of protecting the critical customer and business information, including loss of access risk, inappropriate disclosure, inappropriate modification, and the risk of us being unable to adequately monitor and modify controls over our critical information. Any technical problems that may arise in connection with our data and systems, including those that are hosted by third-party providers, could result in interruptions to our business and operations or exposure to security vulnerabilities. These types of problems may be caused by a variety of factors, including infrastructure changes, intentional or accidental human actions or omissions, software errors, malware, viruses, security attacks, fraud, spikes in customer usage and denial of service issues. From time to time, large third-party web hosting providers utilized by us may experience outages or other problems that would result in their systems being offline and inaccessible, which could materially impact our business and operations. In addition, our various customer tools and platforms are currently accessible through our online portal and/or through our mobile applications, which may also be exposed to security breaches. The secure processing, storage, maintenance and transmission of critical customer and business information are vital to our operations and our business strategy. Although we devote significant resources to protecting such information and take what we believe to be reasonable and appropriate measures, including a formal and dedicated enterprise security program, to protect sensitive information from compromises such as unauthorized access, disclosure, or modification or lack of availability, our information technology and infrastructure may be vulnerable to attacks by hackers or viruses or breached due to employee error, malfeasance or other disruptions. We may be exposed to significant monetary damages which are not covered by our liability insurance. Further, a security breach could require us to expend substantial additional resources related to the security of our information systems and providing required breach notifications, diverting resources from other projects and disrupting our businesses. In addition to data security risks, we also face data privacy risks. Should we actually violate, or be perceived to have violated, any privacy promises we make to our customers, we could be subject to a complaint from an affected individual or interested privacy regulator, such as the Office of the Privacy Commissioner for Personal Data in Hong Kong. This risk is heightened given the sensitivity of the data we collect. Even the perception that the privacy of personal information is not satisfactorily protected or does not meet regulatory or contractual requirements could inhibit sales of our solutions, and any failure to comply with such laws, regulations and contractual requirements could lead to significant fines, penalties or other liabilities. There has been unprecedented activity in the development of data protection regulation around the world, and as a result, the interpretation and application of consumer, health-related and data protection laws in Hong Kong, the U.K., Europe and other jurisdictions in which we conduct business are often uncertain, contradictory and in flux. Numerous local and international laws and regulations address privacy and the collection, storing, sharing, use, disclosure, and protection of certain types of data in jurisdictions where we operate, including the Personal Data (Privacy) Ordinance in Hong Kong, or "PDPO" and the U.K. GDPR. These laws, rules, and regulations evolve frequently and their scope may continually change, through new legislation, amendments to existing legislation, and changes in enforcement, and may be inconsistent from one jurisdiction to another. The PDPO applies to data users that control the collection, holding, processing or use of personal data in Hong Kong and does not have extraterritorial effect. The PDPO does not specifically govern the use of human genetic data or other sensitive personal data, and we are subject to the general requirements under PDPO including to obtain the prescribed consent of the data subject and to take all practicable steps to protect the personal data held by data users against unauthorized or accidental access, loss or use. Breaches of the PDPO may lead to a variety of civil and criminal sanctions including fines up to HK$100,000 and imprisonment of up to two years. In addition, data subjects have a right to bring proceedings in court to seek compensation for damage. We also have operations in the U.K. and the European Union and are therefore required to comply with increasingly complex and changing data security and privacy regulations in the U.K. and the European Union that regulate the collection, use and transfer of personal data, including the transfer of personal data between or among countries. For example, the European Union's General Data Protection Regulation, or "GDPR," now also enacted in the U.K., or "the U.K. GDPR," as well as the U.K. Data Protection Act (2018), or "DPA," have imposed stringent compliance obligations regarding the handling of personal data and have resulted in the issuance of significant financial penalties for noncompliance. The U.K. GDPR and GDPR broadly apply to any entity established in the U.K. and the European Union as well as extraterritorially to any entity outside the U.K. and the European Union that offers goods or services to, or monitors the behavior of, individuals who are located in the U.K. and the European Union. The GDPR imposes strict requirements on controllers and processors of personal data, including enhanced protections for "special categories" of personal data, which includes sensitive information such as health and genetic information of data subjects. As a controller and processor of personal data, we are subject to extensive obligations related to the collection, recording, use, storage, disclosure and destruction of any test results and associated personal data by our services, laboratories, websites and applications in accordance with the various data protection principles prescribed under the U.K. GDPR, and "genetic data" and "data concerning health" which we collect in connection with our testing services constitute a special category of data under the U.K. GDPR and the DPA, and are subject to more stringent rules that provide more protection of such data given the sensitive nature. The U.K. GDPR and GDPR also grant individuals various rights to seek legal remedies in relation to their personal data if the individual believes his or her rights have been violated, including the rights of access, rectification, objection to certain processing and deletion. Failure to comply with the requirements of the GDPR or the related national data protection laws may result in significant administrative fines issued by the U.K. or European Union regulators. Under the U.K. GDPR, the Information Commissioner can impose significant administrative fines on both data controllers and data processors. There are two tiers of such fines, which are the higher of up to £8.7 million or 2% of global turnover, or the higher of up to £17.5 million or 4% of global turnover. Under the GDPR, maximum penalties for violations are capped at 20 million euros or 4% of an organization's annual global revenue, whichever is greater. Despite our efforts to comply with applicable laws, regulations, and other obligations relating to privacy, data protection, and information security, it is possible that our interpretations of the law or other obligations, practices, or platform could be inconsistent with, or fail or be alleged to fail to meet all requirements of, such laws, regulations, or obligations. If so, this could result in government-imposed fines or orders requiring us to change our commercial practices, which could disrupt our operations and adversely affect our business. In addition, these privacy laws and regulations may differ from country to country and region to region, and our obligations under these laws and regulations vary based on the nature of our activities in the particular jurisdiction, such as whether we collect samples from individuals in the local jurisdiction, perform testing in the local jurisdiction, or process personal information regarding employees or other individuals in the local jurisdiction. Complying with changing regulatory requirements requires us to incur substantial costs, exposes us to potential regulatory action or litigation, and may require changes to our business practices in certain jurisdictions, any of which could materially and adversely affect our business operations and operating results. There is no assurance that we are or will remain in compliance with diverse privacy and data security requirements in all of the jurisdictions in which we currently operate and may operate in the future. Failure of us to comply with applicable laws or regulations or any other obligations relating to privacy, data protection, or information security, or any compromise of security that results in unauthorized access to, or use or release of personally identifiable information or other data relating to our customers, or other individuals, or the perception that any of the foregoing types of failure or compromise has occurred, could damage our reputation and brand, discourage new and existing customers from using our platform, or result in fines, investigations, or proceedings by governmental agencies and private claims and litigation, any of which could adversely affect our business, financial condition, and results of operations.

We generated a total revenue of approximately $275.8 million and $35.2 million for the years ended December 31, 2022 and 2023, respectively, out of which $262.6 million and $13.5 million were generated from our discontinued Diagnostics segment, which primarily comprises of our COVID-19 testing services named Project Screen. However, we no longer provide COVID-19 testing services as demand for such services has been substantially reduced with the production and widely administered use of efficacious vaccines and other therapeutic treatment for COVID-19, as well as changes in mandatory testing requirements. Therefore, our ability to execute our growth strategies and achieve and maintain profitability will depend on our ability to derive significant revenue from other products and services and expand our overall customer base. If we are unable to launch new products successfully and expand our overall customer base, our business and results of operations will be materially and adversely affected.

We believe that the brand identity that we have developed has significantly contributed to the success of our business. It is critical that we continue to maintain and enhance the recognition and reputation of our brands. Many factors, some of which are beyond our control, are important to maintaining and enhancing our brands and if not properly managed, may cause material harm to our brands. These factors include our ability to: (i) provide effective, accurate and user-friendly testing services to customers; (ii) maintain the efficiency, reliability and quality of the testing services we provide to our consumers; (iii) maintain or improve consumer satisfaction with our after-sale services; (iv) increase brand awareness through marketing and brand promotion activities; and (v) preserve our reputation and goodwill in the event of any negative publicity on our services, product quality, price, data privacy and security, our industry and other players within the industry or other issues affecting us or our peers. If our devices are perceived by the public to be of poor quality or if our test kits are perceived to provide inaccurate results or significantly delayed responses, such perception, even if factually incorrect or based on isolated incidents, could damage our reputation, diminish the value of our brand, undermine the trust and credibility we have established and have a negative impact on our ability to attract new clients and customers or retain our current clients and customers. If we fail to promote and maintain our brands including "Prenetics," or "CircleDNA," or if we incur excessive expenses in this effort, our business, operating results and financial condition may be materially and adversely affected. We anticipate that, as the market becomes increasingly competitive, maintaining and enhancing our brands may become increasingly difficult and expensive.

We are highly dependent on our senior management team and key advisors and personnel. Our success will depend on our ability to retain senior management and to attract and retain qualified advisors and personnel in the future, including sales and marketing professionals and other highly skilled personnel and to integrate current and additional personnel in all departments. To induce valuable employees to remain at our Company, in addition to salary and cash incentives, we have issued, and will in the future issue, equity incentive awards that vest over time. The value to employees of such equity incentive awards that vest over time may be significantly affected by movements in our share price which is beyond our control, and may at any time be insufficient to counteract more lucrative offers from other companies. Despite our efforts to retain valuable employees, members of our management and development teams may terminate their employment with us on relatively short notice, even where we have employment agreements in place. The standard employment agreement of our employees provides that the employee can terminate the employment by giving at least one month's notice or payment in lieu of notice, which means that any of our employees could leave their employment at any time on relatively short notice or without notice at all. We also do not maintain "key person" insurance policies on the lives of these people or the lives of any of our other employees. The loss of members of our senior management, sales and marketing professionals and scientists as well as contract employees could result in delays in product development and harm our business. In particular, the loss of the services of Mr. Danny Yeung, our Director, Chairperson and Chief Executive Officer, Dr. Lawrence Tzang, our Chief Scientific Officer or Mr. Stephen Lo, our Chief Financial Officer, could significantly delay or prevent the achievement of our strategic objectives and otherwise have a material adverse impact on our business. If we are not successful in attracting and retaining highly qualified personnel, our business, financial condition and results of operations will be negatively impacted. Competition for skilled personnel across virtually all areas where we operate and need to attract additional talent is intense. If we are not successful in attracting and retaining highly qualified personnel, the rate and success at which we can develop and commercialize our products will be limited, and our business, financial condition and results of operations would be negatively impacted. In addition, we rely on our scientific advisory board comprised of accomplished scholars and experts in oncology, genomics and precision oncology to offer invaluable insights on the latest scientific developments and provide guidelines on development of our pipeline products. If any of our scientific advisor leaves the advisory board, our research and development capabilities may be negatively affected.

We rely on a limited number of suppliers for materials, and genome sequencing service. We do not have long-term agreements with most of our suppliers, and our suppliers could cease supplying these materials and services at any time, or fail to provide us with sufficient quantities of materials or materials that meet our specifications or services that are satisfactory to us. Obtaining substitute components could be difficult, time-consuming and costly and it could require us to redesign or revalidate our test kit. Our laboratory operations could be interrupted if we encounter delays or difficulties in securing these reagents, sequencers or other equipment or materials, and if we cannot timely obtain an acceptable substitute. Such interruption could significantly affect our ability to conduct our tests and could adversely affect our ability to meet customer demand. Although we maintain relationships with suppliers with the objective of ensuring that we have adequate supply for the delivery of our services, increases in demand for our services can result in supply shortages and higher costs. Our suppliers may not be able to meet our delivery schedules or performance and quality specifications, and we may not be able to purchase such items at a competitive cost. Further, we may experience shortages in certain items as a result of limited availability, increased demand, pandemics or other outbreaks of contagious diseases, weather conditions and natural disasters, as well as other factors outside of our control. In addition, our freight costs may increase due to factors such as limited carrier availability, increased fuel costs, increased compliance costs associated with new or changing government regulations, pandemics or other outbreaks of contagious diseases and inflation. Furthermore, the prices charged for our products may not reflect changes in our packaging material, freight, tariff and energy costs at the time they occur, or at all. Any of the foregoing risks, if they occur, could have a material adverse effect on our business, financial condition and results of operations.

Like many other companies that operate in Asia, our business will be materially affected by economic and political conditions in Asia, which could be negatively impacted by many factors beyond our control, such as inability to access capital markets, control of foreign exchange, changes in exchange rates, rising interest rates or inflation, slowing or negative growth rate, government involvement in allocation of resources, inability to meet financial commitments in a timely manner, terrorism, political uncertainty, epidemic or pandemic, civil unrest, fiscal or other economic policy of governments, and the timing and nature of any regulatory reform. The recent geo-political uncertainties may also give rise to uncertainties in global economic conditions and adversely affect general investor confidence. Political unrest such as protests or demonstrations could disrupt economic activities and adversely affect our business. There can be no assurance that these protests and other economic, social, or political unrest in the future will not have a material adverse effect on our financial conditions and results of operations.

One of our key business strategies is to pursue international expansion of our business operations and market our products in multiple jurisdictions. As a result, we expect that our business will be subject to a variety of risks associated with doing business internationally, including an increase in our expenses and diversion of the management's attention from other aspects of our business. Accordingly, our business and financial results in the future could be adversely affected due to a variety of factors, including: (i) political, social and/or economic instability; (ii) risks related to governmental regulations in foreign jurisdictions and unexpected changes in regulatory requirements and enforcement; (iii) fluctuations in currency exchange rates; (iv) higher levels of credit risk and payment fraud; (v) burdens of complying with a variety of foreign laws; (vi) complexities and difficulties in obtaining intellectual property protection and reduced protection for intellectual property rights in some countries; (vii) difficulties in staffing and managing global operations and the increased travel, infrastructure and legal compliance costs associated with multiple international locations and subsidiaries; (viii) management of tax consequences and compliance; and (ix) other challenges caused by distance, language, and cultural differences, making it harder to do business in certain international jurisdictions. In addition, we may be subject to increased regulatory risks and local competition in various jurisdictions where we plan to expand operations but have limited operating experience. Such increased regulatory burden and competition may limit the available market for our products and services and increase the costs associated with marketing the products and services where we are able to offer our products. If we are unable to manage the complexity of global operations successfully, or fail to comply with any of the regulations in other jurisdictions, our financial performance and operating results could suffer.