Waterdrop (WDH) Risk Factors

Our platform stores and processes certain personal and other sensitive data provided by users on our platforms, and we make certain personal information provided by the user or third-party data providers available to banks or insurance carriers with user consent. Personally identifiable and other confidential information is increasingly subject to legislation and regulations in mainland China and numerous foreign jurisdictions. The PRC governmental authorities have enacted a series of laws and regulations relating to the protection of privacy and personal information, under which internet service providers and other network operators are required to clearly indicate the purposes, methods and scope of any information collection and usage, to obtain appropriate user consent and to establish user information protection systems with appropriate remedial measures. However, this regulatory framework for privacy issues in mainland China and worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future. For example, on August 20, 2021, the Standing Committee of the National People's Congress of China promulgated the Personal Information Protection Law, which integrates the scattered rules with respect to personal information rights and privacy protection. Our mobile apps and websites only collect basic user personal information that is necessary to provide the corresponding services. We do not collect any sensitive personal information or other excessive personal information that is not related to the corresponding services. We update our privacy policies from time to time to meet the latest regulatory requirements of the governmental authorities and adopt technical measures to protect data and ensure cybersecurity in a systematic way. Nonetheless, the Personal Information Protection Law raises the protection requirements for processing personal information, and many specific requirements of the Personal Information Protection Law remain to be clarified by governmental authorities and courts in practice. We may be required to make further adjustments to our business practices to comply with the personal information protection laws and regulations. See "Item 4. Information on the Company- B. Business Overview-Regulation." In addition, regulatory requirements on cybersecurity and data privacy are constantly evolving and can be subject to significant changes. The regulators in mainland China have been increasingly focused on regulation in the areas of cybersecurity and data protection in recent years. For example, on June 10, 2021, the Standing Committee of the National People's Congress promulgated the PRC Data Security Law, which took effect in September 2021. The Data Security Law, among others, provides for a security review procedure for the data activities that may affect national security. On December 28, 2021, the Cyberspace Administration of China, the National Development and Reform Commission, the Ministry of Industry and Information Technology, and several other PRC governmental authorities jointly issued the Cybersecurity Review Measures, which provide that critical information infrastructure operators that procure internet products and services and network platform operators engaging in data processing activities must be subject to the cybersecurity review if their activities affect or may affect national security. The Cybersecurity Review Measures further stipulate that network platform operators holding over one million users' personal information shall apply with the Cybersecurity Review Office for a cybersecurity review before public offering at a foreign stock exchange. However, given the Cybersecurity Review Measures were relatively new, it remains uncertain how these measures would affect us. Furthermore, on November 14, 2021, the Cyberspace Administration of China released the Regulations on the Network Data Security (Draft for Comments) and accepted public comments until December 13, 2021. These draft regulations provide that data processors refer to individuals or organizations that autonomously determine the purpose and the manner of processing data. In accordance with these draft regulations, data processors shall apply for a cybersecurity review for the following activities: (i) merger, reorganization or division of Internet platform operators that have acquired a large number of data resources related to national security, economic development or public interests to the extent that affects or may affect national security; (ii) listing abroad of data processors which process over one million users' personal information; (iii) the listing of data processors in Hong Kong which affects or may affect national security; or (iv) other data processing activities that affect or may affect national security. However, there have been no clarifications from the authorities as of the date of this annual report as to the standards for determining such activities that "affects or may affect national security." See "Item 4. Information on the Company- B. Business Overview-Regulation." As of the date of this annual report, these draft regulations are released for public comment only, and its provisions and the anticipated adoption or effective date may be subject to change with substantial uncertainty. These draft regulations remain unclear on whether the requirements will be applicable to companies that have been listed in the United States, such as us. We cannot predict the impact of these draft regulations, if any, at this stage, and we will closely monitor and assess any development in the rule-making process. If the enacted versions of these draft regulations mandate clearance of cybersecurity review and other specific actions to be completed by China-based companies listed on a U.S. stock exchange, such as us, we face uncertainties as to whether such clearance can be timely obtained, or at all. As of the date of this annual report, we have not been involved in any formal investigations on cybersecurity review made by the Cyberspace Administration of China on such basis. However, if we are not able to comply with the cybersecurity and network data security requirements in a timely manner, or at all, we may be subject to government enforcement actions and investigations, fines, penalties, suspension of our non-compliant operations, or removal of our applications from the application stores, among other sanctions, which could materially and adversely affect our business and results of operations. In addition to the cybersecurity review, these draft regulations require that data processors processing "important data" or listed overseas shall conduct an annual data security assessment by itself or commission a data security service provider to do so, and submit the assessment report of the preceding year to the municipal cybersecurity department by the end of January each year. If a final version of these draft regulations is adopted, we may be subject to review when conducting data processing activities and annual data security assessment and may face challenges in addressing its requirements and make necessary changes to our internal policies and practices in data processing. The laws and regulations in mainland China relating to data privacy and cybersecurity, including, among others, the PRC Cybersecurity Law and the PRC Data Security Law are relatively new and subject to interpretation by the regulators. Although we have taken various measures to comply with all applicable laws and regulations regarding cybersecurity and data privacy in mainland China, we cannot assure you that the measures we have taken or will take are adequate under relevant laws, and we may be held liable in the event of any violation of the laws and regulations. We expect that these areas will receive greater public scrutiny and attention from regulators and more frequent and rigid investigation or review by regulators, which will increase our compliance costs and subject us to heightened risks and challenges. If we are unable to manage these risks, we could become subject to penalties, fines, suspension of business and revocation of required licenses, and our reputation and results of operations could be materially and adversely affected. In addition to laws, regulations and other applicable rules regarding privacy and privacy advocacy, industry groups or other private parties may propose new and different privacy standards. We cannot assure you that our existing privacy and personal protection system and technical measures will always be considered sufficient under applicable laws, regulations and other privacy standards. We could be adversely affected if legislation or regulations in mainland China are expanded to require changes in business practices or privacy policies, or if the PRC governmental authorities interpret or implement their legislation or regulations in ways that negatively affect our business. We may also be subject to additional regulations, laws and policies adopted by the local governments to apply more stringent social and ethical standards in data privacy resulting from the increased global focus on this area.

The third-party insurance brokerage and agency industry in China is intensely competitive. Our current or potential competitors include (i) online third-party brokers and agents such as Ant Group and WeSure; and (ii) offline third-party brokers and agents such as Fanhua and Datong. New competitors may emerge at any time. We also face competition from traditional insurance intermediaries such as bancassurance, tied agency channel of insurance carriers and direct sales channel of insurance carriers. Additional players may also enter into the rapidly evolving medical crowdfunding space from time to time. We also face intensive competition as more companies tap into the global clinical research and development third-party service market where many market players exist. We also face competition in other healthcare service market as we are exploring healthcare-related business initiatives. Existing or potential competitors may have substantially greater brand recognition and possess more financial, marketing and research resources than we do. Our competitors may introduce platforms with more attractive products, content and features, or services or solutions with competitive pricing or enhanced performance that we cannot match. Some of our competitors may have more resources to develop or acquire new technologies and react quicker to changing requirements of consumers. In addition, for the online insurance marketplace industry we operate in, our target insurance policy purchasers, PRC residents with potential insurance needs, may seek insurance products and services in well-equipped and developed neighboring insurance markets. We may fail to compete effectively with our competitors and industry participants in neighboring insurance markets.

The brand recognition and reputation of our "Waterdrop" or "Shuidi" brand and the successful maintenance and enhancement of our brand and reputation have contributed and will continue to contribute significantly to our success and growth. Any negative perception and publicity, whether or not justified, such as complaints and accidents in relation to user experience or quality of services, including inappropriate behavior of the crowdfunding consultants, customer service staff, sales personnel, agents and other related personnel, and our purported inability to satisfy certain user requirements, could tarnish our reputation and reduce the value of our brand. Further, our competitors may fabricate complaints or negative publicity about us for the purpose of vicious competition. We face the ongoing risk of misinformation being disseminated through social media channels that we leverage, which may contain fabricated sensitive topics of which purposes are to generate traffic and gain popularity. Unverified claims, rumors or false accusations concerning our platform may be circulated, which could potentially harm our platform's reputation and users' confidence. With the increased use of social network, adverse publicity can be disseminated quickly and broadly, making it increasingly difficult for us to respond and mitigate effectively. We are also subject to negative publicity regarding our platform participants, whose activities are out of our control. Negative public perception on the insurance products by insurance carriers on our platform or that insurance carriers on our platform do not provide satisfactory customer services, even if factually incorrect or based on isolated incidents, could undermine the trust and credibility we have established and have a negative impact on our ability to attract new users or retain our current users.

We launched our clinical trial patient recruitment services in December 2021. We have developed the digital platform, E-Find, to help pharmaceutical companies find matches for clinical trials. People in need, mostly patients, can have access to investigational drugs and frontier innovative therapies through E-Find. Identifying, screening and enrolling patients to participate in clinical trials is critical to the success of such new business as well, and we may not be able to identify, recruit and enroll a sufficient number of patients with the required or desired characteristics to complete the clinical trials in a timely manner. We may have difficulty enrolling patients, for example, if the competitors of the pharmaceutical companies we cooperate with have ongoing clinical trials for similar products and the patients who would otherwise be eligible for our clinical trials instead enroll in the competitors' clinical trials. Our patient recruitment businesses are also subject to privacy protection and data compliance risks. Before patients enroll in clinical trials, we collect and maintain medical data, treatment records and other personal data. We are subject to the privacy laws and regulations. Although we have taken measures to maintain the confidentiality of medical records and personal data of patients prior to enrolling in clinical trials so that they cannot be accessed without proper authorization, we cannot assure you that such measures are effective in ensuring our compliance with the laws and regulations, or that we are able to prevent the enrollees' private or medical records being divulged without their consent. For example, our information technology systems may be hacked, and personal data could leak due to theft or misuse of personal information arising from misconduct or negligence, leading to disclosure. In addition, the clinical trials are conducted by third-party biopharmaceutical and biotechnology companies that we cooperate with, and we cannot ensure that their professionals involved in the clinical trials will always comply with our data privacy measures. Furthermore, any changes in the laws and regulations may affect our ability to use medical data and subject us to liability for the use of such data for previously permitted purposes. Any failure to protect the confidentiality of the medical records and personal data of patients or any restrictions on our use of medical data or any liability arising therefrom could materially and adversely affect our business, financial condition and results of operations. If our relationship with hospitals worsens, the patient recruitment consultants may be banned from entering the hospitals or patients' wards, which may materially affect our offline patient recruitment consultancy of our business. We may also experience enrollment delays related to increased or unforeseen regulatory, legal and logistical requirements at certain clinical trial sites. Prolonged regulatory review and contractual discussions with individual clinical trial sites may cause such delays. Any delays in planned clinical trials could result in increased costs, delays in advancing the product candidates of the pharmaceutical companies we cooperate with and testing the effectiveness of product candidates or in termination of the clinical trials altogether, which in turn may have a material and adverse impact on our patient recruitment business.

We highly rely on our data in every step of our business, in particular, the entire insurance value chain, including research and co-design of insurance products, risk management, claim settlement, and policy holder services. We also rely on our data in the development and operation of medical crowdfunding and healthcare business. We currently also use external data sources for our business analysis, which can become unavailable due to regulatory restrictions or other reasons.

In addition to growing our user base organically, we also cooperate with our user acquisition channels to convert their user traffic into user base of our platform. If our user acquisition channels do not renew their agreements with us, choose to work with our competitors, or terminate their cooperation with us, we may lose potential users and our business and results of operations will be negatively affected. In addition, if our user acquisition channels lose influence over their traffic or otherwise fail to effectively convert their users to our users, our business and results of operations may suffer. Furthermore, we have incurred significant expenses for paying third-party user acquisition channels marketing fees. If certain of existing third-party user acquisition channels require higher rates of marketing fees or we fail to negotiate favorable terms with them or find new third-party user acquisition channels, our cost of user acquisition may increase, and our results of operations may be adversely affected.

We have expanded business operations into overseas markets. However, we have limited history and experience operating in jurisdictions outside of mainland China. We have made certain investments, and may further make significant investments to expand our international operations and compete with local competitors. Such investments may not be successful and may negatively affect our operating results. Conducting our business internationally, particularly in countries in which we have limited experience, subjects us to various risks, which include, among others: - operational and compliance challenges caused by distance, language, and cultural differences;- the resources required to build a local management team in each new market and to localize our service offerings to appeal to consumers in that market;- compliance challenges caused by unfamiliar laws and regulations;- competition with businesses that understand local markets better than we do, that have pre-existing relationships with potential consumers in those markets, or that are favored by government or regulatory authorities in those markets;- international geopolitical tensions;- political, social and economic instability in any jurisdiction where we operate;- international export controls and economic and trade sanctions;- legal uncertainty including uncertainty resulting from unique local laws or a lack of clear legal precedent;- regulatory press and licenses requirements from local authorities in insurance, crowdfunding or other industries;- fluctuations in currency exchange rates;- managing operations in markets in which offline activities are favored over online platform or service;- adverse tax consequences, including the complexities of foreign value added tax systems, and restrictions on the repatriation of earnings;- increased financial accounting and reporting burdens, and complexities associated with implementing and maintaining adequate internal controls;- difficulties in implementing and maintaining the financial systems and processes needed to enable compliance across multiple offerings and jurisdictions; and - reduced or varied protection for intellectual property rights in some markets. These risks could adversely affect our international operations, which could in turn adversely affect our business, financial condition, and operating results.

In addition to the impact of COVID-19, our business could be materially and adversely affected by natural disasters, health epidemics or other public safety concerns affecting China. Natural disasters, such as severe weather conditions, a snowstorm, flood or hazardous air pollution, or other outbreaks, may give rise to server interruptions, breakdowns, system failures, technology platform failures or internet failures, which could cause the loss or corruption of data or malfunctions of software or hardware as well as adversely affect our ability to operate our platform and provide services and solutions. In recent years, there have been outbreaks of epidemics in China and globally, such as COVID-19, H1N1 flu, avian flu or another epidemic. Our business operations could be disrupted by any of these epidemics. Our business could also be adversely affected if our employees are affected by health epidemics, such as new variants of COVID-19 or outbreaks of other diseases. In addition, our results of operations could be adversely affected to the extent that any health epidemic harms the Chinese economy in general. A prolonged outbreak of any of these illnesses or other adverse public health developments in China or elsewhere in the world could have a material adverse effect on our business operations. Such outbreaks could significantly impact the insurance industry, which could severely disrupt our operations and adversely affect our business, financial condition and results of operations. Our headquarters are located in Beijing, where most of our management and employees currently reside. Most of our system hardware and back-up systems are hosted in facilities located in Shanghai. Consequently, if any natural disasters, health epidemics or other public safety concerns were to affect Beijing and Shanghai, our operation may experience material disruptions, which may materially and adversely affect our business, financial condition and results of operations.