Weave Communications (WEAV) Risk Factors

Our ability to attract new customers and increase revenue from existing customers depends in part on our ability to enhance and improve our existing platform and products, increase adoption and usage of our products and introduce new products. The success of any enhancements or new products depends on several factors, including timely completion, adequate quality testing, actual performance quality, market-accepted pricing levels, overall market acceptance, ease of use of the new product and trained customer support personnel who can assist customers with the new product. Enhancements and new products that we develop may not be introduced in a timely or cost-effective manner, may contain errors or defects, may require reworking features and capabilities, may have interoperability difficulties with our platform or other products or may not achieve the broad market acceptance necessary to generate significant revenue. Our ability to generate usage of additional products by our customers may also require increasingly sophisticated and more costly sales efforts. In addition, adoption of new products or enhancements may put additional strain on our customer support and success teams, which could require us to make additional expenditures related to further hiring and training. We also may invest in the acquisition of complementary businesses, technologies, services, products and other assets that expand the products that we can offer our customers. We may make these investments without being certain that they will result in products or enhancements that will be accepted by existing or prospective customers. If we are unable to successfully enhance our existing platform and products to meet evolving customer requirements, increase adoption and usage of our products or develop new products, or if our efforts to increase the usage of our products are more expensive than we expect, then our business, results of operations and financial condition would be adversely affected.

The market for vertically tailored customer experience and payments software in general, and cloud-based communications in particular, is subject to rapid technological change, evolving industry standards, changing regulations, as well as changing customer needs, requirements and preferences. Customers and consumers may choose to adopt other forms of electronic communications or alternative customer engagement platforms. The success of our business will depend, in part, on our ability to adapt and respond effectively to these changes on a timely basis. If we are unable to develop functionality for our platform or new products that satisfy our customers and provide enhancements and new features for our existing products that keep pace with rapid technological and industry change, including but not limited to applicable industry standards, our business, results of operations and financial condition could be adversely affected. If new technologies emerge that are able to deliver competitive products and services at lower prices, more efficiently, more conveniently or more securely, such technologies could adversely impact our ability to compete effectively. Our platform must integrate with a variety of network, hardware, mobile and software platforms and technologies, and we need to continuously modify and enhance our products and platform to adapt to changes and innovation in these technologies if mobile phone operating system providers, network service providers, our customers or their end users adopt new software platforms or infrastructure, we may be required to develop new versions of our products to work with those new platforms or infrastructure. This development effort may require significant resources, which could adversely affect our business, results of operations and financial condition. We may need to devote significant resources to the creation, support, and maintenance of our mobile applications, and any failure of our platform and products to operate effectively with evolving or new platforms and technologies could reduce the demand for our platform and products. If we are unable to respond to these changes in a cost-effective manner, or at all, our platform and products may become less marketable and less competitive or obsolete, and our business, results of operations and financial condition could be adversely affected.

There is considerable activity in connection with the development of intellectual property, whether or not patentable, in our industry. Our competitors, as well as a number of other entities, including non-practicing entities and individuals, may own or claim to own intellectual property relating to our industry and our business. As we face increasing competition and our public profile increases, the possibility of intellectual property rights claims against us may also increase. We have in the past and may in the future be subject to legal proceedings and claims by our competitors or other third parties that we are infringing upon, misappropriating, or violating their intellectual property rights, even if we are unaware of such intellectual property rights. Such claims, regardless of merit, may result in litigation. The costs of defending such litigation are considerable, and such litigation may divert management and key personnel's attention and resources, which might seriously harm our business, results of operations, and financial condition. We may be required to settle such litigation on terms that are unfavorable to us. For example, a settlement may require us to obtain a license to continue practices found to be in violation of a third-party's rights, which may not be available on reasonable terms and may significantly increase our operating expenses. A license to continue such practices may not be available to us at all. As a result, we may also be required to develop alternative non-infringing technology or practices or discontinue the practices. The development of alternative non-infringing technology or practices would require significant effort and expense. Similarly, if any litigation to which we may be a party fails to settle and we go to trial, we may be subject to an unfavorable judgment. For example, the terms of a judgment may require us to cease some or all of our operations or require the payment of substantial amounts to the other party. Any of these events or other outcomes may: - materially and adversely affect our business and results of operations;- result in the loss of a substantial number of existing customers or prohibit the acquisition of new customers;- cause us to pay license fees for intellectual property we are deemed to have infringed;- cause us to incur costs and devote valuable technical resources to redesigning our products or platform;- cause our cost of revenue to increase;- cause us to accelerate expenditures to preserve existing revenue;- cause existing or new vendors to require pre-payments or letters of credit;- materially and adversely affect our brand in the marketplace and cause a substantial loss of goodwill;- cause us to change our business methods;- require us to cease certain business operations or offering certain products or features; and - lead to our bankruptcy or liquidation.

Our customers use our platform and products for important aspects of their businesses, and any errors, defects or disruptions to our products and any other performance problems with our products could damage our customers' businesses and, in turn, hurt our brand and reputation and erode customer trust. We provide regular updates to our platform and products, which have in the past contained, and may in the future contain, undetected errors, failures, vulnerabilities and bugs when first introduced or released. Real or perceived errors, failures or bugs in our products could result in negative publicity, loss of or delay in market acceptance of our platform, loss of competitive position, lower customer retention or claims by customers for losses sustained by them. In such an event, we may be required, or may choose, for customer relations or other reasons, to expend additional resources to help correct the problem. In addition, we may not carry insurance sufficient to compensate us for any losses that may result from claims arising from defects or disruptions in our products. As a result, our reputation and our brand could be harmed, and our business, results of operations and financial condition may be adversely affected.

Our continued growth depends in part on the ability of our existing and potential customers to access our platform at any time and within an acceptable amount of time. Our platform is proprietary, and we rely on the expertise of members of our engineering, operations, and product development teams for our platform's continued performance. We have experienced, and may in the future experience, disruptions, outages, and other performance problems related to our platform due to a variety of factors, including infrastructure changes, introductions of new functionality, human or software errors, delays in scaling our technical infrastructure if we do not maintain enough excess capacity and accurately predict our infrastructure requirements, capacity constraints due to an overwhelming number of users accessing our platform simultaneously, denial-of-service attacks, human error, actions or inactions attributable to third parties, earthquakes, hurricanes, floods, fires, natural disasters, power losses, disruptions in telecommunications services, fraud, military or political conflicts, terrorist attacks and other geopolitical unrest, computer viruses, ransomware, malware or other events. Our systems also may be subject to break-ins, sabotage, theft, and intentional acts of vandalism, including by our own employees. Some of our systems are not fully redundant and our disaster recovery planning may not be sufficient for all eventualities. Further, our business or network interruption insurance may not be sufficient to cover all of our losses that may result from interruptions in our service as a result of systems failures and similar events. From time to time, we may experience limited periods of server downtime due to server failure or other technical difficulties. In some instances, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time. It may become increasingly difficult to maintain and improve our performance, especially during peak usage times and as our platform becomes more complex and our user traffic increases. If our platform is unavailable or if our users are unable to access our platform within a reasonable amount of time, or at all, our business would be adversely affected and our brand could be harmed. In the event of any of the factors described above, or certain other failures of our infrastructure, customer or guest data may be permanently lost. Moreover, a limited number of our agreements with customers may provide for limited service level commitments from time to time, and it is possible that an increasing number of our agreements may include service-level commitments in the future. If we experience significant periods of service downtime in the future, we may be subject to claims by our customers against these service level commitments. System failures in the future could also result in significant losses of revenue. To the extent that we do not effectively address capacity constraints, upgrade our systems as needed, and continually develop our technology and network architecture to accommodate actual and anticipated changes in technology, our business and operating results may be adversely affected.

We continue to incorporate additional AI solutions and features into our platform and our business and these solutions and features may become more important to our operations or to our future growth over time. However, there can be no assurance that we will realize the desired or anticipated benefits from AI. Our investments in AI solutions and features may negatively impact our cost of revenue and gross margins until we are able to increase revenue enough to offset these investments. We may also fail to properly implement or market our AI solutions and features. Our competitors or other third parties may incorporate AI into their products, offerings, and solutions more quickly or more successfully than us, which could impair our ability to compete effectively and adversely affect our results of operations. Our ability to effectively implement and market our AI solutions and features will depend, in part, on our ability to attract and retain employees with AI expertise, and we expect significant competition for professionals with the skills and technical knowledge that we will require. Additionally, our offerings based on AI may expose us to additional claims, demands and proceedings by private parties and regulatory authorities and subject us to legal liability as well as brand and reputational harm. For example, our business, financial condition and results of operations may be adversely affected if content or recommendations that AI solutions or features assist in producing are or are alleged to be deficient, inaccurate, or biased, or if such content, recommendations, solutions, or features or their development or deployment (including the collection, use, or other processing of data used to train or create such AI solutions or features) are found to have or alleged to have infringed upon or misappropriated third-party intellectual property rights or violated applicable laws, regulations, or other actual or asserted legal obligations to which we are or may become subject. The legal, regulatory, and policy environments around AI are evolving rapidly, and we may become subject to new and evolving legal and other obligations. These and other developments may require us to make significant changes to our use of AI, including by limiting or restricting our use of AI, and which may require us to make significant changes to our policies and practices, which may necessitate expenditure of significant time, expense, and other resources. AI also presents emerging ethical issues, and if our use of AI becomes controversial, we may experience brand or reputational harm.

A portion of the technologies we use in our products incorporate "open source" software, and we may continue to incorporate open source software in our products in the future. From time to time, companies that use third-party open source software have faced claims challenging the use of such open source software and their compliance with the terms of the applicable open source license. We may be subject to lawsuits by parties claiming ownership of what we believe to be open source software, or claiming noncompliance with the applicable open source licensing terms. Some open source licenses require end-users who distribute or make available software and services across a network that include open source software to make available all or part of such software, which in some circumstances could include valuable proprietary code, at no cost, or license such code under the terms of the particular open source license. While we employ practices designed to monitor our compliance with the licenses of third-party open source software and protect our valuable internally-developed source code, we may inadvertently use third-party open source software in a manner that exposes us to claims of non-compliance with the applicable terms of such license, including claims for infringement of intellectual property rights or for breach of contract. Additionally, if a third-party software provider has incorporated open source software into software that we license from such provider, we could be required to disclose source code that incorporates or is a modification of such licensed software. Furthermore, there is an increasing number of open-source software license types, almost none of which have been tested in a court of law, resulting in a dearth of guidance regarding the proper legal interpretation of such license types. If an author or other third-party that distributes open source software that we use or license were to allege that we had not complied with the conditions of the applicable open source license, we could expend substantial time and resources to re-engineer some or all of our software or be required to incur significant legal expenses defending against such allegations. Additionally, we could be subject to significant damages, enjoined from the use of our platform, products, or other technologies we use in our business that contain such open source software, and be required to comply with the foregoing conditions, including the public release of certain portions of our internally-developed source code. In addition, the use of third-party open source software typically exposes us to greater risks than the use of third-party commercial software because open-source licensors generally do not provide warranties or set up controls on the functionality or origin of the software. Use of open source software may also present additional security risks because the public availability of such software may make it easier for hackers and other third parties to exploit vulnerabilities in such software and determine how to compromise our platform. Any of the foregoing could be harmful to our business, financial condition or operating results. In the future, we may need to obtain licenses from third parties to use intellectual property rights associated with the development of our platform, products, and other internal tools, which might not be available on acceptable terms, or at all. Any loss of the right to use any third-party software required for the development and maintenance of our platform, products, or other internal tools could result in loss of functionality or availability of our platform, products, or other internal tools until equivalent technology is either developed by us, or, if available, is identified, obtained, and integrated. Any errors or defects in third-party software could result in errors or a failure of our platform, products, or other internal tools. Any of the foregoing would disrupt the deployment of our platform, products, or other internal tools and harm our business, results of operations and financial condition.

The actual or perceived improper sending of text messages, pre-recorded messages, or voice calls may subject us to potential risks, including liabilities or claims relating to consumer protection laws and regulatory enforcement, including fines. For example, the TCPA and the Telemarketing Sales Rule restrict telemarketing and the use of automatic SMS text messages. The TCPA requires companies to obtain prior express written consent before making telemarketing calls or sending certain text messages and to not contact any number placed on either federal or state "do-not-call" registries or the company's internal do-not-call list. The FCC may take enforcement action against persons or entities that send "junk faxes," or make illegal robocalls, and individuals also may have a private cause of action. Although the FCC's rules prohibiting unsolicited fax advertisements or making illegal robocalls apply to those who "send" the advertisements or make the calls, fax transmitters or other service providers that have a high degree of involvement in, or actual notice of, unlawful sending of junk faxes or making of illegal robocalls and have failed to take steps to prevent such transmissions may also face liability under the FCC's rules, or in the case of illegal robocalls, Federal Trade Commission ("FTC") rules. We take significant steps designed to prevent our systems from being used to make illegal robocalls or send unsolicited faxes on a large scale, and we do not believe that we have a high degree of involvement in, or notice of, the use of our systems to broadcast junk faxes or make illegal robocalls. However, because fax transmitters and related service providers do not enjoy an absolute exemption from liability under the TCPA and related FCC rules, we could face FCC or FTC inquiry and enforcement or civil litigation, or private causes of action, if someone uses our system for such purposes. Because the TCPA provides for a private right of action under which a plaintiff may recover monetary damages, this may result in civil claims against Weave and requests for information through third party subpoenas. The scope and interpretation of the laws that are or may be applicable to the delivery of text messages or voice calls are continuously evolving and developing. If we do not comply with these laws or regulations or if we become liable under these laws or regulations due to the failure of our customers to comply with these laws by obtaining proper consent, we could face direct liability. Moreover, despite our ongoing and substantial efforts to limit such use, certain customers may use our platform to transmit unauthorized, offensive or illegal messages, spam, phishing scams, and website links to harmful applications, reproduce and distribute copyrighted material or the trademarks of others without permission, and report inaccurate or fraudulent data or information. These actions are in violation of our policies, in particular, our acceptable use policies. However, our efforts to defeat spamming attacks and other fraudulent activity will not prevent all such attacks and activity. Such use of our platform could damage our reputation and we could face claims for damages, regulatory enforcement, copyright or trademark infringement, defamation, negligence, or fraud. Moreover, our customers' and other users' promotion of their products and services through our platform might not comply with federal, state, and foreign laws. These risks may increase as we enter new healthcare vertical markets that rely more heavily on email marketing campaigns to obtain new customers. We rely on contractual representations made to us by our customers that their use of our platform will comply with our policies and applicable law, including, without limitation, our email and messaging policies. Although we retain the right to verify that customers and other users are abiding by certain contractual terms, our acceptable use policy and our email and messaging policies and, in certain circumstances, we review their email and distribution lists, our customers and other users are ultimately responsible for compliance with our policies, and we do not systematically audit our customers or other users to confirm compliance with our policies. We cannot predict whether our role in facilitating our customers' or other users' activities would expose us to liability under applicable law, or whether that possibility could become more likely if there are changes to current laws regulating content moderation, such as Section 230 of the Communications Decency Act. There have been various Congressional and executive efforts to eliminate or modify Section 230 over the past few years. Even if claims asserted against us do not result in liability, we may incur substantial costs in investigating and defending such claims. If we are found liable for our customers' or other users' activities, we could be required to pay fines or penalties, redesign business methods or otherwise expend resources to remedy any damages caused by such actions and to avoid future liability. Similar rules in Canada, such as CASL and Unsolicited Telecommunications Rules, may subject our company to similar risks, even if merely resulting in reputational or monetary harm associated with investigating and defending such claims, including if such claims do not result in liability.

As a provider of interconnected voice over internet protocol ("VoIP") services, we are subject to various international, federal, state and local requirements applicable to our industry. For example, our business is regulated by the FCC. The FCC is considering whether interconnected VoIP services should be treated as telecommunications services, which could subject interconnected VoIP services to additional common carrier regulation. The FCC's efforts may result in additional regulation of IP network and service providers, which may negatively affect our business. If we do not comply with applicable FCC rules and regulations, or rules and regulations of other governing regulatory agencies, we could be subject to enforcement actions, fines, loss of licenses, and possibly restrictions on our ability to operate or offer certain of our subscriptions. Any enforcement action by the FCC, which may be a public process, would hurt our reputation in the industry and could have a material adverse impact on our revenue. The failure of our platform and products to comply, or delays in compliance, with various existing and evolving standards could delay or interrupt our introduction of new products, subject us to fines or other imposed penalties, or harm our reputation, any of which would have a material adverse effect on our business, financial condition or operating results. Regulations to which we may be subject address the following matters, among others: - license requirements that apply to providers of communications services in many jurisdictions;- acceptable marketing practices;- our obligation to contribute to various Universal Service Fund ("USF") programs, programs for funding access to relay services and number administration, including at the state level;- monitoring on rural call completion rates;- safeguarding and use of Customer Proprietary Network Information;- U.S. and Canadian regulations concerning access requirements for users with disabilities;- our obligation to offer 7-1-1 abbreviated dialing for access to relay services;- compliance with the requirements of U.S. and foreign law enforcement agencies, including the Communications Assistance for Law Enforcement Act and cooperation with local authorities in conducting wiretaps, pen traps and other surveillance activities;- the ability to dial 9-1-1 (or corresponding numbers in regions outside the U.S.), auto-locate E-911 calls (or corresponding equivalents) when required, and access emergency services;- the transmission of telephone numbers associated with calling parties between carriers and service providers like Weave;- regulations governing outbound dialing, including the Telephone Consumer Protection Act; and - FCC and other regulators efforts to combat robo-calling, caller ID spoofing, and robo-texting. A number of states require us to register as a VoIP provider, contribute to state universal service and related programs, pay E-911 surcharges, and pay other surcharges and fees that fund various utility commission programs, while others are actively considering extending their public policy programs to include the subscriptions we provide. We pass USF, E-911 fees, and other surcharges through to our customers, which may result in our subscriptions becoming more expensive or require that we absorb these costs. In the future, state public utility commissions may expand their jurisdiction over VoIP subscriptions like ours. Regulation of our services as telecommunications services may require us to obtain authorizations or licenses to operate in additional states or foreign jurisdictions and comply with legal requirements applicable to traditional telephony providers. This regulation may impact our ability to differentiate ourselves from incumbent service providers and impose substantial compliance costs on us, negatively affecting our margins.

Our text, voice and email messaging and management services, and our customers' use of these services, expose us to various regulatory risks. For example, the CAN-SPAM Act establishes certain requirements for commercial email messages and transactional email messages and specifies penalties for the transmission of email messages that are intended to deceive the recipient as to source or content. Among other things, the CAN-SPAM Act, obligates the sender of commercial emails to provide recipients with the ability to "opt-out" of receiving future commercial emails from the sender. In addition, some states have passed laws regulating commercial email practices that are significantly more restrictive and difficult to comply with than the CAN-SPAM Act. For example, Utah and Michigan prohibit the sending of email messages that advertise products or services that minors are prohibited by law from purchasing (e.g., alcoholic beverages, tobacco products, illegal drugs) or that contain content harmful to minors (e.g., pornography) to email addresses listed on specified child protection registries. Some portions of these state laws may not be preempted by the CAN-SPAM Act. In addition, certain non-U.S. jurisdictions have enacted laws regulating the sending of email that are more restrictive than U.S. laws, such as the Canadian Anti-Spam Law. If we were found to be in violation of the CAN-SPAM Act, applicable state laws governing email not preempted by the CAN-SPAM Act or foreign laws regulating the distribution of email, whether as a result of violations by our customers or our own acts or omissions, we could be required to pay large penalties, which would adversely affect our financial condition, significantly harm our business, injure our reputation and erode customer trust. The terms of any injunctions, judgments, consent decrees or settlement agreements entered into in connection with enforcement actions or investigations against our company in connection with any of the foregoing laws may also require us to change one or more aspects of the way we operate our business, which could impair our ability to attract and retain customers or could increase our operating costs.

Changes in laws or regulations relating to the use of the internet could require us to modify our products and platform in order to comply with these changes. In addition, government agencies or private organizations have imposed and may impose additional taxes, fees or other charges for accessing the internet or commerce conducted via the internet. These laws or charges could limit the growth of internet related commerce or communications generally or result in reductions in the demand for internet based products and services such as our products and platform. In particular, a re-adoption of "network neutrality" rules in the United States could affect the services used by us and our customers. In October 2023, the FCC voted to advance a proposal of reinstating "net neutrality" and to allow the FCC to regulate broadband internet access as a utility. A number of other states have likewise adopted or are adopting or considering legislation or executive actions that would regulate the conduct of broadband providers. If we are not able to adapt our platform and products to address any new laws or regulations, our business, results of operations and financial condition could be adversely affected.

In the event a dispute between a cardholder and a customer is not resolved in favor of the customer, the transaction is normally charged back to the customer and the purchase price is credited or otherwise refunded to the cardholder. If we are unable to collect such amounts from the customer's account or reserve account, if applicable, or if the customer refuses or is unable, due to closure, bankruptcy or other reasons, to reimburse us for a chargeback, we are responsible for the amount of the refund paid to the cardholder. The risk of chargebacks is typically greater with those customers that promise future delivery of goods and services rather than delivering goods or rendering services at the time of payment, as well as "card not present" transactions in which consumers do not physically present cards to customers in connection with the purchase of goods and services, such as e-commerce, telephonic and mobile transactions. While we have not experienced these issues to a significant degree in the past and do not view them to be material, we may experience significant losses from chargebacks in the future. A substantial increase in chargebacks not paid by our customers could have a material adverse effect on our business, financial condition or results of operations. We have policies and procedures to monitor and manage customer-related credit risks and often mitigate such risks by requiring collateral, such as cash reserves, and monitoring transaction activity. Notwithstanding our policies and procedures for managing credit risk, it is possible that a default on such obligations by one or more of our customers could adversely affect our business, financial condition or results of operations.

We process business and personal information belonging to our customers and employees and because of this, we are subject to numerous federal, state, local, and foreign laws, orders, codes, regulations, and regulatory guidance regarding privacy, data protection, information security, and the processing of personal information and other content (collectively, "Data Protection Laws"), the number and scope of which are changing, subject to differing applications and interpretations, and may be inconsistent among countries, or conflict with other rules, laws, or Data Protection Obligations (defined below). These laws and regulations include HIPAA, which establishes a set of national privacy and security standards for the protection of protected health information ("PHI") by health plans, healthcare clearinghouses and certain healthcare providers, referred to as covered entities, and individuals and entities that perform services for them which involve the use, or disclosure of, individually identifiable health information, known as business associates and their subcontractors. We are considered a business associate under HIPAA, and we execute business associate agreements ("BAAs") with our customers, subcontractors, and trusted suppliers. HIPAA requires covered entities and business associates, such as Weave, and their covered subcontractors to develop and maintain policies and procedures with respect to PHI that is used or disclosed, including the adoption of administrative, physical and technical safeguards to protect such information. Failure to comply with HIPAA could subject us to direct civil liability by the Department of Health and Human Services' Office for Civil Rights ("OCR"). In the event of an information security incident affecting PHI or other violation, OCR could require us to pay a civil monetary penalty and enter into a Corrective Action Plan that could cause to incur substantial compliance costs. Similar Data Protection Laws are in place in Canada, including the Personal Information Protection and Electronic Documents Act ("PIPEDA"). Failure to comply could subject us to investigation and monetary penalty by the Office of the Privacy Commissioner of Canada. In addition, experiencing a breach of personal information or PHI, or failing to comply with HIPAA could also subject us to contractual liability under our BAAs with our covered entity customers and damage our reputation which might hurt our ability to retain existing customers or attract new customers. We expect that there will continue to be new Data Protection Laws and Data Protection Obligations, and we cannot yet determine the impact such future Data Protection Laws may have on our business. We are also subject to the terms of our internal and external privacy and security policies, codes, representations, certifications, industry standards, publications, and frameworks, which we refer to as Privacy Policies, and obligations to third parties related to privacy, data protection, and information security ("Data Protection Obligations"). The requirements or obligations of the regulatory framework for privacy, information security, data protection, and data processing worldwide is, and is likely to remain, uncertain for the foreseeable future, and it is possible that these or other actual or alleged obligations may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other rules or our practices. Any significant change in Data Protection Laws or Data Protection Obligations, including without limitation, regarding processing of our users' or customers' data, or regarding the manner in which the express or implied consent of users or customers for the use and disclosure of such data is obtained, could increase our costs and could require us to modify our products or operations, possibly in a material manner, and may limit our ability to develop new services and features that make use of the data that our users and customers voluntarily share, or may limit our ability to store and Process customer data and operate our business. Data protection legislation is also becoming increasingly common in the United States at both the federal and state level. For example, California enacted legislation, the California Consumer Privacy Act of 2018 (the "CCPA"), which affords consumers expanded privacy protections. The potential effects of this legislation are far-reaching and have required Weave to implement enhanced practices and policies in an effort to comply. Specifically, the CCPA gives California residents expanded rights to request access to and deletion of their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used. The CCPA also provides for civil penalties for violations, as well as a private right of action for data breaches that may increase data breach litigation. In addition, the CCPA has prompted a number of proposals for new federal and state privacy legislation that, if passed, could increase our potential liability, increase our compliance costs, and adversely affect our business. It remains unclear how much private litigation will ensue under the data breach private right of action. Additionally, the California Privacy Rights Act of 2020 ("CPRA"), which became fully effective on January 1, 2023, expanded the rights of California residents with respect to their personal information. The CPRA, among other things, gives California residents the ability to limit use of certain sensitive personal information, further restrict the use of cross-contextual advertising, establish restrictions on the retention of personal information, expand the types of data breaches subject to the CCPA's private right of action, provide for increased penalties for CPRA violations concerning California residents under the age of 16, and establish a new California Privacy Protection Agency to implement and enforce the new law which may result in increased regulatory scrutiny of California businesses in the areas of data protection and security. Similar laws have been proposed or enacted in other states and at the federal level. For example, Virginia enacted the Consumer Data Protection Act, Colorado enacted the Colorado Privacy Act, and Utah enacted the Utah Consumer Privacy Act. Compliance with any newly enacted privacy and data security laws or regulations may be challenging and cost and time-intensive, and we may be required to put in place additional mechanisms to comply with applicable legal requirements. In addition, the various state privacy laws may limit how we use personal information we collect, particularly with respect to marketing and the use of online advertising networks. Furthermore, the FTC and many state attorneys general continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive. There are a number of legislative proposals in the United States, at both the federal and state level and more globally, that could impose new obligations in areas such as e-commerce and other related legislation or liability for copyright infringement by third parties. We cannot yet determine the impact that future laws, regulations, and standards may have on our business. Change in existing legislation or introduction of new legislation may require us to incur additional expenditures to ensure compliance with such legislation, which may adversely affect our financial condition. We strive to comply with Data Protection Laws and Data Protection Obligations to the extent possible, but we may at times fail, or may be perceived to have failed, to do so. Moreover, despite our efforts, we may not be successful in achieving compliance if our employees, partners, or vendors do not comply with applicable Data Protection Laws and Data Protection Obligations. A finding that our Privacy Policies are, in whole or part, inaccurate, incomplete, deceptive, unfair, or misrepresentative of our actual practices, a failure or perceived failure by us to comply with Data Protection Laws or Data Protection Obligations or any data compromise that results in the unauthorized release or transfer of business or personal information or other user or customer data, may increase our compliance and operational costs, limit our ability to market our products or services and attract new and retain current customers, limit or eliminate our ability to process data, and result in domestic or foreign governmental enforcement actions and fines, litigation, significant costs, expenses, and fees (including attorney fees), cause a material adverse impact to business operations or financial results, and otherwise result in other material harm to our business. In addition, any such failure or perceived failure could result in public statements against us by consumer advocacy groups, the media or others, which may cause us material reputational harm. Our actual or perceived failure to comply with Data Protection Laws, Privacy Policies, and Data Protection Obligations could also subject us to litigation, claims, proceedings, actions, or investigations by governmental entities, authorities, or regulators that could require changes to our business practices,diversion of resources and the attention of management from our business, regulatory oversights and audits, discontinuance of necessary processing, or other remedies that adversely affect our business.

We collect sales, value added or similar indirect taxes in a number of jurisdictions. An increasing number of states have considered or adopted laws that attempt to impose sales tax collection obligations on out-of-state companies. Additionally, the Supreme Court of the United States ruled in South Dakota v. Wayfair, Inc. et al. ("Wayfair"), that online sellers can be required to collect sales and use tax despite not having a physical presence in the buyer's state. In response to Wayfair, or otherwise, states or local governments may adopt, or begin to enforce, laws requiring us to calculate, collect and remit taxes on sales in their jurisdictions. Similarly, many foreign jurisdictions have considered or adopted laws that impose value added, digital service, or similar taxes, on companies despite not having a physical presence in the foreign jurisdiction. A successful assertion by one or more states, or foreign jurisdictions, requiring us to collect taxes where we presently do not do so, or to collect more taxes in a jurisdiction in which we currently do collect some taxes, could result in substantial tax liabilities, including taxes on past sales, as well as penalties and interest. The requirement to collect sales, value added or similar indirect taxes by foreign, state or local governments for sellers that do not have a physical presence in the jurisdiction could also create additional administrative burdens for us, put us at a competitive disadvantage if they do not impose similar obligations on our competitors, decrease our future sales and subject us to liabilities for future or historical periods, which could have a material adverse effect on our business and results of operations. We continually monitor the ever-evolving tax landscape in the jurisdictions in which we operate and those jurisdictions where our customers reside. Effective in March 2017, we began collecting certain telecommunications-based taxes from our customers in certain jurisdictions. Since then, we have added more jurisdictions where we collect these taxes and we expect to continue expanding the number of jurisdictions in which we will collect these taxes in the future. In the event any of these jurisdictions disagree with our assumptions and analysis, the assessment of our tax exposure could differ materially from our current estimates. Some customers may question incremental tax charges that we may impose and some may seek to negotiate lower pricing from us, which could adversely affect our business, results of operations and financial condition.

In June 2019, the FCC ruled that providers of voice services may by default (subject to opt-out by subscribers) block voice traffic based on reasonable analytics designed to identify unwanted calls. Effective in June 30, 2022, the FCC required that all voice service providers implement the Secure Telephone Identity Revisited ("STIR") and Signature-based Handling of Asserted Information Using toKENs ("SHAKEN" and, together with STIR, "STIR/SHAKEN") caller ID authentication framework in the internet protocol ("IP"), portions of their networks and that non-facilities-based voice providers comply fully with STIR/SHAKEN. The STIR/SHAKEN framework is expected to be used throughout the world. Weave has implemented STIR/SHAKEN for voice traffic originating in the U.S. and we rely on our service providers to sign our voice traffic originating in Canada. However, it is likely that the standards to obtain STIR/SHAKEN signing authority in other countries will differ from the U.S. requirements and these differing standards may not be interoperable with the U.S. requirements. For example, the Canadian Radio-television and Telecommunications Commission ("CRTC") required all telecommunications service providers implement STIR/SHAKEN to authenticate and verify caller identification information for IP-based voice calls, effective in November 2021, and file status reports every six months starting in May 2022. Despite initially denying non-facilities based providers access, the Canadian Secure Token Governance Authority ("CST-GA") created a process in November 2021 for such providers to obtain Service Provider Code Tokens and, in turn, Secure Telephone Identity Certificates ("STI Certificates") to allow higher (Level A or B) call attestation. Calls that are not attested at a higher level, either directly or by an underlying provider, are at a greater risk of being blocked or flagged and ignored by end users. Further, it is unclear how cross-border calls originating from U.S. service providers will be authenticated under Canada's framework or vice versa. In July 2022, the CST-GA signed a memorandum of understanding with the U.S. Secure Telephone Identity Governance Authority to coordinate interconnection of SHAKEN in both the U.S. and Canada to allow providers to sign calls in one country and accept the signature in the other. However, the SHAKEN interconnection between the U.S. and Canada is not yet operational. Until operational, we may be required to obtain STI Certificates or otherwise incur costs to sign our calls in both the U.S. and Canada, which could impose substantial compliance costs and negatively affect our margins or could make our services less competitive than incumbent providers. In addition, foreign regulators have allowed terminating voice service providers to block voice traffic to address robo-calling or other unwanted calls. If our solutions are not interoperable with foreign regulators' requirements, if the SHAKEN interconnection between the U.S. and Canada does not become operational, or if we or our service providers are unable to authenticate originating calls from our customers' telephone numbers under STIR/SHAKEN then our business could be harmed. Call recipients would be less likely to answer non-authenticated calls. In addition, the terminating voice service providers may block calls that are not authenticated under STIR/SHAKEN as the lack of authentication could be viewed as a reasonable indication that the call is unwanted by the recipient. This would make our service less desirable for our customers.

Our revenue is derived from SMBs, and the majority of our revenue is derived from small businesses. While we believe our core healthcare verticals in dental, optometry, veterinary services, and other medical specialty services have been more resilient than other types of small business, SMBs often have higher rates of business failures and limited budgets. Further, SMBs are fragmented in terms of size, geography, sophistication and nature of business and, consequently, are more challenging to serve at scale and in a cost-effective manner. Many of these SMBs are in the early stages of their development and there is no guarantee that their businesses will succeed. In addition, SMBs may be affected by economic uncertainty or downturns to a greater extent than enterprises and typically have more limited financial resources, including capital borrowing capacity, than enterprises. For example, inflation and interest rate trends have adversely impacted economies and financial markets globally, which particularly impacted many SMBs. SMBs are also typically restricted by factors other than price in their technology-related decisions. These factors may make us more susceptible to economic downturns and may limit our ability to grow our business and become profitable. If we are not able to effectively address the risks associated with serving SMBs, our revenue, results of operations and financial condition could be adversely impacted.

A majority of our current customer base consists of small businesses. In addition to pursuing continued customer growth among small businesses, we intend to pursue opportunities to expand our customer base among medium-sized businesses in various healthcare industries. As we target a portion of our sales efforts at larger and multi-location businesses, we may incur higher costs and longer sales and installation cycles, and we may be less effective at predicting when we will complete these sales. In these market segments, the decision to purchase our subscriptions may require the approval of more technical personnel and management levels within a potential customer's organization and, therefore, sales to larger and multi-location businesses may require us to invest more time educating potential customers about the benefits of our subscriptions. In addition, our customers may be acquired by or may consolidate into larger and multi-location businesses that may demand more features, integration services and customization, and may require more highly skilled sales and support personnel. These new businesses may also demand service-level agreements or other contractual terms that may introduce additional risk. Further, our investment in marketing our subscriptions to these potential customers may not be successful, which could adversely affect our results of operations and our overall ability to grow our customer base.

Our ability to attract new customers, retain existing customers and increase the use of our platform by existing customers is critical to our success. Our future revenue will depend in large part on our success in attracting additional customers to our platform. Our ability to attract additional customers will depend on a number of factors, including the effectiveness of our sales team, the success of our marketing efforts, our levels of investment in expanding our sales and marketing teams, referrals by existing customers, our brand recognition within the markets we address, our efforts to provide satisfactory customer service, the stability and reliability of our platform, our ability to timely onboard new customers or timely expand functionality for our existing customers, the perceived value of our platform and the features and functionality it offers, our ability to leverage and scale our core sales efforts and marketing capabilities to focus on our core specialty healthcare verticals, and the nature and availability of competitive offerings. We may not experience the same levels of success in the future with respect to our customer acquisition strategies as we have experienced in the past, and if the costs associated with acquiring new customers were to materially increase in the future, our expenses may rise significantly. A majority of our customers pay their subscription on a monthly basis, while a significant number of our customers pay their subscriptions on an annual basis. Our customers have no contractual obligation to renew their subscriptions after their subscription term expires. As a result, even though the number of customers using our platform has grown rapidly in recent periods, there can be no assurance that we will be able to retain these customers. Renewals of subscriptions may decline or fluctuate as a result of a number of factors, including dissatisfaction with our platform or support, the perception that a competitive platform, product or service presents a better or less expensive option or our failure to successfully deploy sales and marketing efforts towards existing customers as they approach the expiration of their subscription term. In addition, we may terminate our relationships with customers for various reasons, such as heightened credit risk, excessive card chargebacks, unacceptable business practices or contract breaches. We have historically experienced customer turnover as a result, in part, of our customers being SMBs, which are categorically more susceptible than larger businesses to general economic conditions, higher levels of churn, consolidation with other businesses and other risks affecting their businesses. In addition to attracting new customers and retaining existing customers, we seek to expand usage of our platform by broadening adoption by our customers of the various products available on our platform. We have experienced difficulties with, and cannot be certain that we will be successful in, increasing adoption of additional products by our existing customers. Our ability to increase adoption of our products by our customers will depend on a number of factors, including our customers' satisfaction with our platform, competition, pricing and our ability to demonstrate the value proposition of our products. Our costs associated with renewals and generating sales of additional products to existing customers are substantially lower than our costs associated with entering into subscriptions with new customers. Accordingly, our business model relies to a significant extent on our ability to renew subscriptions and sell additional products to existing customers, and, if we are unable to retain revenue from existing customers or to increase revenue from existing customers, our operating results could be adversely impacted even if such lost revenue were offset by an increase in revenue from new customers. Our ability to attract new customers and retain existing customers depends in part on our ability to timely onboard new customers or timely expand functionality for our existing customers. Our platform often requires integration and customization that can result in longer onboarding and ramping process times. New customers onboarding onto our platform or existing customers increasing functionality within our platform may require specific customizations that can delay lead times and may require onboarding efforts that take up to several months. Our onboarding and ramp times may be further delayed due to unanticipated complications with phone number porting or integrations with existing or new customers' systems, which could delay or prevent adoption of our platform for extended periods of time and may cause us to expend more resources than originally anticipated. These delays could limit our ability to attract and retain customers and may adversely affect our revenue and profits.

In order to grow our business, we must continue to attract new customers in a cost-effective manner. We use a variety of marketing channels to promote our products and platform, such as industry and customer events, trade shows, public relations initiatives and brand marketing, as well as search engine marketing and optimization. If the costs of the lead generation and marketing channels we use increase dramatically, then we may choose to use alternative and less expensive channels, which may not be as effective as the channels we currently use. As we add to or change the mix of our lead generation and marketing strategies, we may need to expand into more expensive channels than those we are currently in, which could adversely affect our business, results of operations and financial condition. Since the beginning of the COVID-19 pandemic, our in-person lead generation and marketing efforts have been significantly limited due to event cancellations and the related evolution in where our potential customers assemble, and we have had to further develop our inbound and outbound channels to make up for the absence of sales leads generated from trade shows and other industry events as noted above. To the extent that trade shows and other in-person lead generation activities continue to resume, there can be no assurance that those activities will attract new customers in a cost-effective manner or at levels that existed prior to the COVID-19 pandemic. We will incur marketing expenses before we are able to recognize any revenue that the lead generation and marketing initiatives may generate, and these expenses may not result in increased revenue or brand awareness. We have made in the past, and may make in the future, significant expenditures and investments in new marketing campaigns, and we cannot guarantee that any such investments will lead to the cost-effective acquisition of additional customers. If we are unable to maintain effective marketing programs, then our ability to attract new customers could be adversely affected, our advertising and marketing expenses could increase substantially, and our results of operations may suffer.

In order to provide Weave Payments, we have entered into payment service provider agreements with Stripe Inc. ("Stripe"). These payment service provider agreements provide for terms which expire at various dates after 2028, and in some cases, renew for subsequent 12-month terms unless we provide a notice of termination prior to the end of the then current term. These agreements are integral to Weave Payments, and any problems with Stripe or disruption affecting its services could have an adverse effect on our reputation, results of operations and financial results. If Stripe were to terminate its relationship with us, we could incur substantial delays and expense in finding and integrating an alternative payment service provider into Weave Payments, and the quality and reliability of such alternative payment service provider may not be comparable. Any temporary or permanent disruption in our ability to offer Weave Payments, whether as a result of an interruption in Stripe's services due to technical or other issues, or due to the termination of our agreement with Stripe, would decrease our revenue and adversely affect our business. We have in the past experienced limited interruptions with respect to payments processed through Stripe, which in some cases resulted in the temporary inability of some of our customers to collect payments through our platform. In the event that Stripe fails to maintain adequate levels of support, experiences interrupted operations, experiences a breach of their networks or systems, does not provide high quality service, or increases the fees they charge us, we may suffer additional costs and be required to pursue new third-party relationships, which could materially disrupt our operations. In addition, interruptions affecting payment processing by Stripe could result in periods of time during which Weave Payments cannot function properly, and therefore cannot collect payments for our customers, which could adversely affect our relationships with our customers and our business, reputation, brand, financial condition, and results of operations.

We currently interconnect with network service providers to enable the use by our customers of our products over their networks and we rely on network service providers for these services. Where we do not have direct access to phone numbers, our reliance on network service providers has reduced our operating flexibility, ability to make timely service changes and control quality of service. In addition, the fees that we are charged by network service providers may change daily or weekly, while we do not typically change our customers' pricing as rapidly. At times, network service providers have instituted additional fees due to regulatory, competitive or other industry related changes that increase our network costs. Additionally, our ability to respond to any new fees may be constrained if all network service providers in a particular market impose equivalent fee structures, if the magnitude of the fees is disproportionately large when compared to the underlying prices paid by our customers, or if the market conditions limit our ability to increase the price we charge our customers. Furthermore, many of these network service providers do not have long-term committed contracts with us and may interrupt services or terminate their agreements with us without notice. If a significant portion of our network service providers stop providing us with access to their infrastructure, fail to provide these services to us on a cost-effective basis, cease operations, or otherwise terminate these services, the delay caused by qualifying and switching to other network service providers could be time-consuming and costly and could adversely affect our business, results of operations and financial condition. Further, if problems occur with our network service providers, it may cause errors or poor quality communications with our products, and we could encounter difficulty identifying the source of the problem. The occurrence of errors or poor quality communications on our products, whether caused by our platform or a network service provider, may result in the loss of our existing customers or the delay of adoption of our products by potential customers and may adversely affect our business, results of operations and financial condition. Further, we sometimes access network services through intermediaries who have direct access to network service providers. We expect that we will continue to rely on intermediaries for these services, but this may change in the future. These intermediaries sometimes have offerings that directly compete with our products and may stop providing services to us on a cost-effective basis. If a significant portion of these intermediaries stop providing services or stop providing services on a cost-effective basis, our business could be adversely affected. We also interconnect with internet service providers to enable the use of our communications products by our customers, and we expect that we will continue to rely on internet service providers for network connectivity going forward. Our reliance on internet service providers reduces our control over quality of service and exposes us to potential service outages and rate fluctuations. If a significant portion of our internet service providers stop providing us with access to their network infrastructure, fail to provide access on a cost-effective basis, cease operations, or otherwise terminate access, the delay caused by qualifying and switching to other internet service providers could be time-consuming and costly and could adversely affect our business, results of operations, and financial condition. If problems were to occur with any of these third-party network or internet service providers, they may cause errors or poor call quality that could impact our customers, and we could encounter difficulty identifying the source of the problem. From time to time, these third-party network or service providers have been adversely impacted or overloaded by large increases in traffic for a variety of reasons. The occurrence of interruptions, errors or poor call quality, whether caused by our systems or a third-party network or service provider, may result in the loss of our existing customers and delay or loss of market acceptance of our platform and products, and harm our business and results of operations.