Zepp Health (ZEPP) Risk Factors

Your ADSs are transferable on the books of the depositary. However, the depositary may close its books at any time or from time to time when it deems it expedient in connection with the performance of its duties. The depositary may close its books from time to time for a number of reasons, including in connection with corporate events such as a right offering, during which time the depositary needs to maintain an exact number of ADS holders on its books for a specified period. The depositary may also close its books in emergencies, and on weekends and public holidays. The depositary may refuse to deliver, transfer or register transfers of our ADSs generally when our share register or the books of the depositary are closed, or at any time if we or the depositary thinks it is advisable to do so because of any requirement of law or of any government or governmental body, or under any provision of the deposit agreement, or for any other reason.

Under the PRC Enterprise Income Tax Law and its implementation rules, an enterprise established outside of the PRC with "de facto management body" within the PRC is considered a "resident enterprise" and will be subject to the enterprise income tax on its global income at the rate of 25%. The implementation rules define the term "de facto management body" as the body that exercises full and substantial control and overall management over the business, productions, personnel, accounts and properties of an enterprise. In 2009, the State Administration of Taxation issued a circular, known as SAT Circular 82, which provides certain specific criteria for determining whether the "de facto management body" of a PRC-controlled enterprise that is incorporated offshore is located in China. Although this circular only applies to offshore enterprises controlled by PRC enterprises or PRC enterprise groups, not those controlled by PRC individuals or foreigners, the criteria set forth in the circular may reflect the general position of the State Administration of Taxation on how the "de facto management body" text should be applied in determining the tax resident status of all offshore enterprises. According to SAT Circular 82, an offshore incorporated enterprise controlled by a PRC enterprise or a PRC enterprise group will be regarded as a PRC tax resident by virtue of having its "de facto management body" in China and will be subject to PRC enterprise income tax on its global income only if all of the following conditions are met: (i) the primary location of the day-to-day operational management is in the PRC; (ii) decisions relating to the enterprise's financial and human resource matters are made or are subject to approval by organizations or personnel in the PRC; (iii) the enterprise's primary assets, accounting books and records, company seals, and board and shareholder resolutions, are located or maintained in the PRC; and (iv) at least 50% of voting board members or senior executives habitually reside in the PRC. We believe that Zepp Health Corporation is not a PRC resident enterprise for PRC tax purposes. See "Item 4. Information on the Company-B. Business Overview-Regulation-Regulation on Tax-PRC Enterprise Income Tax." However, the tax resident status of an enterprise is subject to determination by the PRC tax authorities and uncertainties remain with respect to the interpretation of the term "de facto management body." If the PRC tax authorities determine that Zepp Health Corporation is a PRC resident enterprise for enterprise income tax purposes, we may be required to withhold a 10% withholding tax from dividends we pay to our shareholders that are non-resident enterprises, including the holders of our ADSs. In addition, non-resident enterprise shareholders (including our ADS holders) may be subject to PRC tax on gains realized on the sale or other disposition of ADSs or ordinary shares, if such income is treated as sourced from within the PRC. Furthermore, if we are deemed a PRC resident enterprise, dividends payable to our non-PRC individual shareholders (including our ADS holders) and any gain realized on the transfer of ADSs or ordinary shares by such shareholders may be subject to PRC tax at a rate of 20% unless a reduced rate is available under an applicable tax treaty. It is unclear whether non-PRC shareholders of our company would be able to claim the benefits of any tax treaties between their country of tax residence and the PRC in the event that we are treated as a PRC resident enterprise. Any such tax may reduce the returns on your investment in the ADSs or ordinary shares.

Due to the volume and sensitivity of the personal information and biometric data we collect and manage and the nature of our products, the security features of our enterprise platform and information systems are critical. We face risks inherent in handling and protecting large volume of data. In particular, we face a number of challenges relating to data from transactions and other activities on our platforms, including: - protecting the data in and hosted on our system, including against attacks on our system by outside parties or fraudulent behavior or improper use by our employees;- addressing concerns related to privacy and sharing, safety, security and other factors; and - complying with applicable laws, rules and regulations relating to the collection, use, storage, transfer, disclosure and security of personal information, including any requests from regulatory and government authorities relating to these data. In general, we expect that data security and data protection compliance will receive greater attention and focus from regulators, both domestically and globally, as well as attract continued or greater public scrutiny and attention going forward, which could increase our compliance costs and subject us to heightened risks and challenges associated with data security and protection. If we are unable to manage these risks, we could become subject to penalties, including fines, suspension of business and revocation of required licenses, and our reputation and results of operations could be materially and adversely affected. The PRC regulatory and enforcement regime with regard to data security and data protection is evolving and may be subject to different interpretations or significant changes. Moreover, different PRC regulatory bodies, including the Standing Committee of the National People's Congress, the Ministry of Industry and Information Technology, the Cyberspace Administration of China, the Ministry of Public Security and the State Administration for Market Regulation have enforced data privacy and protections laws and regulations with varying standards and applications. See "Item 4. Information on the Company-B. Business Overview-Regulation-Regulation on Information Security" and "Item 4. Information on the Company-B. Business Overview-Regulation-Regulation on Internet Privacy." In particular, in November 2021, the Cyberspace Administration of China released the Regulations on the Network Data Security (Draft for Comments). These regulations provide that data processors refer to individuals or organizations that, during their data processing activities such as data collection, storage, utilization, transmission, publication and deletion, have autonomy over the purpose and the manner of data processing. In accordance with these regulations, data processors shall apply for a cybersecurity review for certain activities, including, among other things, (i) the listing abroad of data processors that process the personal information of more than one million users and (ii) any data processing activity that affects or may affect national security. However, there have been no clarifications from the authorities as of the date of this annual report as to the standards for determining whether an activity is one that "affects or may affect national security." In addition, the Regulations on the Network Data Security (Draft for Comments) require that data processors that process "important data" or are listed overseas must conduct an annual data security assessment by itself or commission a data security service provider to do so, and submit the assessment report of the preceding year to the municipal cybersecurity department by the end of January each year. The period for which the Cyberspace Administration of China solicited comments on this draft ended on December 13, 2021, but there is no timetable as to when the Regulations on the Network Data Security (Draft for Comments) will be enacted. In addition, in December 2021, the Cyberspace Administration of China, together with other authorities, jointly promulgated the Revised Cybersecurity Review Measures, which became effective on February 15, 2022 and replaced its predecessor regulation, pursuant to which, critical information infrastructure operators that procure internet products and services must be subject to the cybersecurity review if their activities affect or may affect national security. The Revised Cybersecurity Review Measures further stipulate that network platform operators that hold personal information of over one million users shall apply with the Cybersecurity Review Office for a cybersecurity review before any initial public offering at a foreign stock exchange. As of the date of this annual report, no detailed rules or implementation rules have been issued by any authority and we have not been informed that we are a critical information infrastructure operator by any government authorities. Furthermore, the exact scope of "critical information infrastructure operators" under the current regulatory regime remains unclear, and the PRC government authorities may have wide discretion in the interpretation and enforcement of the applicable laws. Therefore, it is uncertain whether we would be deemed to be a critical information infrastructure operator under PRC law. If we are deemed to be a critical information infrastructure operator under the PRC cybersecurity laws and regulations, we may be subject to obligations in addition to what we have fulfilled under the PRC cybersecurity laws and regulations. Many of the data-related legislations are relatively new and certain concepts thereunder remain subject to interpretation by the regulators. If any data that we possess belongs to data categories that are subject to heightened scrutiny, we may be required to adopt stricter measures for protection and management of such data. The Regulations on the Network Data Security (Draft for Comments) and the Revised Cybersecurity Review Measures remain unclear on whether the requirements will be applicable to companies that are already listed in the United States, such as us, if we were to pursue another listing outside of the PRC. We cannot predict the impact of the Regulations on the Network Data Security (Draft for Comments) and the Revised Cybersecurity Review Measures, if any, at this stage, and we will closely monitor and assess any development in the rule-making process. If the enacted version of the Regulations on the Network Data Security (Draft for Comments) and the Revised Cybersecurity Review Measures mandate clearance of cybersecurity review and other specific actions to be taken by issuers like us, we face uncertainties as to whether we can complete these additional procedures timely, or at all, which may delay or disallow our future listings (should we decide to pursue them). If we are not able to comply with the cybersecurity and data privacy requirements in a timely manner, or at all, we may be subject to government enforcement actions and investigations, fines, penalties, suspension of our non-compliant operations, or removal of our app from the relevant application stores, among other sanctions, which could materially and adversely affect our business and results of operations. As of the date of this annual report, except as disclosed below that we have received some rectification notices from local branches of the Cyberspace Administration of China for some problems they found on the personal information protection and data security, etc., and after which the rectifications have been completed, we have not been involved in any formal investigations on cybersecurity review made by the Cyberspace Administration of China on such basis. We are constantly in the process of evaluating the potential impact of the PRC Cyber Security Law, the Data Security Law and other laws, regulations and policies relating to cybersecurity, privacy, data protection and information security on our current business practices. All these laws and regulations may result in additional expenses and obligations to us and subject us to negative publicity, which could harm our reputation and negatively affect the trading price of the ADSs. We expect that these areas will receive greater public scrutiny and attention from regulators and more frequent and rigid investigation or review by regulators, which may increase our compliance costs and subject us to heightened risks and challenges. We place a strong emphasis on data security. To achieve the objective, our board of directors has established an artificial intelligence and big data ethics committee to assist the board with respect to privacy and data usage matters, including to oversee compliance with the applicable privacy laws and regulations, management's periodic assessment of data privacy ethics as well as any related policies with respect to risk assessment and risk management, among other things. We have adopted a series of internal policies on data collection, processing and usage. We conduct regular self-inspections with regard to data privacy and cybersecurity to ensure compliance with applicable laws and regulations. In addition, every year, we hire a qualified third-party professional evaluation firm to carry out testing and certification of our information system. Our information system has been certified by such professional evaluation firm as Safety Level III Computer Information System, an information security hierarchical protection system standard established by the Ministry of Public Security, and has passed the ISO27001 information security management system certification and the ISO27701 privacy information management system certification. We believe that we are currently in compliance with applicable laws, regulations and policies overseen by the Cyberspace Administration of China relating to cybersecurity, privacy, data protection and information security. In general, compliance with the existing PRC laws and regulations, as well as additional laws and regulations that PRC regulatory bodies may enact in the future, related to data security and personal information protection, may be costly and result in additional expenses to us, and subject us to negative publicity, which could harm our reputation and business operations. There are also uncertainties with respect to how such laws and regulations will be implemented and interpreted in practice. Moreover, in recent years, regulatory authorities in China have increased their supervision on the collection and use of personal information, as well as cybersecurity and data compliance, over mobile applications. In November 2021, we received an oral notice from the Beijing branch of the Cyberspace Administration of China requiring us to make rectification on our app to change our keyword censorship mechanism. We have made the rectification as requested. In December 2021, we received a formal notice from the Beijing branch of the Cyberspace Administration of China, stating that certain internet-based information services that we provided violated the relevant provisions under the PRC Cybersecurity Law and we were imposed with a fine of RMB0.5 million. We have paid up such fine and have adjusted our business practices to comply with the PRC Cybersecurity Law and other applicable regulations. On September 6, 2022, we received a notice from the Beijing Communication Administration, requiring us to conduct self-review on the problems they found on our app in respect of infringement of users' rights, threats to data security and potential hidden hazards. We submitted a rectification report on September 14, 2022 and have not received any further requirements from them on this since then. On July 18, 2023, we received a notice from the Beijing Haidian branch of the Cyberspace Administration of China, requiring us to rectify the issues they identified on our app related to the unauthorized collection of user information. In response, we swiftly prepared and submitted a rectification report by July 19, 2023, in accordance with their directives. The necessary corrections have since been implemented successfully, resulting in no penalties or additional demands from the authorities. We cannot assure you that similar incident will not occur in the future. Any of these incidents may adversely affect our brand and reputation, consume our managerial resources, result in potential liability of us or administrative measures being enforced on us, or otherwise harm our business. In addition, regulatory authorities around the world have adopted or are considering a number of legislative and regulatory proposals concerning data protection. These legislative and regulatory proposals, if adopted, and the uncertain interpretations and application thereof could, in addition to the possibility of fines, result in an order requiring that we change our data practices and policies, which could have an adverse effect on our business and results of operations. The European Union General Data Protection Regulation, which came into effect on May 25, 2018, includes operational requirements for companies that receive or process personal data of residents of the European Economic Area. The General Data Protection Regulation establishes new requirements applicable to the processing of personal data, affords new data protection rights to individuals and imposes penalties for serious data breaches. Individuals also have a right to compensation under the General Data Protection Regulation for financial or non-financial losses. Given our products are sold in Europe, and the resident of the European Economic Area can access our website and our mobile platform and input protected information, we are subject to provisions of the General Data Protection Regulation. In the United States, the Health Insurance Portability and Accountability Act governs the privacy and security of health information and require that covered entities, including most health care providers, implement administrative, physical, and technical safeguards to protect the security of individually identifiable health information that is maintained or transmitted electronically. Violations of the Health Insurance Portability and Accountability Act privacy and security regulations could result in significant civil and criminal penalties. For more details, see "Item 4. Information on the Company-B. Business Overview-Regulation-Regulation on Internet Privacy." The California Consumer Privacy Act, which took effect in January 2020, also establishes certain transparency rules and creates new data privacy rights for users, including more ability to control how their data is shared with third parties. These laws and regulations are evolving and subject to interpretation. Similarly, there are a number of legislative proposals in the European Union, the United States, at both the federal and state level, as well as other jurisdictions that could impose new obligations or limitations in areas affecting our business. In addition, some countries are considering or have passed legislation implementing data protection requirements or requiring local storage and processing of data or similar requirements that could increase the cost and complexity of delivering our services. Moreover, a growing number of legislative and regulatory bodies have adopted consumer notification requirements in the event of unauthorized access to or acquisition of certain types of personal data. Such breach notification laws continue to evolve and may be inconsistent from one jurisdiction to another, which might become a particular concern as we accelerate our international expansion. Complying with these obligations could cause us to incur substantial costs and could increase negative publicity surrounding any incident that compromises user data. Any failure to comply with applicable regulations could also result in regulatory enforcement actions against us. We generally comply with industry standards and are subject to the terms of our own privacy policies. Compliance with any additional laws could be expensive, and may place restrictions on the conduct of our business and the manner in which we interact with our customers. For each product we develop, we gather personnel from product team, research and development team, security team and legal team to thoroughly assess the privacy risks related to the product. We review the character, potential and defined sales areas, types of personal data to be collected, related purpose for data collection and other aspects of each product to ensure compliance with applicable laws and regulations, including the General Data Protection Regulation and the California Consumer Privacy Act regulations. For upgraded services and additional functions to be added to established products, we go through the same procedures. In 2021, we obtained the ISO/IEC 27001 information security management system certification. However, we cannot guarantee that our efforts will be effective or sufficient. Compliance with existing, proposed and recently enacted laws (including implementation of the privacy and process enhancements called for under the General Data Protection Regulation and the Committee on Foreign Investment in the United States) and regulations can be costly. Any failure to comply with applicable regulations could also result in regulatory enforcement actions against us, and the misuse of or failure to secure personal information could also result in violation of data privacy laws and regulations, proceedings against us by governmental entities or others, damage our reputation and credibility and could have a negative impact on revenues and profits.

We may fail to own or apply for key trademarks or patents on important products, services, technologies or designs in a timely fashion, or at all, both in China and overseas. We have registered and applied to register trademarks and service marks, including, but not limited to, "Amazfit," "ZEPP," "huami," "??" and "??" in China and foreign jurisdictions. We may not be able to adequately protect our trademarks and service marks, and our competitors and others may successfully challenge the validity and/or enforceability of our trademarks and service marks and other intellectual property. Additionally, we may be prohibited from entering into certain new markets due to restrictions surrounding competitors' trademarks. For example, our company name in Chinese characters, "??," was previously registered as a trademark by a company unaffiliated to us in certain trademark categories in China. In August 2020, we engaged a trademark agent to file an invalidation petition against this registered trademark in the National Intellectual Property Administration. In July 2021, the National Intellectual Property Administration issued an order which invalidated this registered trademark. The invalidation decision was further confirmed by Beijing Intellectual Property Court and Beijing High People's Court in June 2022 and December 2022, respectively. Furthermore, the "??" trademark in one trademark category is contractually owned by Xiaomi only. If for any reason our cooperation relationship with Xiaomi is deteriorated in the future, we may not be able to use "??" as a trademark in this category, which could negatively impact our operations. It may be possible, in jurisdictions where the status of various applications is pending, unclear, challenged or rejected, for a third-party owner of the national trademark registration for a similar mark to prohibit the manufacture, sale or exportation of our products in or from that country. Failure to register our trademarks or purchase or license the right to use our trademarks or logos in these countries could limit our ability to obtain supplies from, or manufacture in, less costly markets or penetrate new markets should our business plan include selling our products in those countries. Additionally, we may receive from time-to-time letters alleging our infringement of patents, trademarks or other intellectual property rights.

Some of the technologies we use incorporate open source software, such as Zepp OS, and we may incorporate other open source software in the future. Such open source software is generally licensed by its authors or other third parties under open source licenses. These licenses may subject us to certain unfavorable conditions, including requirements that we offer our products and services that incorporate the open source software for no cost, that we make publicly available the source code for any modifications we made or derivative works we created based upon, incorporating, or using the open source software, or that we license such modifications or derivative works under the terms of the particular open source license. Additionally, if a third-party software provider has incorporated open source software into the software that we license from such provider, we could be required to disclose or provide at no cost any of our source code that incorporates or is a modification of such licensed software. If the author or other third-party distributor of the open source software that we use or license were to allege that we had not complied with the conditions of the applicable license, we could be required to incur significant legal expenses defending against such allegations and could be subject to significant damages and enjoined from the sale of our products and services that contained the open source software. Any of the foregoing could disrupt the distribution and sale of our products and services and harm our business.

Our business is subject to seasonal fluctuations, which may be caused by product launches and various promotional events hosted by our distributors. Historically, our revenues have been higher in the fourth quarter each year primarily as a result of (i) holiday sales for Black Friday and Cyber Monday and during the lead-up to Christmas and (ii) promotional events organized by Amazon and other e-commerce platforms. Accordingly, any shortfall in expected fourth quarter revenue would adversely affect our annual operating results. Furthermore, our growth may obscure the extent to which seasonality trends have affected our business. Accordingly, yearly or quarterly comparisons of our operating results may not be useful and our results in any particular period will not necessarily be indicative of the results to be expected for any future period.

Sales of substantial amounts of our ADSs in the public market, or the perception that these sales could occur, could adversely affect the market price of our ADSs and could materially impair our ability to raise capital through equity offerings in the future. We cannot predict what effect, if any, market sales of securities held by our significant shareholders or any other shareholder or the availability of these securities for future sale will have on the market price of our ADSs.

Labor costs in China have risen in recent years as a result of the enactment of new labor laws and social development. Given most of our contract manufacturers are currently located in China, rising labor costs in China will increase their costs, which in turn may be reflected in the manufacturing fees charged by these contract manufacturers to us. In addition, we have witnessed growing inflation rates in many areas of the world, which adversely affects us and our suppliers alike. The rising costs as a result of higher labor cost of our contract manufacturers and increasing raw material price, on the other hand, cannot be easily passed to end consumers in the form of higher retail sale prices due to severe competition in the smart wearable device market. Our profitability therefore may be adversely affected if labor cost and inflation continue to rise in the future.

We do not maintain our own manufacturing capabilities and rely on contract manufactures to produce our products. We assign the production of our self-branded product lines and Xiaomi Wearable Products to a number of corresponding manufacturers. We may experience operational difficulties with our manufacturers, including reductions in the availability of production capacity, challenges in complying with product specifications, variations in quality control, failures to meet production deadlines, increases in manufacturing costs and longer lead time required. Our manufacturers may experience disruptions in their manufacturing operations due to equipment breakdowns, labor strikes or shortages, natural disasters, lockdowns as a result of outbreaks of the epidemics, component or material shortages, cost increases or other similar problems. In addition, we may not be able to renew contracts with our contract manufacturers or identify manufacturers who are capable of producing new products we target to launch in the future.

The majority of our assets, including production facilities, are located in China. Accordingly, our business, financial condition, results of operations and prospects may be influenced to a significant degree by political, economic and social conditions in China generally. As the case in many other developing countries, the Chinese economy differs from the economies of most developed countries in many respects, including the level of government involvement, level of development, growth rate, control of foreign exchange and allocation of resources. Although the Chinese government has implemented measures emphasizing the utilization of market forces for economic reform, the reduction of state ownership of productive assets, and the establishment of improved corporate governance in business enterprises, a substantial portion of productive assets in China is still owned by the government. In addition, the Chinese government continues to play a significant role in regulating industry development by imposing industrial policies. The Chinese government also exercises significant control over China's economic growth through allocating resources, controlling payment of foreign currency-denominated obligations, setting monetary policy, and providing preferential treatment to particular industries or companies. While the Chinese economy has experienced significant growth over the past decades, growth has been uneven, both geographically and among various sectors of the economy. The Chinese government has implemented various measures to encourage economic growth and guide the allocation of resources. Some of these measures may benefit the overall Chinese economy, but may have a negative effect on us. For example, our financial condition and results of operations may be adversely affected by government control over capital investments or changes in tax regulations. In addition, in the past the Chinese government has implemented certain measures, including interest rate adjustment, to control the pace of economic growth. These measures may cause decreased economic activity in China, which may adversely affect our business and operating results.