ITEM 1A. Risk Factors

Risk factors that could cause actual results to differ from our expectations and that could negatively impact our financial condition and results of operations are discussed below and elsewhere in this Annual Report. Additional risks and uncertainties not presently known to us or that are currently not believed to be significant to our business may also affect our actual results and could harm our business, financial condition and results of operations. If any of the risks or uncertainties described below or any additional risks and uncertainties actually occur, our business, results of operations and financial condition could be materially and adversely affected.

Risks Relating to Our Business

We have a limited operating history and we may never generate revenue or profit.

We are a clinical-stage biotechnology company that commenced activities in January 2012. We have a limited operating history, and our business plan has not been tested. Since inception, we have had no revenue and have incurred significant operating losses. We have financed our operations primarily through equity and debt offerings. To generate revenue and become and remain profitable, we need to successfully complete our existing clinical trials, cultivate partnerships with pharmaceutical companies, and develop and commercialize gedatolisib pursuant to our license agreement with Pfizer. We must also build operational and financial infrastructure to support commercial operations, train and manage employees, and market and sell our anticipated drug products and/or our CELsignia tests (as a companion diagnostic and/or as a stand-alone test). We must also build operational and financial infrastructure to support commercial operations, train and manage employees, and market and sell our CELsignia tests (as a companion diagnostic and/or as a stand-alone test) and, once fully developed and commercialized, our anticipated drug products.

We may never succeed in any of these activities and, even if we do, we may never generate revenue that is sufficient to achieve profitability. We expect to continue to incur significant expenses and operating losses for the foreseeable future, and the net losses we incur may fluctuate significantly from quarter to quarter. Our failure to become and remain profitable would decrease our value and could impair our ability to raise capital, maintain or expand our research and development efforts, expand our business, or continue our operations.

Our inability to raise additional capital on acceptable terms in the future may limit our ability to develop and commercialize our integrated therapeutic (Rx) and companion diagnostic (CDx) strategy.

We may require additional capital to finance capital expenditures and operating expenses over the next several years as we launch our integrated therapeutic and companion diagnostic strategy and expand our infrastructure, commercial operations and research and development activities. If we are not able to secure additional funding when needed, we may have to delay, reduce the scope of or eliminate one or more research and development programs or selling and marketing initiatives. In addition, we may have to work with a partner on one or more of our products or market development programs, which could lower the economic value of those programs to our company.

Future financing activities could dilute the percentage ownership of our stockholders and could cause our stock price to fall, or could result in operating or other restrictions.

We may seek to raise additional capital through equity offerings, debt financings, collaborations or licensing arrangements. Additional funding may not be available to us on acceptable terms, or at all. If we raise funds by issuing equity securities, it will result in dilution to current stockholders. If we raise funds by issuing equity securities, dilution to our stockholders could result. Any equity securities issued may also provide for rights, preferences or privileges senior to those of holders of our existing securities. The incurrence of additional indebtedness or the issuance of certain equity securities could result in increased fixed payment obligations and could also include restrictive covenants, such as limitations on our ability to incur additional debt or issue additional equity, limitations on our ability to acquire or license intellectual property rights, and other operating restrictions that could adversely affect our ability to conduct our business. In the event that we enter into collaborations or licensing arrangements to raise capital, we may be required to accept unfavorable terms.

We will be dependent on our ability to attract and retain key personnel.

Our operations will be materially dependent upon the services of our officers and key employees, including Brian F. Sullivan, our Chief Executive Officer, and Dr. Lance G. Laing, our Chief Science Officer. Successful implementation of our business plan will also require the services of other consultants and additional personnel. We cannot assure you that we will be able to attract and retain such persons as employees, independent contractors, consultants or otherwise. If we are not able to attract individuals with the skills required for our business, or if we lose the services of either Mr. Sullivan or Dr. Laing, we may be unable to successfully implement our business plan.

Risks Related to Our Product Strategy

Our near-term revenue prospects depend on the success of our initial drug product, gedatolisib. If we are unable to successfully complete clinical development of, obtain regulatory approval for or commercialize gedatolisib, or if we experience delays in doing so, our business will be materially harmed. If we are unable to successfully complete clinical development of, obtain regulatory approval for or commercialize our drug products, or if we experience delays in doing so, our business will be materially harmed.

To date, we have not yet completed any registrational clinical trials or the development of our initial drug candidate, gedatolisib. Our future success and ability to generate revenue, which we do not expect will occur for several years, if ever, is dependent on our ability to successfully develop, obtain regulatory approval for and commercialize one or more products, and currently, our primary focus is to pursue approval and commercialization of gedatolisib for one or more intended uses. Our competitors, either alone or with collaboration partners, may succeed in developing, acquiring or licensing on an exclusive basis drug or biologic products that are more effective, safer, more easily commercialized or less costly than our product candidates or may develop proprietary technologies or secure patent protection that we may need for the development of our technologies and products. We may not have the financial resources to continue development of, or to modify existing or enter into new collaborations for, our current or future product candidates if we experience any issues that delay or prevent regulatory approval of, or our ability to commercialize, gedatolisib, including:

We were not involved in the early development of gedatolisib; therefore, we are dependent on third parties having accurately generated, collected, interpreted and reported data from certain preclinical and clinical trials of gedatolisib.

We had no involvement with or control over the initial preclinical and clinical development of gedatolisib. We are dependent on third parties having conducted their research and development in accordance with the applicable protocols and legal, regulatory and scientific standards; having accurately reported the results of all preclinical studies and clinical trials conducted with respect to such drug product; and having correctly collected and interpreted the data from these trials. If these activities were not compliant, accurate or correct, the clinical development, regulatory approval or commercialization of our drug product will be delayed and may be adversely affected.

As an organization, we have never successfully completed any registrational clinical trials, and we may be unable to do so for any drug candidates we may develop.

We will need to successfully complete registrational clinical trials in order to obtain the approval of the FDA or comparable foreign regulatory authorities to market our drug products. Carrying out clinical trials, including later-stage registrational clinical trials, is a complicated process. As an organization, we have not previously completed any registrational clinical trials. In order to do so, we will need to build and expand our clinical development and regulatory capabilities, and we may be unable to recruit and train qualified personnel. We also expect to continue to rely on third parties to conduct our clinical trials. If these third parties do not successfully carry out their contractual duties, meet expected deadlines or comply with regulatory requirements, we may not be able to obtain regulatory approval of or commercialize any potential product candidates. Consequently, we may be unable to successfully and efficiently execute and complete necessary clinical trials in a way that leads to submission and approval of our drug products. We may require more time and incur greater costs than our competitors and may not succeed in obtaining regulatory approval of any drug products that we develop. Failure to commence or complete, or delays in, our planned clinical trials, could prevent us from or delay us in commercializing our drug products.

The successful development of our products is highly uncertain.

Our business depends on the successful development of biopharmaceuticals, which is highly uncertain and is dependent on numerous factors, many of which are beyond our control. Product candidates that appear promising in the early phases of development may fail to reach the market for several reasons including, among other things, that clinical trial results may show the product candidates to be less effective than expected or to have unacceptable side effects or toxicities; we may fail to receive the necessary regulatory approvals or there may be a delay in receiving such approvals; or the proprietary rights of others and their competing products and technologies that may prevent our product candidates from being commercialized.

The length of time necessary to complete clinical trials and to submit an application for marketing approval for a final decision by a regulatory authority varies significantly from one drug product to the next and from one country to the next and may be difficult to predict. We will incur significant research and development expenses before knowing whether our products are commercially viable, and may abandon development of a specific trial, or a product candidate, at any time for a variety of reasons. For example, we terminated the FACT-2 Trial for our CELsignia diagnostic test in the third quarter of 2023 in response to FDA approvals of new therapeutic options for certain patients that negatively impacted enrollment. If we expend resources on products that are ultimately not commercially viable, our timing for becoming profitable and our ability to invest in other products in our pipeline would be adversely affected.

In addition, if gedatolisib receives marketing approval for the intended uses that we are pursuing, we will continue to be subject to significant post-approval regulatory obligations. In addition, there is always the risk that we, a regulatory authority or a third party might identify previously unknown problems with a product post-approval, such as adverse events of unanticipated severity or frequency. Compliance with these requirements is costly, and any failure to comply or other issues with our drug products post-approval could adversely affect our business, financial condition and results of operations.

If we encounter difficulties enrolling patients in any of our clinical trials, our clinical development activities could be delayed or otherwise adversely affected.

The timely completion of clinical trials in accordance with their protocols depends, among other things, on our ability to enroll a sufficient number of patients who remain in the trial until its conclusion. We may experience difficulties in patient enrollment in our clinical trials for a variety of reasons, including:

Delays in patient enrollment may result in increased costs or may affect the timing or outcome of our clinical trials, which could prevent completion of these trials and adversely affect our ability to advance the development of our product candidates.

Clinical development involves a lengthy and expensive process, with an uncertain outcome. We may incur additional costs or experience delays in completing, or ultimately be unable to complete, the development and commercialization of our product candidates.

To obtain the requisite regulatory approvals to commercialize any drug products, we must demonstrate through extensive preclinical studies and clinical trials that such drug product is safe and effective in humans. Clinical testing is expensive and can take many years to complete, and its outcome is inherently uncertain. We may be unable to establish clinical endpoints that applicable regulatory authorities would consider clinically meaningful, and a clinical trial can fail at any stage of testing.

Differences in trial design between early-stage clinical trials and later-stage clinical trials, which involve a greater number of patients and take years to complete, make it difficult to extrapolate the results of earlier clinical trials to later clinical trials. Moreover, clinical data are often susceptible to varying interpretations and analyses, and many companies that have believed their product candidates performed satisfactorily in clinical trials have nonetheless failed to obtain marketing approval of their products. Additionally, we are conducting and plan to conduct some open-label trials, where both the patient and investigator know whether the patient is receiving the investigational product candidate or either an existing approved drug or placebo. Most typically, open-label clinical trials test only the investigational product candidate and sometimes may do so at different dose levels. Open-label clinical trials are subject to various limitations that may exaggerate any therapeutic effect as patients in those trials are aware when they are receiving treatment. Open-label clinical trials may be subject to a “patient bias” where patients perceive their symptoms to have improved merely due to their awareness of receiving an experimental treatment. In addition, open-label clinical trials may be subject to an “investigator bias” where those assessing and reviewing the outcomes of the clinical trials are aware of which patients have received treatment and may interpret the information of the treated group more favorably given this knowledge. Where a randomized, placebo-controlled clinical trial is designed to allow enrolled subjects to cross-over to the treatment arm, there may be a risk of inadvertent unblinding of subjects prior to cross-over, which may limit the clinical meaningfulness of those data and may require the conduct of additional clinical trials. As such, the results from an open-label trial may not be predictive of future clinical trial results with any of our product candidates for which we include an open-label clinical trial when studied in a controlled environment with a placebo or active control.

Successful completion of clinical trials is a prerequisite to submitting a new drug application, or NDA, to the FDA and similar marketing applications to comparable foreign regulatory authorities for each drug product and, consequently, the ultimate approval and commercial marketing of any drug products. We may experience delays in initiating our Phase 3 clinical trial due to requests from the FDA for additional information, including additional nonclinical or clinical data, or for requests to amend the clinical trial protocol. Additional delays may be incurred once the Phase 3 clinical trial is initiated if it takes longer than expected to activate the targeted number of clinical sites, if the enrollment of patients is negatively affected by staffing shortages at clinical sites, or by other unanticipated factors, or if the FDA and other regulatory authorities require us to pause our Phase 3 clinical trial due to unexpected safety issues. We also may experience numerous unforeseen events during, or as a result of, any future clinical trials that we could conduct that could delay or prevent our ability to receive marketing approval or commercialize our current product candidates or any future product candidates.

Our costs will increase if we experience delays in clinical testing or marketing approvals. We do not know whether our clinical trials will begin or continue as planned, will need to be reassigned or will be completed on schedule, or at all. We do not know whether any of our clinical trials will begin as planned, will need to be reassigned or will be completed on schedule, or at all. Significant clinical trial delays also could shorten any periods during which we may have the exclusive right to commercialize our product candidates and may allow our competitors to bring products to market before we do, potentially impairing our ability to successfully commercialize our product candidates and harming our business and results of operations. Any delays in our clinical development programs may harm our business, financial condition and results of operations significantly.

We face significant competition, and our operating results will suffer if we fail to compete effectively.

Our industry is characterized by intense competition and rapid innovation. Our competitors may be able to develop other compounds or drugs that are able to achieve similar or better results than our lead product candidate, gedatolisib. Our competitors may be able to develop other compounds or drugs that are able to achieve similar or better results. Our potential competitors include major multinational pharmaceutical companies, established biotechnology companies, specialty pharmaceutical and diagnostic companies, and universities and other research institutions. Many of our competitors have substantially greater financial, technical and other resources, such as larger research and development staff and experienced marketing and manufacturing organizations and well-established sales forces.

Smaller or early-stage companies may also prove to be significant competitors, particularly as they develop novel approaches to treating disease indications that gedatolisib is also focused on treating. Established pharmaceutical companies may also invest heavily to accelerate discovery and development of novel therapeutics or to in-license novel therapeutics that could make the product candidates that we develop obsolete. Mergers and acquisitions in the biotechnology and pharmaceutical industries may result in even more resources being concentrated in our competitors.

Competition may increase further as a result of advances in the commercial applicability of technologies and greater availability of capital for investment in these industries. Our competitors, either alone or with collaboration partners, may succeed in developing, acquiring or licensing on an exclusive basis products that are more effective, safer, more easily commercialized or less costly than our product candidates or may develop proprietary technologies or secure patent protection that we may need for the development of our technologies and products. Our competitors, either alone or with collaboration partners, may succeed in developing, acquiring or licensing on an exclusive basis drug or biologic products that are more effective, safer, more easily commercialized or less costly than our product candidates or may develop proprietary technologies or secure patent protection that we may need for the development of our technologies and products. We believe the key competitive factors that will affect the development and commercial success of our product candidates are efficacy, safety, tolerability, reliability, convenience of use, price, and reimbursement. With respect to our CELsignia platform, which is a novel approach to companion diagnostics, we will need to demonstrate compelling advantages on a cost-competitive basis, educate key opinion leaders, and successfully collaborate with partners in the discovery, development, and commercialization of our tests. To do so, we need to successfully complete our five existing clinical trial collaborations, continue to develop other CELsignia tests for other cancer sub-types, cultivate partnerships with pharmaceutical companies, and develop and commercialize gedatolisib pursuant to our license agreement with Pfizer.

Even if we obtain regulatory approval of drug products, the availability and price of our competitors’ products could limit the demand and the price we are able to charge for our product candidates. We may not be able to implement our business plan if the acceptance of our product candidates is inhibited by price competition or the reluctance of physicians to switch from existing methods of treatment to our product candidates, or if physicians switch to other new drug or biologic products or choose to reserve our product candidates for use in limited circumstances.

If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could face clinical trial delays; regulatory investigations or actions; litigation; fines and penalties, disruptions of our business operations; reputational harm; and other adverse consequences.

Cyberattacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties upon which we rely. We rely on contract research organizations, contract manufacturing organizations, distributors, supply chain resources, and other third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, on-site systems and cloud-based data centers, systems handling human resources, financial reporting and controls, customer relationship management, regulatory compliance, and other infrastructure operations. We also communicate sensitive data, including patient data, electronically, and through relationships with multiple third-party vendors and their subcontractors. These applications and data encompass a wide variety of sensitive information, including research and development information, patient data, commercial information, and business and financial information. Our ability to monitor these third parties’ security practices is limited, and these third parties may not have adequate security measures in place. If we or any of our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. We cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our information technology systems or the third-party information technology systems that support us and our services.

Cybersecurity threats are becoming increasingly difficult to detect, and come from a variety of sources, including without limitation nation-state actors and activists that create disruption for geopolitical reasons and in conjunction with military conflicts and defense activities. This risk is heightened during times of war and other major conflicts, including the war between Russia and Ukraine, the state of war between Israel and Hamas and the risk of a larger regional conflict. In addition, we and the third parties upon which we rely face an evolving cybersecurity threat landscape, which includes social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, attacks enhanced or facilitated by artificial intelligence (“AI”), software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, natural disasters, terrorism, and other similar threats. Many of our employees and contractors are working remotely at least part of the time. Remote work involves risks to our information technology systems and data, as individuals utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations.

Ransomware attacks also continue to increase in prevalence and severity and can lead to significant interruptions in our operations, ability to provide our services, loss of data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.

While we take steps designed to identify, prevent, assess and mitigate vulnerabilities in our information systems and to mitigate related third-party risks, there can be no assurance that we will be able to detect and remediate all such vulnerabilities, including on a timely basis. The threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature. Therefore, we (or third parties on whom we rely) may be unable to detect a vulnerability until after a security incident has occurred. Further, we or third parties on which we rely may face downtime as a result of adopting new information technology systems that are designed to enhance compliance or reduce vulnerabilities.

A security incident or other interruption could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties upon whom we rely. This could disrupt our clinical trials, damage our reputation, and negatively affect our ability to conduct our business in the ordinary course, including our ability to collect, process, and prepare company financial information, provide information and educational materials through our website, and manage the administrative aspects of our business.

We may expend significant resources or modify our business activities (including our clinical trial activities) to try to protect against security incidents. Additionally, certain data privacy and security obligations may require us to implement and maintain certain measures to protect our information technology systems and sensitive information and to notify relevant stakeholders, including affected individuals, regulatory authorities and our stockholders, of certain security incidents. The disclosure decisions are complex, may take time to determine, and may be subject to change as an investigation progresses. Providing disclosure may be costly, and the failure to comply with such requirements could also lead to adverse consequences. If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may face government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal information); litigation (including class claims) and mass arbitration; indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss; and other similar harms. Accordingly, security incidents and attendant consequences may damage our financial position and negatively impact our ability to grow and operate our business.

Further, if the information technology systems of the third parties upon which we rely become subject to security incidents, we may have insufficient recourse against such third parties, and we may have to expend significant resources to mitigate the impact of such an event, and to develop and implement protections to prevent future events of this nature from occurring. There can be no assurance that limitations of liability in our third-party contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our data privacy and security practices. Additionally, we cannot be sure that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.

In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, our sensitive information could be leaked, disclosed, or revealed as a result of or in connection with our employee’s, personnel’s, or vendor’s use of generative AI technologies.

Public health matters may materially and adversely impact our business, including ongoing clinical trials.

The outbreak of COVID-19 and government measures taken in response demonstrated that public health matters have a significant impact on the global economy, with healthcare systems particularly affected. As a result of the COVID-19 outbreak and related public health measures, we experienced delays in the enrollment of patients in certain CELsignia-related clinical trials. Future outbreaks or variants of the virus, or the emergence of other pandemics or public health disruptions, could materially and adversely impact our clinical trials, business, financial condition and results of operations. Potential disruptions include but are not limited to:

	●	limitations on our ability to recruit and hire key personnel due to our inability to meet with candidates because of travel restrictions; and
	●	limitations on employee resources that would otherwise be focused on the conduct of clinical trials and research as a result of focus on health matters and loss of productivity from remote work.

Risks Related to Product Development and Product Regulation

If we are unable to obtain approval from the FDA or comparable foreign regulatory authorities to market our products for their intended use, we will not be able to generate revenue. For a new drug to be approved for marketing, the FDA and other regulatory authorities must determine that the drug is safe and effective. Because all drugs can have adverse effects, the data from our Phase 3 clinical study must demonstrate to the satisfaction of the FDA and other health authorities that the benefits of gedatolisib in combination with palbociclib and fulvestrant, or gedatolisib in combination with fulvestrant, outweigh its risks. Failure to demonstrate sufficient magnitude of benefit, even if the benefit is found to be statistically significant, may not support regulatory approval.

The marketability of our products, particularly gedatolisib, depends on securing approval from the FDA and equivalent foreign regulatory bodies. This requires rigorous pre-clinical and clinical studies, including Phase 3 clinical trials for each intended use, that the benefits of the therapy outweigh its risks. Failure to demonstrate sufficient magnitude of benefit, even if the benefit is found to be statistically significant, may not support regulatory approval. Satisfaction of the FDA’s regulatory requirements typically takes many years and requires substantial resources for research, development and testing. Satisfaction of the FDA’s regulatory requirements typically takes many years, depends upon the type, complexity and novelty of the drug product and requires substantial resources for research, development and testing.

If a drug meets its primary efficacy endpoint objective in a Phase 3 clinical trial, and the drug sponsor has additional nonclinical and clinical data required by the FDA or other regulatory authorities, the drug sponsor may submit an NDA seeking marketing approval. Upon submission of an NDA, these health authorities perform a benefit-risk assessment that considers the strength and quality of evidence available and takes remaining uncertainties into account. These considerations include an assessment of the strengths and limitations of clinical trials, including design, and potential implications for assessing drug efficacy, the magnitude of benefit and interpretation of clinical importance, the benefit attributed to the drug when studied in combination with other therapies, and the clinical relevance of the study endpoints. We are currently conducting a Phase 3 clinical trial, VIKTORIA-1, evaluating gedatolisib in combination with fulvestrant with or without palbociclib, in patients with HR+/HER2- advanced breast cancer after progression on CDK4/6 therapy, and a Phase 1b/2 clinical trial, CELC-G-201, evaluating gedatolisib in combination with darolutamide in patients with metastatic castration resistant prostate cancer.

We have sought feedback from the FDA and other regulatory authorities on the design of gedatolisib clinical trials, with the goal of addressing these considerations in the clinical trials’ design. However, due to the complexity of clinical trials, the uncertainty of outcomes, and the uncertainty of how the FDA and other regulatory authorities may balance benefits and risks in their review of an NDA, it may not be practical or possible to address all benefit-risk assessment considerations in a clinical trial so that sufficient evidence is generated to support a marketing approval, even if the primary endpoint objective is achieved in the Phase 3 stage of the trial. A breakthrough therapy is defined as a product that is intended, alone or in combination with one or more other products, to treat a serious or life-threatening disease or condition, and preliminary clinical evidence indicates that the product may demonstrate substantial improvement over existing therapies on one or more clinically significant endpoints, such as substantial treatment effects observed early in clinical development. The FDA or other regulatory authorities may require us to redesign or conduct additional unplanned clinical trials before granting any approval and we may not get approval at all. Regulatory approval may also be delayed by changes in government regulation, future legislation or administrative action or changes in FDA policy that occur prior to or during our regulatory review. We cannot predict whether our research and clinical approaches will result in a drug that the FDA considers safe for humans and effective for indicated uses.

The results from clinical trials that we conduct may not support approval of gedatolisib, and the results of clinical trials of other pharmaceutical collaborators may not support use of our CELsignia platform as a companion diagnostic or standalone testing tool. In addition, we may be unable to execute on our intention of using our CELsignia PI3K Activity Test in evaluating tumors in certain of our gedatolisib clinical trials.

If regulatory approvals are delayed or not obtained, especially with respect to gedatolisib, it will negatively impact our ability to commercialize our products and generate revenue and may diminish any competitive advantages that we may otherwise enjoy. If we are required to conduct additional clinical trials or other testing of gedatolisib beyond those that we currently contemplate, if we are unable to successfully complete clinical trials or other testing of gedatolisib, or if the results of these trials or tests are not positive or are only modestly positive or if there are safety concerns, we may:

Breakthrough Therapy Designation or Fast Track Designation from the FDA may not actually lead to a faster development or regulatory review or approval process.

If a drug is intended for the treatment of a serious or life-threatening condition and the product demonstrates the potential to address unmet medical needs for this condition, the product sponsor may apply for Fast Track Designation. The designation offers the opportunity for frequent interactions with the FDA to discuss the drug’s development plan and to ensure collection of appropriate data needed to support drug approval, as well as eligibility for submission of a New Drug Application.

In addition, a drug may receive Breakthrough Therapy Designation if it is intended, alone or in combination with one or more other products, to treat a serious or life-threatening disease or condition and preliminary clinical evidence indicates that the product may demonstrate substantial improvement over existing therapies on one or more clinically significant endpoints, such as substantial treatment effects observed early in clinical development. The benefits of Breakthrough Therapy Designation include more intensive guidance from the FDA on an efficient development program, access to a scientific liaison to help accelerate review time, and potential eligibility for priority review if relevant criteria are met. This designation can expedite the development and regulatory review of an investigational medicine that is intended to treat a serious or life-threatening condition.

Both Fast Track and Breakthrough Therapy Designations are within the discretion of the FDA. While the FDA has granted both designations to our lead drug candidate, gedatolisib, such designations may not result in a faster development process, review or approval compared to products considered for approval under conventional FDA procedures, and neither designation assures ultimate approval by the FDA. In addition, the FDA may later decide that the product no longer meets the qualification conditions and may rescind either or both such designations.

Obtaining and maintaining regulatory approval of our product candidates in one jurisdiction does not mean that we will be successful in obtaining regulatory approval of our product candidates in other jurisdictions.

Obtaining and maintaining regulatory approval of our product candidates in one jurisdiction does not guarantee that we will be able to obtain or maintain regulatory approval in any other jurisdiction, while a failure or delay in obtaining regulatory approval in one jurisdiction may have a negative effect on the regulatory approval process in others. For example, even if the FDA grants marketing approval of a product candidate, a comparable foreign regulatory authority must also approve the manufacturing, marketing and promotion of the product candidate in those countries.

Approval procedures vary among jurisdictions and can involve requirements and administrative review periods different from, and greater than, those in the U.S., including additional preclinical studies or clinical trials, as clinical trials conducted in one jurisdiction may not be accepted by regulatory authorities in other jurisdictions. In many jurisdictions outside the U.S., a product candidate must be approved for reimbursement before it can be approved for sale in that jurisdiction. In some cases, the price that we intend to charge for our products is also subject to approval.

Obtaining foreign regulatory approvals and compliance with foreign regulatory requirements could result in significant delays, difficulties and costs for us and could delay or prevent the introduction of our products in certain countries. If we fail to comply with the regulatory requirements in international markets and/or receive applicable marketing approvals, our target market will be reduced and our ability to realize the full market potential of our product candidates will be harmed.

Even if we receive initial regulatory approvals, we will be subject to ongoing regulatory obligations and continued regulatory review, which may result in significant additional expense, and we may be subject to penalties if we fail to comply with regulatory requirements or experience unanticipated problems with our product candidates.

If any of our product candidates are approved, they will be subject to ongoing regulatory requirements for manufacturing, labeling, packaging, storage, advertising, promotion, sampling, record-keeping, conduct of post-marketing studies and submission of safety, efficacy and other post-marketing information, including both federal and state requirements in the U.S. and requirements of comparable foreign regulatory authorities. In addition, we will be subject to continued compliance with requirements for any clinical trials that we conduct post-approval.

Manufacturers and manufacturers’ facilities are required to comply with extensive FDA and comparable foreign regulatory authority requirements. Accordingly, we and others with whom we work must continue to expend time, money and effort in all areas of regulatory compliance, including manufacturing, production and quality control.

Any regulatory approvals that we receive for our product candidates may be subject to limitations on the approved indicated uses for which the product may be marketed or to the conditions of approval, or contain requirements for potentially costly post-marketing testing, including Phase 4 clinical trials and surveillance to monitor the safety and efficacy of the product candidate. Certain endpoint data we hope to include in any approved product labeling also may not make it into such labeling, including exploratory or secondary endpoint data such as patient-reported outcome measures. The FDA may impose consent decrees or withdraw approval if compliance with regulatory requirements and standards is not maintained or if problems occur after the product reaches the market. Later discovery of previously unknown problems with our product candidates, including adverse events of unanticipated severity or frequency, or with our third-party manufacturers or manufacturing processes, or failure to comply with regulatory requirements, may result in revisions to the approved labeling to add new safety information, imposition of post-marketing studies or clinical trials to assess new safety risks or imposition of distribution restrictions or other restrictions under a REMS program. Other potential consequences include, among other things:

The FDA strictly regulates marketing, labeling, advertising and promotion of products that are placed on the market. Products may be promoted only for the approved indications and in accordance with the provisions of the approved label. If we are slow or unable to adapt to changes in existing requirements or the adoption of new requirements or policies, or if we are not able to maintain regulatory compliance, we may lose any marketing approval that we may have obtained and we may not achieve or sustain profitability.

Our success with CELsignia is heavily dependent on the success of our first CELsignia trials and on finding appropriate pharmaceutical company partners.

The success of our CELsignia tests depends on our ability to attract pharmaceutical company partnerships that provide revenue from the sale of CELsignia tests during clinical trials, from milestone payments during clinical trials, from sales of our CELsignia tests as companion diagnostics or stand-alone tests thereafter, and, potentially, from royalties on the incremental drug revenues our tests enable. Our ability to obtain such partnerships and generate such revenue depends in part on the ability of our first CELsignia tests to demonstrate the potential incremental opportunity available for pharmaceutical companies, as well as our ability to establish strategic partnerships or other arrangements with suitable pharmaceutical companies. Our ability to obtain such partnerships and generate such revenue depends in part on the ability of our first CELsignia tests to demonstrate the potential incremental opportunity available for pharmaceutical companies.

Phase 2 trials are underway to evaluate the efficacy and safety of these therapies in CELsignia selected patients. We do not expect to receive final results from our FACT-1 trial until the first half of 2025. The FACT-2 trial, which was evaluating patients with early-stage triple negative breast cancer, was terminated in the third quarter of 2023. This decision was made in response to recent FDA approvals of new therapeutic options for patients with early-stage triple negative breast cancer. The availability of these new therapeutic options negatively impacted enrollment, which led us to conclude that the study was no longer feasible.

Success of the clinical trials using the CELsignia HER2 Pathway Activity Test or CELsignia Multi-Pathway Activity Test will depend on many factors, such as successfully enrolling patients, meeting trial endpoint goals, and completing the trial in a timely manner. Our ability to complete the trial could be delayed or prevented for several reasons that are out of our control, such as the FDA withdrawing its authorization and approval to perform the study, NSABP, MD Anderson Cancer Center, or University of Rochester determining that the human and/or toxicology test results do not support continuing the trial, or participants having adverse reactions or side-effects to the drugs administered in the study. Our ability to complete the trial could be delayed or prevented for several reasons that are out of our control, such as the FDA withdrawing its authorization and approval to perform the study, NSABP, West Cancer Center, Massachusetts General Hospital, MD Anderson Cancer Center, or University of Rochester determining that the human and/or toxicology test results do not support continuing the trial, or participants having adverse reactions or side-effects to the drugs administered in the study.

If we are unable to demonstrate that the CELsignia HER2 Pathway Activity Test or CELsignia Multi-Pathway Activity Test is suitable as a companion diagnostic for the targeted therapy, we will likely not be able to generate future revenue from our CELsignia HER2 Pathway Activity Test or CELsignia Multi-Pathway Activity test and may not be able to attract other pharmaceutical companies to partner with us for the development and commercialization of other CELsignia tests. Further, potential pharmaceutical company partners may delay negotiating development agreements until results of the first clinical trial using our CELsignia HER2 Pathway Activity Test trial are available. Even if the ultimate outcome of the first clinical trial using a CELsignia HER2 Pathway Activity Test trial is positive, any delays could materially and adversely affect our business.

If the FDA were to begin regulating our tests, we could incur substantial costs and delays associated with trying to obtain premarket clearance or approval.

Most laboratory developed tests (“LDTs”) are not currently subject to FDA regulation, although reagents, instruments, software or components provided by third parties and used to perform LDTs may be subject to regulation. We believe that the CELsignia tests are LDTs, which is a term that describes tests that are designed and performed within a single laboratory. As a result, we believe the CELsignia tests are not currently subject to regulation by the FDA in accordance with the FDA’s current policy of exercising enforcement discretion regarding LDTs.

It is not clear when or if the FDA will seek to alter the current LDT regulatory framework in the future. We cannot provide any assurance that FDA regulation, including premarket review, will not be required in the future for our tests, whether through additional guidance issued by the FDA, new enforcement policies adopted by the FDA or new legislation enacted by Congress. We cannot predict with certainty the timing or content of future legislation enacted or guidance issued regarding LDTs, or how it will affect our business.

If premarket review is required by the FDA at a future date or if we decide to voluntarily pursue FDA premarket review of our CELsignia tests, there can be no assurance that our CELsignia tests or any tests we may develop in the future will be cleared or approved by the FDA on a timely basis, if at all, nor can there be assurance that labeling claims will be consistent with our current claims or adequate to support continued adoption of and reimbursement for our CELsignia tests. Compliance with FDA regulations would increase the cost of conducting our business and subject us to heightened regulation and scrutiny by the FDA and penalties for failure to comply with these requirements.

If we fail to obtain required federal and state laboratory licenses, we could lose the ability to perform our tests.

Clinical laboratory tests, including our CELsignia tests, are regulated under CLIA. CLIA is a federal law that regulates clinical laboratories that perform testing on specimens derived from humans for the purpose of providing information for the diagnosis, prevention or treatment of disease. CLIA regulations mandate specific standards for laboratories in the areas of personnel qualifications, administration, and participation in proficiency testing, patient test management and quality assurance. CLIA certification is also required in order for us to be eligible to bill state and federal healthcare programs, as well as many private third-party payers, for any tests we launch. We will also be required to maintain state licenses in certain states to conduct testing in our laboratories. While we currently have CLIA certification for our Minnesota laboratory, failure to maintain this certification would adversely affect our ability to launch our CELsignia tests.

Risks Related to Intellectual Property

We depend on intellectual property licensed from third parties, including from Pfizer for our lead product candidate, and termination of this license could result in the loss of significant rights, which would harm our business.

We are dependent on patents, know-how and proprietary technology, both our own and licensed from others. All patents covering gedatolisib and any combination therapies using our product candidates are licensed from third parties. Any termination of a product license could result in the loss of significant rights and would cause material adverse harm to our ability to commercialize our product candidates.

Disputes may also arise between us and our licensors regarding intellectual property subject to a license agreement, including:

If disputes over intellectual property that we have licensed prevent or impair our ability to maintain our current licensing arrangements on acceptable terms, we may be unable to successfully develop and commercialize the affected product candidates.

We are generally also subject to all of the same risks with respect to protection of intellectual property that we own, as we are for intellectual property that we license. If we or our licensors fail to adequately protect this intellectual property, our ability to commercialize products could materially suffer.

If we fail to comply with our obligations under our patent license with Pfizer, we could lose license rights that are important to our business.

We are a party to a license agreement with Pfizer pursuant to which we in-license key patents for gedatolisib. This license imposes various diligence, milestone payment, royalty, insurance and other obligations on us. If we fail to comply with these obligations, Pfizer may have the right to terminate the license, in which event we would not be able to develop or market the products covered by such licensed intellectual property. We may have limited control over the maintenance and prosecution of these in-licensed rights, activities or any other intellectual property that may be related to our in-licensed intellectual property. For example, we cannot be certain that such activities by these licensors have been or will be conducted in compliance with applicable laws and regulations or will result in valid and enforceable patents and other intellectual property rights. We have limited control over the manner in which our licensors initiate an infringement proceeding against a third-party infringer of the intellectual property rights, or defend certain of the intellectual property that is licensed to us. It is possible that the licensors’ infringement proceeding or defense activities may be less vigorous than had we conducted them ourselves.

We may not be successful in obtaining or maintaining necessary rights to develop any future product candidates on acceptable terms.

Our clinical trials and other programs currently, and may in the future, involve additional product candidates that require the use of, or reliance on, proprietary rights held by third parties. Accordingly, the growth of our business depends in part on our ability to acquire, in-license or use these proprietary rights. We may be unable to acquire or in-license any compositions, methods of use, processes or other third-party intellectual property rights from third parties that we identify as necessary or important to our business operations. We may fail to obtain any of these licenses at a reasonable cost or on reasonable terms, if at all, which could harm our business. We may need to cease use of the compositions or methods covered by such third-party intellectual property rights, and may need to seek to develop alternative approaches that do not infringe on such intellectual property rights which may entail additional costs and development delays, even if we were able to develop such alternatives, which may not be feasible. Even if we are able to obtain a license, it may be non-exclusive, thereby giving our competitors access to the same technologies licensed to us. In that event, we may be required to expend significant time and resources to develop or license replacement technology.

The licensing and acquisition of third-party intellectual property rights is a competitive area, and companies that may be more established or have greater resources than we do may also be pursuing strategies to license or acquire third-party intellectual property rights that we may consider necessary or attractive in order to commercialize our product candidates. More established companies may have a competitive advantage over us due to their size, cash resources and greater clinical development and commercialization capabilities. There can be no assurance that we will be able to successfully complete such negotiations and ultimately acquire the rights to the intellectual property surrounding the additional product candidates that we may seek to acquire.

If we are not able to prevent disclosure of our trade secrets and other proprietary information, the value of our products could be significantly diminished.

We rely on trade secret protection to protect our interests in proprietary know-how and in processes for which patents are difficult to obtain or enforce. We may not be able to protect our trade secrets adequately. We have a policy of requiring our consultants, advisors and strategic partners to enter into confidentiality agreements and our employees to enter into invention, non-disclosure and non-compete agreements. However, no assurance can be given that we have entered into appropriate agreements with all parties that have had access to our trade secrets, know-how or other proprietary information. There is also no assurance that such agreements will provide meaningful protection of our trade secrets, know-how or other proprietary information in the event of any unauthorized use or disclosure of information. Furthermore, we cannot provide assurance that any of our employees, consultants, contract personnel, or strategic partners, either accidentally or through willful misconduct, will not cause serious damage to our programs and/or our strategy, for example by disclosing important trade secrets, know-how or proprietary information to our competitors. It is also possible that our trade secrets, know-how or other proprietary information could be obtained by third parties as a result of breaches of our physical or electronic security systems. Any disclosure of confidential data into the public domain or to third parties could allow our competitors to learn our trade secrets and use the information in competition against us. In addition, others may independently discover our trade secrets and proprietary information. Any action to enforce our rights is likely to be time consuming and expensive, and may ultimately be unsuccessful, or may result in a remedy that is not commercially valuable. These risks are accentuated in foreign countries where laws or law enforcement practices may not protect proprietary rights as fully as in the United States. Any unauthorized disclosure of our trade secrets or proprietary information could harm our competitive position.

We may be subject to claims by employees claiming ownership of what we regard as our own intellectual property.

While it is our policy to require our employees and contractors who may be involved in the development of intellectual property to execute agreements assigning such intellectual property to us, we may be unsuccessful in executing such an agreement with each party who in fact develops intellectual property that we regard as our own. Our and their assignment agreements may not be self-executing or may be breached, and we may be forced to bring claims against third parties, or defend claims they may bring against us, to determine the ownership of what we regard as our intellectual property. If we fail in prosecuting or defending any such claims, in addition to paying monetary damages, we may lose valuable intellectual property rights or personnel. If we fail in prosecuting or defending any such claims, in addition to paying monetary damages, we may lose valuable intellectual property rights or personnel. Even if we are successful in prosecuting or defending against such claims, litigation could result in substantial costs and be a distraction to management.

If we are unable to obtain and maintain intellectual property protection for our CELsignia technology, or if the scope of the intellectual property protection obtained is not sufficiently broad, our competitors could develop and commercialize technology and diagnostic tests similar or identical to ours, and our ability to successfully commercialize our technology and diagnostic tests may be impaired.

We have applied for patents that protect our CELsignia technology and our patent portfolio currently includes seven issued U.S. patents and more than 30 issued international patents. We cannot ensure that our intellectual property position will not be challenged or that all patents for which we have applied will be granted. However, we cannot assure you that our intellectual property position will not be challenged or that all patents for which we have applied will be granted. We cannot know with certainty whether we were the first to make the inventions claimed in our owned or licensed patents or pending patent applications, or that we were the first to file for patent protection of such inventions. Therefore, we cannot know with certainty whether we were the first to make the inventions claimed in our owned or licensed patents or pending patent applications, or that we were the first to file for patent protection of such inventions.

The patent prosecution process is expensive and time-consuming, and we may not be able to file, prosecute, maintain, enforce or license all necessary or desirable patent applications at a reasonable cost or in a timely manner, or in all jurisdictions. We may choose not to seek patent protection for certain innovations and may choose not to pursue patent protection in certain jurisdictions, and under the laws of certain jurisdictions, patents or other intellectual property rights may be unavailable or limited in scope. Additionally, the laws and regulations governing patents could change in unpredictable ways that would weaken our ability to obtain new patents or to enforce our existing patents and patents that we might obtain in the future. There also may be patent reforms in foreign jurisdictions that could increase the uncertainties and costs surrounding the prosecution of our patent applications and the enforcement or defense of our issued patents in those jurisdictions. In addition, there may be patent law reforms in foreign jurisdictions that could increase the uncertainties and costs surrounding the prosecution of our patent applications and the enforcement or defense of our issued patents in those foreign jurisdictions. It is also possible that we will fail to identify patentable aspects of our discovery and nonclinical development output before it is too late to obtain patent protection.

As a result of these factors, the issuance, scope, validity, enforceability and commercial value of our patent rights are highly uncertain. Our pending and future patent applications may not result in patents being issued that protect our technology or CELsignia tests, in whole or in part, or which effectively prevent others from commercializing competitive technologies and diagnostic tests. Moreover, given the amount of time required for the development, testing and regulatory review of new diagnostic tests, patents protecting such tests might expire before or shortly after such candidates are commercialized. Given the amount of time required for the development, testing and regulatory review of new diagnostic tests, patents protecting such tests might expire before or shortly after such candidates are commercialized. As a result, our owned patent portfolio may not provide us with sufficient rights to exclude others from commercializing diagnostic tests similar or identical to ours.

Third parties may initiate legal proceedings alleging that we are infringing their intellectual property rights, the outcome of which would be uncertain and could have a material adverse effect on the success of our business.

The commercial success of our products depends upon our ability to use proprietary technologies without infringing the proprietary rights of third parties. There is considerable intellectual property litigation in the medical technology, biotechnology and pharmaceutical industries. We may become party to, or threatened with, future adversarial proceedings or litigation regarding intellectual property rights with respect to our products. We may become party to, or threatened with, future adversarial proceedings or litigation regarding intellectual property rights with respect to our CELsignia platform, including interference or derivation proceedings before the US PTO and similar bodies in other jurisdictions. Additionally, because current and future employees may have been previously employed at universities or other biotechnology, diagnostic technology or pharmaceutical companies, including our competitors or potential competitors and strategic partners, third parties may assert infringement claims against us based on existing patents or patents that may be granted in the future, or they may allege that our employees or we have used or disclosed intellectual property, including trade secrets or other proprietary information, of any such employee’s former employer. Litigation may be necessary to defend against these claims.

Patent litigation could result in loss of exclusivity or freedom to operate or in patent claims being narrowed, invalidated or held unenforceable, in whole or in part, which could limit our ability to stop others from using or commercializing similar or identical technology and product candidates, or limit the duration of the patent protection of our technology and potential diagnostic tests. If we are found to infringe a third party’s intellectual property rights, we could be required to obtain additional licenses from such third party to continue developing and marketing our applicable products. We may also be required to expend considerable resources repeating clinical studies, which would adversely affect the timing for generating potential revenue from a new product and our ability to invest in other products in our pipeline. However, we may not be able to obtain any required license on commercially reasonable terms or at all. Even if we were able to obtain a license, it could be non-exclusive, thereby giving our competitors access to the same technologies licensed to us. We could be forced, including by court order, to cease commercializing the infringing technology or product.

In addition, we could be found liable for monetary damages, including treble damages and attorneys’ fees if we are found to have willfully infringed a patent. A finding of infringement could prevent us from commercializing our products or force us to cease some of our business operations, which could materially harm our business. A finding of infringement could prevent us from commercializing our CELsignia platform or force us to cease some of our business operations, which could materially harm our business. Claims that we have misappropriated the confidential information or trade secrets of third parties could have a similar negative impact on our business.

Any lawsuits relating to infringement of intellectual property rights necessary to defend ourselves or enforce our rights will be costly and time consuming and could be unsuccessful.

Because competition in our industry is intense, competitors may infringe or otherwise violate our issued patents, patents of our licensors or other intellectual property. To counter infringement or unauthorized use, we may be required to file infringement claims, which can be expensive and time consuming, and could distract our technical and management personnel from their normal responsibilities. Any claims we assert against perceived infringers could provoke these parties to assert counterclaims against us alleging that we infringe their patents. In addition, in a patent infringement proceeding, a court may decide that a patent of ours is invalid or unenforceable, in whole or in part, construe the patent’s claims narrowly or refuse to stop the other party from using the technology at issue on the grounds that our patents do not cover the technology in question. An adverse result in any litigation proceeding could put one or more of our patents at risk of being invalidated or interpreted narrowly. We may also elect to enter into license agreements in order to settle patent infringement claims or to resolve disputes prior to litigation, and any such license agreements may require us to pay royalties and other fees that could be significant. Furthermore, because of the substantial amount of discovery required in connection with intellectual property litigation, there is a risk that some of our confidential information could be compromised by disclosure.

Risks Related to Our Reliance on Third Parties

We rely on third parties to conduct certain aspects of our preclinical studies and clinical trials. If these third parties do not successfully carry out their contractual duties, meet expected deadlines or comply with regulatory requirements, we may not be able to obtain regulatory approval for, or commercialize, any potential product candidates.

We depend upon third parties to execute our operational plans and to conduct certain aspects of our preclinical studies. Additionally, we depend on third parties, including independent investigators, to conduct our clinical trials, under agreements with universities, medical institutions, contract research organizations, or CROs, strategic partners and others. Our reliance on third parties may affect our development timelines and increase our costs.

We have limited control over third-party clinical investigators and limited visibility into their day-to-day activities, including with respect to their compliance with the approved clinical protocol. Nevertheless, we are responsible for ensuring that each of our clinical trials is conducted in accordance with the applicable protocol, legal and regulatory requirements and scientific standards. Nevertheless, we are responsible for ensuring that each of our clinical trials is conducted in accordance with the applicable protocol, legal and regulatory requirements and scientific standards, and our reliance on third parties does not relieve us of our regulatory responsibilities. We and these third parties are required to comply with GCP requirements, which are regulations and guidelines enforced by the FDA and comparable foreign regulatory authorities for product candidates in clinical development. Regulatory authorities enforce these GCP requirements through periodic inspections of clinical trial sponsors, clinical investigators and clinical trial sites. If we or any of these third parties fail to comply with applicable GCP requirements, the clinical data generated in our clinical trials may be deemed unreliable and the FDA or comparable foreign regulatory authorities may require us to suspend or terminate these trials or perform additional preclinical studies or clinical trials before approving our marketing applications. Moreover, our business may be adversely affected if any of these third parties violates federal or state fraud and abuse or false claims laws and regulations or healthcare privacy and security laws.

Any third parties conducting aspects of our preclinical studies or our clinical trials will not be our employees and, except for remedies that may be available to us under our agreements with such third parties, we cannot control whether or not they devote sufficient time and resources to our preclinical studies and clinical programs. These third parties may also have relationships with other commercial entities, including our competitors, for whom they may also be conducting clinical trials or other product development activities, which could affect their performance on our behalf. If these third parties do not successfully carry out their contractual duties or obligations or meet expected deadlines, if they need to be replaced or if the quality or accuracy of the preclinical or clinical data they obtain is compromised due to the failure to adhere to our protocols or regulatory requirements or for other reasons, our development timelines, including clinical development timelines, may be extended, delayed or terminated and we may not be able to complete development of, obtain regulatory approval of or successfully commercialize our product candidates. As a result, our financial results and the commercial prospects for our product candidates would be harmed, our costs could increase and our ability to generate revenue could be delayed or precluded entirely.

Our reliance on third parties to formulate and manufacture our drug product will expose us to risks that may delay the development, regulatory approval and commercialization of our drug product or result in higher product costs.

We have no direct experience in drug formulation or manufacturing and do not intend to establish our own manufacturing facilities. We lack the resources and expertise to formulate or manufacture our own product candidates. Instead, we will contract with one or more manufacturers to manufacture, supply, store and distribute drug supplies for our clinical trials. If our drug product receives FDA approval, we will rely on one or more third-party contractors to manufacture our drugs. Similarly, we rely on instrument and reagent suppliers in connection with our CELsignia tests.

Our anticipated future reliance on a limited number of third-party manufacturers exposes us to risks that, among other things, we may be unable to identify manufacturers on acceptable terms or at all because the number of potential manufacturers is limited and the FDA must approve any replacement contractor; our third-party manufacturers might be unable to formulate and manufacture our drugs in the volume and of the quality required to meet our clinical and/or commercial needs, if any; our future contract manufacturers may not perform as agreed or may not remain in the contract manufacturing business for the time required to supply our clinical trials or to successfully produce, store and distribute our products; and our contract manufacturers may fail to comply with good manufacturing practice and other government regulations and corresponding foreign standards. Each of these risks could delay our clinical trials, the approval, if any, of our product candidates by the FDA, or the commercialization of our product candidates or result in higher costs or deprive us of potential product revenues.

The pharmaceutical companies that we partner with for our CELsignia tests may not be successful in receiving regulatory approval for drug indications or may not commercialize their companion therapies for our expected companion diagnostic programs.

There can be no assurances that our pharmaceutical partners for our CELsignia tests will be able to obtain regulatory approval for new indications to treat applicable patient populations or otherwise be successful in commercializing their therapies. Among other risks, our pharmaceutical companies we partner with may not meet clinical trial endpoint targets, may encounter regulatory or production delays, may not pursue commercialization of companion therapeutics, or may terminate their relationship with us. Any of these factors could adversely affect our commercialization strategy for our CELsignia platform, as well as our business, results of operations and financial condition.

We may not be successful in finding pharmaceutical company partners or negotiating favorable terms for continuing development of additional CELsignia tests.

Many of the potential partners for CELsignia are global, multi-billion-dollar pharmaceutical companies with sophisticated research and development organizations and multiple priorities. We may not be successful in our efforts to establish such a strategic partnership or other alternative arrangements for our CELsignia tests because, among other things, our research and development pipeline may be insufficient, such tests may be deemed to be at too early of a stage of development for collaborative effort, or third parties may not view such tests as having the requisite potential to demonstrate efficacy. In addition, we may be restricted under collaboration agreements from entering into future agreements with other partners. Even if we are able to find suitable partners, we may not be successful in negotiating development agreements with such partners that provide revenue from the sale of our CELsignia tests, from milestone payments, and/or from royalties on the incremental drug revenues that our tests enable. If we are unable to reach agreements with suitable strategic partners on a timely basis, on acceptable terms or at all, we may have to curtail the development of additional CELsignia tests, our expected revenue opportunities may be significantly smaller than expected and our business opportunities may be negatively impacted.

Performance issues or price increases by our shipping carriers could adversely affect our business, results of operations and financial condition, and harm our reputation and ability to provide our products on a timely basis.

Expedited, reliable shipping is essential to our operations. Should our shipping carriers encounter delivery performance issues such as loss, damage or destruction of a sample, such occurrences may damage our reputation and lead to decreased demand for our services and increased cost and expense to our business. Should our shipping carrier encounter delivery performance issues such as loss, damage or destruction of a sample, such occurrences may damage our reputation and lead to decreased demand for our services and increased cost and expense to our business. In addition, any significant increase in shipping rates could adversely affect our operating margins and results of operations. Similarly, strikes, severe weather, natural disasters or other service interruptions by delivery services we use would adversely affect our ability to receive and process patient samples on a timely basis. There are only a few providers of overnight nationwide transport services, and there can be no assurance that we will be able to maintain arrangements with providers on acceptable terms, if at all.

Risks Related to Commercializing Our Products

Even if our products achieve positive clinical trial results and requisite approvals, they may fail to achieve the degree of market acceptance by physicians, patients, third-party payors and others in the medical community necessary for commercial success.

If any product we develop achieves positive clinical trial results and receives marketing approval, whether on a standalone basis or in combination with other therapies, it may nonetheless fail to gain sufficient market acceptance by physicians, patients, third-party payors and others in the medical community. For example, existing drug therapies may be viewed as more reliable than gedatolisib, or physicians may continue to rely on conventional genomic- or proteomic-based analyses to diagnose cancer and prescribe cancer medications, versus adopting the use of a CELsignia test. For example, conventional genomic- or proteomic-based analyses are commonly used today to diagnose cancer and prescribe cancer medications, and physicians may continue to rely on these diagnostic tests instead of adopting the use of a CELsignia test. If the product candidates we develop do not achieve an adequate level of acceptance, we may not generate significant product revenues and we may not become profitable. The degree of market acceptance of any product candidate, if approved for commercial sale, will depend on a number of factors, including:

If our products do not achieve an adequate level of acceptance, we may never generate significant product revenues and we may not become profitable.

If we commercialize any product candidates, we will be subject to U.S. and foreign governmental regulations as well as private payor policies that mandate price controls or limitations on patient access to our products or establish prices paid by government entities or programs for our products. Our business, and our future results could be adversely affected by changes in such regulations.

Even if we or our partners are successful in obtaining marketing approval, commercial success of any approved products will also depend in large part on the availability of insurance coverage and adequate reimbursement from third-party payors, including government payors such as the Medicare and Medicaid programs and managed care organizations in the U.S. or country specific governmental organizations in foreign countries. Government and private payors routinely seek to manage utilization and control costs, and there is considerable public and government scrutiny of pharmaceutical and diagnostic pricing. Efforts by states and the federal governments to regulate prices or payment for pharmaceutical products, including proposed actions to facilitate drug importation, limit reimbursement to lower international reference prices, require deep discounts, and require manufacturers to report and make public price increases and sometimes provide a written justification for such price increases, could adversely affect our business if implemented.

Availability of reimbursement may be affected by existing and future healthcare reform measures designed to reduce the cost of healthcare, including the Inflation Reduction Act, which requires manufacturers of certain drugs to engage in price negotiations with Medicare, imposes rebates under Medicare Part B and Medicare Part D to penalize price increases that outpace inflation, and replaces the Part D coverage gap discount program with a new discounting program. Some states have implemented, and others are considering implementing, patient access constraints or cost cutting under the Medicaid program, and some are considering measures that would apply to broader segments of their populations that are not Medicaid-eligible. State legislatures also have continued to focus on addressing drug costs, generally by increasing price transparency or limiting drug price increases.

Third-party payors also could require us to conduct additional studies, including post-marketing studies related to the cost effectiveness of a product and appropriateness for specific patient populations, to qualify for reimbursement, which could be costly and divert our resources. If government and other healthcare payors do not provide coverage and adequate reimbursement for our products once approved, market acceptance and commercial success would be reduced. If government and other healthcare payors were not to provide coverage and adequate reimbursement for our products once approved, market acceptance and commercial success would be reduced. Even if coverage is provided, the approved reimbursement amount may not be high enough to support pricing that results in a sufficient return on our research and development investment. Even if coverage is provided, the approved reimbursement amount may not be high enough to allow us to establish or maintain pricing sufficient to realize a sufficient return on our research and development investment.

We expect pricing pressures will continue globally. U.S. and foreign governmental regulations that mandate price controls or limitations on patient access to our products or establish prices paid by government entities or programs for our products could impact our business, and our future results could be adversely affected by changes in such regulations or policies.

We may encounter difficulties in scaling production, commercializing, marketing and distributing our products, including in hiring and retaining a qualified sales force.

In order to commercialize any of our products, we must build production, marketing, sales, managerial and other non-technical capabilities or make arrangements with third parties to perform these services, and we may not be successful in doing so. Our beliefs that our products will be commercially viable have not been tested. These activities will be expensive and time consuming and will require significant attention of our executive officers to manage. There are risks involved in establishing our own sales and marketing capabilities, as well as with entering into arrangements with third parties to perform these services.

In particular, there is intense competition for qualified sales personnel and our inability to hire or retain an adequate number of sales representatives could limit our ability to maintain or expand our business and increase sales. Furthermore, there is no guarantee that the market opportunity for gedatolisib will be as significant as we expect or exist at all, or that any new drug indications will require our CELsignia tests as a companion diagnostic, or that any pharmaceutical company will effectively coordinate sales and marketing activities with us for our CELsignia tests. If we are unable to successfully commercialize our products, or if we are delayed in doing so, including if we are unable to develop our marketing and sales networks or if our sales personnel do not perform as expected, we may never generate any revenue and our business may fail.

Our business, operational and financial goals may not be attainable if the market opportunities for our products are smaller than we expect. Our internal research and estimates on market opportunities have not been verified by independent sources, and we have not independently verified market and industry data from third parties that we have relied on.

The total market opportunities that we believe exist are based on a variety of assumptions and estimates, including the size of the addressable patient population in applicable jurisdictions, the penetration of other drugs in these markets, the number of potential companion diagnostic programs we will be able to successfully pursue, the amount of potential milestone payments that we could receive in companion diagnostic programs, the number of patients we will test in clinical trials, the price we will be able to charge for our products and the total annual number of cancer patients with undiagnosed abnormal cell signaling. In addition, we have relied on third-party publications, research, surveys and studies for information related to determining market opportunities, including without limitation, information on the number of cancer patients and those receiving various forms of treatment, the cost of drug therapy, the amount of revenue generated from various types of drug therapy, the objective response rates of drug therapies, the number of deaths caused by cancer and the expected growth in cancer drug therapy and diagnostic markets. Our internal research and estimates on market opportunities have not been verified by independent sources, and we have not independently verified market and industry data from third parties that we have relied on. Any or all of our assumptions and/or estimates may prove to be incorrect for several reasons, such as inaccurate reports or information that we have relied on, potential patients or providers not being amenable to using our products or such patients becoming difficult to identify and access, limited reimbursement for our products, pricing pressure due to availability of alternative drugs or diagnostic tests, or an inability of the CELsignia tests’ companion drugs to obtain the necessary regulatory approvals for new indications. Any or all of our assumptions and/or estimates may prove to be incorrect for several reasons, such as inaccurate reports or information that we have relied on, potential patients or providers not being amenable to using our CELsignia platform for diagnostic testing or such patients becoming difficult to identify and access, limited reimbursement for companion diagnostics, pricing pressure due to availability of alternative diagnostic tests, or an inability of the CELsignia tests’ companion drugs to obtain the necessary regulatory approvals for new indications. If any or all of our assumptions and estimates prove inaccurate, we may not attain our business, operational and financial goals. If any or all of our assumptions and estimates prove inaccurate, we and our companion diagnostic pharmaceutical partners may not attain our business, operational and financial goals.

If our sole laboratory facility becomes inoperable, we will be unable to perform our CELsignia tests and our business will be harmed.

We do not have redundant laboratory facilities. We perform all of our diagnostic services in our laboratory located in Minneapolis, Minnesota. Our facility and the equipment we use to perform our tests would be costly to replace and could require substantial lead time to repair or replace. The facility may be harmed or rendered inoperable by physical damage from fire, floods, tornadoes, power loss, telecommunications failures, break-ins and similar events, which may render it difficult or impossible for us to perform our tests for some period of time. The inability to perform our tests may result in the loss of customers or harm our reputation, and we may be unable to regain those customers in the future. Although we possess insurance for damage to our property and the disruption of our business, this insurance may not be sufficient to cover all of our potential losses and may not continue to be available to us on acceptable terms, or at all.

In order to rely on a third party to perform our tests, we could only use another facility with established state licensure and CLIA accreditation under the scope of which our potential CELsignia tests could be performed following validation and other required procedures. We cannot assure you that we would be able to find another CLIA-certified facility willing to adopt CELsignia tests and comply with the required procedures, or that this laboratory would be willing to perform the tests for us on commercially reasonable terms.

Other Risks Related to Government Regulation for Our Business

Failure to comply with the HIPAA security and privacy regulations may increase our operational costs.

A portion of the data that we obtain and handle for or on behalf of our clients is considered protected health information, or PHI, subject to HIPAA. Under HIPAA and our contractual agreements with our HIPAA-covered entity health plan customers, we may be considered a “business associate” to those customers and are required to maintain the privacy and security of PHI in accordance with HIPAA and the terms of our business associate agreements with our clients, including by implementing HIPAA-required administrative, technical and physical safeguards. Under HIPAA and our contractual agreements with our HIPAA-covered entity health plan customers, we are considered a “business associate” to those customers, and are required to maintain the privacy and security of PHI in accordance with HIPAA and the terms of our business associate agreements with our clients, including by implementing HIPAA-required administrative, technical and physical safeguards. We are also required to maintain similar business associate agreements with our subcontractors that have access to PHI of our customers in rendering services to us or on our behalf. We will incur significant costs to establish and maintain these safeguards and, if additional safeguards are required to comply with HIPAA regulations or our clients’ requirements, our costs could increase further, which would negatively affect our operating results. Furthermore, we cannot guarantee that such safeguards have been and will continue to be adequate under applicable laws. If we have failed, or fail in the future, to maintain adequate safeguards, or we or our agents or subcontractors use or disclose PHI in a manner prohibited or not permitted by HIPAA, our subcontractor business associate agreements, or our business associate agreements with our customers, or if the privacy or security of PHI that we obtain and handle is otherwise compromised, we could be subject to significant liabilities and consequences.

Compliance with global privacy and data security requirements could result in additional costs and liabilities to us or inhibit our ability to collect and process data globally, and the failure to comply with such requirements could subject us to significant fines and penalties, which may have a material adverse effect on our business, financial condition or results of operations.

In addition to PHI, we collect, receive, store, process, use, generate, transfer, disclose, make accessible, protect, secure, dispose of, transmit and share (collectively, process) personal data and other sensitive information. Accordingly, we are, or may become, subject to numerous federal, state, local and foreign privacy and security laws regulating the collection, use, safeguarding, transfer and other processing of information.

Globally, virtually every jurisdiction in which we operate has established its own data security and privacy frameworks with which we must comply. For example, the collection, use, disclosure, transfer, or other processing of personal data regarding individuals in the European Economic Area (the “EEA”), including personal health data, is subject to the EU General Data Protection Regulation (the “GDPR”), which is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including requirements relating to the processing of health and other sensitive data, obtaining consent of the individuals to whom the personal data relates, providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of personal data, providing notification of data breaches, and taking certain measures when engaging third-party processors. In addition, the GDPR also imposes strict rules on the transfer of personal data to countries outside the European Union, including the United States, and, as a result, increases the scrutiny that clinical trial sites located in the EEA should apply to transfers of personal data from such sites to countries that are considered to lack an adequate level of data protection, such as the United States. The GDPR also permits data protection authorities to require destruction of improperly gathered or used personal information and/or impose substantial fines for violations of the GDPR, which can be up to 4% of global revenue or €20 million, whichever is greater, and it also confers a private right of action on data subjects and consumer associates to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. In addition, the GDPR provides that EU member states may make their own further laws and regulations limiting the processing of personal data, including genetic, biometric or health data. Given the breadth and depth of changes in data protection obligations, preparing for and complying with these requirements is rigorous and time intensive and requires significant resources and a review of our technologies, systems and practices, as well as those of any third-party collaborators, service providers, contractors or consultants that process or transfer personal data collected in the European Union.

Similar actions are either in place or underway in the United States. For example, the California Consumer Privacy Act of 2018 (the “CCPA”) applies to personal information of consumers, business representatives, and employees, and requires covered businesses to provide specific disclosures related to a business’s processing of personal data, new operational practices, and requirements to respond to certain requests from California residents related to their personal data. There is uncertainty about how the CCPA and other similar laws may be implemented and applied, and inconsistencies across jurisdictions complicate our compliance efforts. Accordingly, the CCPA and other similar laws may impact our business activities and increase our compliance costs, as well as our legal risks. The regulatory framework for the collection, use, safeguarding, transfer and other processing of information is rapidly evolving and is likely to remain uncertain for the foreseeable future.

Evolving data privacy regulations may interrupt or delay our development, regulatory and commercialization activities and increase our cost of doing business, and could lead to government enforcement actions, private litigation and significant fines and penalties against us and could have a material adverse effect on our business, financial condition or results of operations. Even if we are not determined to have violated these laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity, which could harm our reputation and our business.

We will also need to expend a considerable amount of resources complying with other federal, state and foreign laws and regulations. If we are unable to comply or have not complied with such laws, we could face substantial penalties or other adverse actions.

Our operations are subject, directly or indirectly, to other federal, state and foreign laws and regulations that are complex and their application to our specific products, services and relationships may not be clear and may be applied to our business in ways that we do not anticipate. Compliance with laws and regulations will require us to expend considerable resources implementing internal policies and procedures for compliance and ongoing monitoring and will require significant attention of our management team. This will be challenging as an early-stage company with limited financial resources and human capital. These laws include, for example:

Many states and foreign governments have adopted similar laws and regulations. Violations of law could subject us to civil or criminal penalties, monetary fines, disgorgement, individual imprisonment, contractual damages, reputational harm, diminished profits and future earnings and curtailment of our operations. We could also be required to change or terminate some portions of operations or business or could be disqualified from providing services to healthcare providers doing business with government programs.

Risks Relating to Our Common Stock

Provisions in our corporate charter documents and under Delaware law could make an acquisition of our company, which may be beneficial to our stockholders, more difficult and may prevent attempts by our stockholders to replace or remove our current management.

Provisions in our certificate of incorporation and our bylaws may discourage, delay or prevent a merger, acquisition or other change in control of our company that stockholders may consider favorable, including transactions in which you might otherwise receive a premium for your shares. These provisions could also limit the price that investors might be willing to pay in the future for shares of our common stock, thereby depressing the market price of our common stock. In addition, because our board of directors will be responsible for appointing the members of our management team, these provisions may frustrate or prevent any attempts by our stockholders to replace or remove our current management by making it more difficult for stockholders to replace members of our board of directors. Among other things, these provisions:

Moreover, we are governed by the provisions of Section 203 of the Delaware General Corporation Law, which prohibits a person who owns in excess of 15% of our outstanding voting stock from merging or combining with us for a period of three years after the date of the transaction in which the person acquired in excess of 15% of our outstanding voting stock, unless the merger or combination is approved in a prescribed manner.

Any of these provisions of our charter documents or Delaware law could, under certain circumstances, depress the market price of our common stock.

The price of our common stock may be volatile and fluctuate substantially, which could result in substantial losses for purchasers of our common stock or could subject us to securities litigation.

Our stock price may be extremely volatile. The stock market in general and the market for smaller medical technology companies in particular have experienced extreme volatility that has often been unrelated to the operating performance of particular companies. As a result of this volatility, investors may not be able to sell our common stock at or above the price they paid for such stock. The market price for our common stock may be influenced by many factors, including:

Additionally, companies that have experienced volatility in the market price of their stock have been subject to an increased incidence of securities class action litigation. We may be the target of this type of litigation in the future. Securities litigation against us could result in substantial costs and divert our management’s attention from other business concerns, which could seriously harm our business.

Future sales of shares of our common stock, including by us and significant stockholders, could negatively affect our stock price.

Sales of a substantial number of shares of our common stock in the public market could occur at any time. Since December 2022, we have issued 1,034,500 shares of common stock pursuant to equity financing arrangements, including pursuant to our Open Market Sale Agreement^SM with Jefferies LLC, as agent, pursuant to which we may offer and sell, from time to time, through Jefferies, shares of our common stock having an aggregate offering price of up to $50,000,000. At December 31, 2023, $29.8 million of common stock remains available for sale under the Jefferies agreement. We may enter into additional equity financing arrangements in the future. The shares of common stock that we have issued pursuant to equity financings, or may issue in the future, may be resold at any time in the discretion of the investors.

In addition, an aggregate of 21,552,860 shares of common stock are issuable upon conversion or exercise of currently outstanding preferred stock and financing warrants, subject to certain beneficial ownership limitations, which the investors may subsequently resell into the market, and 2,815,392 shares of common stock are issuable upon exercise of awards granted under our 2017 Stock Incentive Plan and 2012 Equity Incentive Plan. Under our Innovatus Loan Agreement, Innovatus also has the right, at its election, to convert up to $6.6 million of outstanding principal of our Innovatus loans into common stock at a price of $10.00 per share. Based on our outstanding principal as of March 27, 2024, Innovatus has the right to acquire 300,000 shares of common stock pursuant to this provision.

Sales of substantial amounts of shares of our common stock or other securities by these investors or our other stockholders or by us under the Open Market Sale Agreement^SM, or the perception in the market that the holders of a large number of shares of our common stock intend to sell their shares, could reduce the trading price of our common stock, make it more difficult for you to sell your shares at a price that you desire and impair our ability to raise capital through the sale of equity or equity-related securities.

Our Series A Preferred Stock has rights, preferences, and privileges that are not held by, and are preferential to, the rights of holders of our common stock.

We issued 1,120,873 shares of Series A Preferred Stock in a financing transaction in December 2022, and 854,134 shares of Series A Preferred Stock were outstanding as of December 31, 2023. The Certificate of Designations of Preferences, Rights and Limitations of Series A Convertible Preferred Stock provides that, in the event of any voluntary or involuntary liquidation, dissolution or winding up of the Company, or in the event of a Deemed Liquidation Event (as defined in the Certificate of Designations of Preferences, Rights and Limitations of Series A Convertible Preferred Stock), the holders of Series A Preferred Stock are entitled to be paid from assets of the Company available for distribution to its stockholders, before any payment is made to the holders of common stock by reason of their ownership thereof, an amount per share equal to the greater of (i) the original issue price ($5.75 on an as-converted-to-common stock basis), plus all accrued and unpaid dividends and (ii) the amount that the holder would have been entitled to receive at such time if the Series A Preferred Stock were converted into common stock. The Company may not, without the consent of holders of a majority of the outstanding shares of Series A Preferred Stock, amend its charter in a manner that adversely affects the powers, preferences or rights of the Series A Preferred Stock or issue or obligate itself to issue shares of any additional class or series of capital stock unless the same ranks junior to the Series A Preferred Stock with respect to the distribution of assets on the liquidation, dissolution or winding up of the Company and the payment of dividends.

If securities or industry analysts do not publish research or reports about our business, or publish negative reports about our business, our stock price and trading volume could decline.

The trading market for our common stock depends in part on the research and reports that securities or industry analysts publish about us or our business. We do not have any control over these analysts. There can be no assurance that analysts will cover us or provide favorable coverage. If one or more of the analysts who cover us downgrade our stock or change their opinion of our stock, our stock price would likely decline. If one or more of these analysts cease coverage of our company or fail to regularly publish reports on us, we could lose visibility in the financial markets, which could cause our stock price or trading volume to decline.

We incur increased costs as a result of operating as a public company, and our management devotes substantial time to new compliance initiatives and corporate governance practices.

As a public company, we incur significant legal, accounting and other expenses that we did not incur as a private company and that private company competitors do not incur. The Sarbanes-Oxley Act, the Dodd-Frank Wall Street Reform and Consumer Protection Act, the continued listing requirements of The Nasdaq Stock Market and other applicable securities rules and regulations impose various requirements on public companies, including establishment and maintenance of effective disclosure and financial controls and corporate governance practices. Our management and other personnel devote a substantial amount of time to these compliance initiatives. Our management and other personnel will need to devote a substantial amount of time to these compliance initiatives. Moreover, these rules and regulations have increased our ongoing legal and financial compliance costs and make some activities more time-consuming and costly.

Pursuant to Section 404 of the Sarbanes-Oxley Act, or Section 404, we are required to furnish a report by our management on our internal control over financial reporting. Depending upon our filer status, we could also be required to include an attestation report on internal control over financial reporting issued by our independent registered public accounting firm as required by Section 404(b). Depending upon our filer status, if we cease to be an emerging growth company, we could also be required to include an attestation report on internal control over financial reporting issued by our independent registered public accounting firm as required by Section 404(b). While we, as of December 31, 2023, concluded that our internal control over financial reporting was effective, we may need to dedicate additional internal resources and engage outside consultants to maintain compliance with Section 404 in the future. Any material weaknesses that we may identify in the future could result in an adverse reaction in the financial markets due to a loss of confidence in the reliability of our financial statements.

ITEM 1B. Unresolved Staff Comments

None.

ITEM 1C. Cybersecurity

Risk Management and Strategy

Our cybersecurity risk management process is a component of our overall approach to managing material risks that could impact our operations, including cybersecurity threats. In general, we seek to manage material internal and third-party cybersecurity risks through an approach that focuses on: (i) protecting information systems and the information residing therein; (ii) identifying, preventing, and mitigating cybersecurity threats; and (iii) assessing and responding to cybersecurity incidents when they occur. Maintaining, monitoring, and updating our information security program—in an effort to ensure that it remains reasonable and appropriate in light of changes in the security threat landscape, available technology, and applicable legal and contractual requirements—is an ongoing effort.

We have implemented and maintain various processes, procedures, and measures to support our overall risk management strategy and to manage and mitigate the material risks posed by cybersecurity threats to our systems and data. With respect to cybersecurity, these measures include conducting risk assessments of our operations and using a risk register to assess identified risks; developing business continuity, disaster recovery and incident response plans; implementing technical safeguards and tools; conducting ongoing cybersecurity awareness training; and using contractual protections where appropriate. Our incident response plan outlines the procedures for reporting, investigating, and remediating cybersecurity incidents, including a framework to facilitate the escalation to our management team and board of cybersecurity incidents, so that our management team is alerted in a timely manner to material information that would be required to be disclosed or reported.

Our Chief Financial Officer works with our IT Director regarding incident prevention and response, as well as disclosure determinations, and is accountable at the management level for our overall risk management program. She receives information about cybersecurity from our IT Director to consider as part of that program. Additionally, our Chief Executive Officer receives updates from the Chief Financial Officer and IT Director about significant threats and incidents involving cybersecurity and data protection.

We use third-party service providers for a variety of services throughout our business, ranging from infrastructure support and maintenance, cybersecurity incident response, data protection and privacy compliance. In addition, we engage with contract research organizations, contract manufacturing organizations, distributors, and other supply chain resources.

We believe that the use of external service providers improves our operational capabilities, and we have implemented a vendor qualification and management program that applies to our service providers that handle protected health information, personal information, or other information subject to protection under applicable privacy and data protection regulations. This program is designed to address and mitigate cybersecurity and data protection risks that arise from our use of such service providers. We do not have full visibility into the cybersecurity risk management processes of our service providers. We rely on our third-party service providers to provide notification of, and remediate, significant cybersecurity threats and cybersecurity incidents that jeopardize the confidentiality, integrity, or availability of information that we own or use.

We periodically evaluate, test, and update our policies, standards, and processes to mitigate cybersecurity threats and manage incidents effectively. These efforts include risk assessments, vulnerability assessments and remediations, phishing tests and employee education, and external scans. Additionally, to enhance our capabilities, we periodically engage third-party service providers, including cybersecurity consultants, to incorporate threat intelligence into our processes.

As of the date of this Form 10-K, we are not aware of any risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents experienced by us or, to our knowledge, by any of our third-party service providers, that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. For further discussion of cybersecurity and data privacy risks that may materially affect the Company and how they may do so, see “Risk Factors—If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could face clinical trial delays; regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; and other adverse consequences,” included in Item 1A of this Annual Report on Form 10-K.

Governance

The Board oversees Celcuity’s management of risks arising from cybersecurity threats. Our management team is implementing processes for delivering periodic briefings to the Board on material cybersecurity risks that are pertinent to our business operations. Additionally, we have processes to promptly notify the Board of a significant cybersecurity incident and to inform the Board of remediation progress, as appropriate.

The IT Director has overall responsibility for our information security program, with support from our management team and specialized partners in cybersecurity incident response and privacy. The process includes managing our incident response strategy. If a cybersecurity incident meets certain criteria, however, our CEO and CFO will become involved with the response strategy, including decisions about public disclosure and reporting. Our IT Director also coordinates with our CEO and CFO to determine strategic cybersecurity priorities and to establish compliance procedures.

We believe our business leaders have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats. Our IT Director has served in various roles in information technology and information security for over a decade, which includes experience in the biotech, pharmaceutical and healthcare industries and experience in cybersecurity risk management and data privacy compliance.

In the ordinary course of our business, we, and the third parties upon which we rely, collect, process, receive, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, share and store (collectively, “process”) proprietary, confidential, and sensitive information, including protected health information, personal information, credit card and other financial information, or other sensitive information owned or controlled by ourselves or our customers, payors, and other parties.