If we fail to comply with data protection laws and regulations, we could be subject to government
enforcement actions, which could include civil or criminal penalties, as well as private litigation and/or adverse publicity, any of which could negatively affect our operating results and business.
We may be subject to laws and regulations that address privacy and data security of patients who use our products or product candidates in the
U.S. and in states in which we conduct our business. In the U.S., numerous federal and state laws and regulations, including state data breach notification laws, state health information privacy laws, and federal and state consumer protection laws
(e.g., Section 5 of the FTC Act) govern the collection, use, disclosure, and protection of health-related and other personal information. For instance, HIPAA imposes certain obligations, including mandatory contractual terms, with respect to
safeguarding the privacy, security and transmission of individually identifiable health information and imposes notification obligations in the event of a breach of the privacy or security of individually identifiable health information on entities
subject to HIPAA and their business associates that perform certain activities that involve the use or disclosure of protected health information on their behalf. Failure to comply with applicable data protection laws and regulations could result in
government enforcement actions and create liability for us, which could include civil and/or criminal penalties, as well as private litigation and/or adverse publicity that could negatively affect our operating results and business.
We may be exposed to liabilities under the FCPA and other U.S. and foreign anti-corruption anti-money laundering, export control,
sanctions, and other trade laws and regulations, and any determination that we violated these laws could have a material adverse effect on our business.
We are subject to export control and import laws and regulations, including the U.S. Export Administration Regulations, U.S. Customs
regulations, and various economic and trade sanctions regulations administered by the U.S. Treasury Departments Office of Foreign Assets Control. We are also subject to the FCPA, the U.S. domestic bribery statute contained in 18 U.S.C.
§ 201, the U.S. Travel Act, the USA PATRIOT Act, the United Kingdom Bribery Act 2010, the Proceeds of Crime Act 2002, and possibly other anti-bribery and anti-money laundering laws in countries outside of the U.S. in
which we conduct our activities. Anti-corruption laws are interpreted broadly and prohibit companies and their employees and third-party intermediaries from authorizing, promising, offering, providing, soliciting, or accepting,
directly or indirectly, improper payments or benefits to or from any person whether in the public or private sector. As we commercialize DEXYCU, if approved, YUTIQ, and any of other product candidates that we may develop, we may engage
with third-party manufacturers and collaborators who operate abroad and are required to obtain certain necessary permits, licenses and other regulatory approvals with respect to our business. Our activities abroad create the risk of
unauthorized payments or offers of payments by employees, consultants, sales agents or distributors, even though they may not always be subject to our control. It is our policy to implement safeguards to discourage these practices by our employees,
consultants, sales agents and distributors. However, our existing safeguards and any future improvements may prove to be less than effective, and the employees, consultants, sales agents, or distributors of our company may engage in conduct for
which we might be held responsible, even if we do not explicitly authorize such activities.
Noncompliance
with anti-corruption, anti-money laundering, export control, sanctions, and other trade laws could subject us to whistleblower complaints, investigations, sanctions, settlements, prosecution, other enforcement actions, disgorgement of
profits, significant fines, damages, other civil and criminal penalties or injunctions, suspension and/or debarment from contracting with certain persons, the loss of export privileges, reputational harm, adverse media coverage and other collateral
consequences. If any subpoenas or investigations are launched, or governmental or other sanctions are imposed, or if we do not prevail in any possible civil or criminal litigation, our business, results of operations and financial condition could be
materially harmed. Responding to any action will likely result in a materially significant diversion of managements attention and resources and significant defense and compliance costs and other professional fees. In addition, the U.S.
government may seek to hold us liable for successor liability FCPA violations committed by companies in which we invest or that we acquire. As a general matter, enforcement actions and sanctions could harm our business, results of operations, and
financial condition.
76