if We are not found liable, could be expensive and time consuming to defend, result in regulatory actions and proceedings, in addition to private claims and litigation, and could result in adverse publicity that could harm our business.
We also are, or may be asserted to be, subject to the terms of our external and internal privacy and security policies, representations, certifications, publications and frameworks and contractual obligations to third parties related to privacy, data protection, information security and processing. Failure to comply with any of these, or if any of these policies or any of our representations, certifications, publications or frameworks are, in whole or part, found or perceived to be inaccurate, incomplete, deceptive, unfair, or misrepresentative of its actual practices, could result in reputational harm; result in litigation; cause a material adverse impact to business operations or financial results; and otherwise result in other material harm to our business.
We depend on sophisticated information technology systems and data processing to operate its business. If we experience security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of its proprietary or confidential data, employee data or personal data, we may face costs, significant liabilities, harm to its brand and business disruption.
We rely on information technology systems and data processing that we or our service providers, collaborators, consultants, contractors or partners operate to collect, process, transmit and store electronic information in our day-to-day operations, including a variety of personal data, such as name, mailing address, email addresses, phone number and clinical trial information. Additionally, we, and our service providers, collaborators, consultants, contractors or partners, do or will collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect and share personal information, health information and other information to host or otherwise process some data and that of users, develop our products, to operate our business, for clinical trial purposes, for legal and marketing purposes, and for other business-related purposes. Our internal computer systems and data processing and those of our third-party vendors, consultants, collaborators, contractors or partners, including existing and future CROs may be vulnerable to a cyber-attack, malicious intrusion, breakdown, destruction, loss of data privacy, theft or destruction of intellectual property or other confidential or proprietary information, business interruption or other significant security incidents. As the cyber-threat landscape evolves, these attacks are growing in frequency, sophistication and intensity, and are becoming increasingly difficult to detect. In addition to traditional computer “hackers,” threat actors, software bugs, malicious code (such as viruses and worms), employee theft or misuse, denial-of-service attacks (such as credential stuffing), phishing and ransomware attacks, sophisticated nation-state and nation-state supported actors now engage in attacks (including advanced persistent threat intrusions). These risks may increase as a result of COVID-19, owing to an increase in personnel working remotely.
There can be no assurance that we, our service providers, collaborators, consultants, contractors or partners will be successful in efforts to detect, prevent, or fully recover systems or data from all breakdowns, service interruptions, attacks, or breaches of systems that could adversely affect our business and operations and/or result in the loss of critical or sensitive data. Any failure by us or our service providers, collaborators, consultants, contractors or partners to detect, prevent, respond to or mitigate security breaches or improper access to, use of, or inappropriate disclosure of any of this information or other confidential or sensitive information, including patients’ personal data, or the perception that any such failure has occurred, could result in claims, litigation, regulatory investigations and other proceedings, significant liability under state, federal and international law, and other financial, legal or reputational harm to us. Further, such failures or perceived failures could result in liability and a material disruption of our development programs and our business operations, which could lead to significant delays or setbacks in research, delays to commercialization of product candidates, lost revenues or other adverse consequences, any of which could have a material adverse effect on its business, results of operations, financial condition, prospects and cashflow. For example, the loss of clinical trial data from completed, ongoing, or future clinical trials could result in delays in our regulatory approval efforts and significantly increase costs to recover or reproduce the data.
34