Item 1A. Risk Factors.

Summary of Risk Factors

The following is a summary of the principal risks and uncertainties that could materially adversely affect our business, financial condition, or results of operations. You should read this summary together with the more detailed description of risk factors below under the heading “Risk Factors”.

Operational, Strategic and Business Risks

•

We have a history of losses and we expect to incur significant losses for the foreseeable future and may not be able to generate sufficient revenue to achieve or sustain profitability.

•

If we are unable to increase sales of our current services or successfully develop and commercialize other services or products, or if we are unable to execute our sales and marketing strategy for our services or unable to gain sufficient acceptance in the market, we may fail to generate sufficient revenue to achieve profitability and sustain our business.

•

We have substantial customer concentration, with a limited number of customers accounting for a substantial portion of our revenue and accounts receivable; in particular, we currently derive a substantial portion of our revenue from one of our largest customers, Natera, and in the past have derived a substantial portion of our revenue from another of our largest customers, the VA MVP.

•

When we grow our business by developing in vitro diagnostic tests, we may be subject to reimbursement challenges.

•

We rely on a limited number of suppliers, or in some cases, a sole supplier, for some laboratory instruments and materials, and we may not be able to replace or immediately transition to alternative suppliers should we need to do so.

•

If our facilities become damaged or inoperable, or we are required to vacate the facilities, our ability to sell and provide our services and pursue our research and development efforts may be jeopardized.

•

If we cannot develop services and products to keep pace with rapid advances in technology, medicine, and science our operating results and competitive position could be harmed.

•

Personalized cancer therapies represent new therapeutic approaches that could result in heightened regulatory scrutiny, delays in clinical development, or delays in or inability to achieve regulatory approval, commercialization, or payor coverage, any of which could adversely affect our business.

•

The loss of key members of our executive management team or the inability to hire, retain, or motivate highly skilled personnel could adversely affect our business.

•

We may not be able to manage our future growth effectively, which could make it difficult to execute our business strategy.

•

We may acquire businesses or assets, form joint ventures, or make investments in other companies or technologies that could harm our operating results, dilute stockholders’ ownership, or cause us to incur debt or significant expense.

Regulatory, Legal and Cybersecurity Risks

•

Complying with numerous statutes and regulations pertaining to our business is an expensive and time-consuming process, and we may be subject to regulatory action if we or our service or product offerings do not comply with applicable requirements.

•

Our internal information technology systems, or those of our third-party vendors, contractors, or consultants, may fail or suffer security breaches, loss or leakage of data, and other disruptions, which could adversely affect our business.

•

Failure or perceived failure to comply with existing or future laws, regulations, contracts, self-regulatory schemes, standards, and other obligations related to data privacy and security (including security incidents) could harm our business. Compliance or the actual or perceived failure to comply with such obligations could increase the cost of our offerings, limit their use or adoption, and otherwise negatively affect our operating results and business.

•

Our employees may engage in misconduct or other improper activities, such as noncompliance with regulatory standards and requirements, including the Foreign Corrupt Practices Act of 1977 and other anti-bribery laws, which could cause significant liability for us and harm our reputation.

•

Changes in health care policy could increase our costs, decrease our revenue, and impact sales of and reimbursement for our tests. When we grow our business by developing in vitro diagnostic tests, we may be subject to reimbursement challenges.

Intellectual Property Risks

•

Litigation or other proceedings or claims of intellectual property infringement, misappropriation, breach of license terms or other violations may require us to spend significant time and money, including damages, and could prevent us from selling our tests.

•

If we cannot license rights to use necessary technologies on reasonable terms, we may not be able to commercialize new services and products.

Table of Contents

•

If we are not able to obtain, maintain and enforce patent protection for our products, services or technologies, our competitors and other third parties could develop and commercialize products, services and technologies similar or identical to ours, and our ability to successfully commercialize our products, services, and technologies may be adversely affected.

•

If we are unable to protect the confidentiality of our trade secrets and know-how, our business would be harmed.

•

Our use of “open source” software could subject our proprietary software to general release, adversely affect our ability to sell our products and services, and subject us to possible litigation.

•

If our trademarks and trade names are not adequately protected, then we may not be able to build name recognition in our markets of interest and our business may be adversely affected.

Financial and Market Risks and Risks Related to Owning Our Common Stock

•

Our inability to raise additional capital on acceptable terms in the future may limit our ability to continue to operate our business and further expand our operations.

•

The market price of our common stock may be volatile or may decline steeply or suddenly regardless of our operating performance, we may not be able to meet investor or analyst expectations, and you may lose all or part of your investment.

•

Our quarterly results may fluctuate significantly, which could adversely impact our common stock’s value.

•

Insiders may exercise significant control over our company and will be able to influence corporate matters.

•

Future sales of shares by existing stockholders, or the perception that such sales could occur, could cause the stock price of our common stock to decline.

•

We do not currently intend to pay dividends on our common stock and, consequently, your ability to achieve a return on your investment will depend on appreciation of the value of our common stock.

•

If securities or industry analysts do not publish research or reports about our business, or publish inaccurate or unfavorable research about our business, our stock price and trading volume could decline.

•

Delaware law and provisions in our amended and restated certificate of incorporation and amended and restated bylaws could make a merger, tender offer, or proxy contest difficult, thereby depressing the trading price of our common stock; our amended and restated certificate of incorporation has an exclusive forum provision, which could limit our stockholders’ ability to obtain a favorable judicial forum for disputes with us or our directors, officers, or employees.

•

Our disclosure controls and procedures may not prevent or detect all errors or acts of fraud.

Table of Contents

Risk Factors.

Our operations and financial results are subject to various risks and uncertainties including those described below. You should consider carefully the risks and uncertainties described below, in addition to other information contained in this Annual Report on Form 10-K, including our audited consolidated financial statements and related notes. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, may also become important factors that adversely affect our business. If any of the following risks or others not specified below materialize, our business, financial condition, and results of operations could be materially and adversely affected. In that case, the trading price of our common stock could decline.

Operational, Strategic and Business Risks

We have a history of losses and we expect to incur significant losses for the foreseeable future and may not be able to generate sufficient revenue to achieve or sustain profitability.

We have incurred net losses since our inception. For the years ended December 31, 2023, 2022, and 2021 we had net losses of $108 million, $113 million and $65 million, respectively. As of December 31, 2023, we had an accumulated deficit of $469 million. To date, we have not generated sufficient revenue to achieve profitability, and we may never achieve or sustain profitability. In addition, we expect to continue to incur net losses for the foreseeable future, and we expect our accumulated deficit to continue to increase as we focus on scaling our business and operations. Our efforts to sustain and grow our business may be more costly than we expect, and we may not be able to increase our revenue sufficiently to offset our higher operating expenses. Our prior losses and expected future losses have had and will continue to have an adverse effect on our stockholders’ equity and working capital. Our failure to achieve and sustain profitability in the future would negatively affect our business, financial condition, results of operations, and cash flows, and could cause the market price of our common stock to decline.

We currently derive substantially all of our revenue from sales of our services. We began offering our services through our CLIA-certified, CAP-accredited, and state-licensed laboratory in 2013. We are in varying stages of research and development for other services and products that we may offer. If we are unable to increase sales of our existing services or successfully develop and commercialize other services and products, we will not generate sufficient revenue to become profitable.

In addition, as a growing genomics company, we have engaged in targeted sales and marketing activities for our services. Although we have had revenue from sales of our services since 2013, our services may never gain significant acceptance in the marketplace and therefore may never generate substantial revenue or permit us to become profitable. We will need to further establish and grow the market for our services through the expansion of our current relationships and development of new relationships with biopharmaceutical customers and through gaining acceptance in medical communities. Gaining acceptance in medical communities can be supported by, among other things, publications in leading peer-reviewed journals of results from studies using our services. The process of publication in leading medical journals is subject to a peer review process and peer reviewers may not consider the results of our studies sufficiently novel or worthy of publication. Failure to have our studies published in peer-reviewed journals would limit the adoption of our services.

Our ability to successfully market our services that we have developed, and may develop in the future, will depend on numerous factors, including:

•

our ability to demonstrate the utility and value of our services to our customers and potential customers;

•

the success of our commercial team, including sales and business development personnel;

•

the recruitment, hiring, and retention of our commercial team personnel;

•

whether our customers and potential customers accept that our services are sufficiently sensitive and specific;

•

our ability to educate our customers and potential customers of the utility of the comprehensiveness of our services and of testing patients at multiple time points;

•

our ability to continue to fund sales and marketing activities;

•

whether our services are considered superior to those of our competitors;

•

any negative publicity regarding our or our competitors’ services resulting from defects or errors;

•

our success obtaining and maintaining patent and trade secret protection for our services and technologies; and

•

our success enforcing and defending intellectual property rights and claims.

Failure to achieve broad market acceptance of our services would materially harm our business, financial condition, and results of operations.

Table of Contents

If we cannot compete successfully with our competitors, we may be unable to increase or sustain our revenue or achieve and sustain profitability.

Our principal competition comes from commercial and academic organizations using established and new laboratory tests to produce information that is similar to the information that we generate for our customers. These commercial and academic organizations may not utilize our services or may not believe them to be superior to those tests that they currently use or others that are developed. Further, it may be difficult to educate our customers and potential customers on the benefits of our comprehensive tests compared to simpler panels provided by our competitors. For example, the information that we provide may be more challenging or require additional resources for our customers to interpret than the information provided by our competitors’ less comprehensive assays. In addition, our suppliers or competitors may announce the development of new products, services or features that results in our customers’ or potential customers’ decision to reduce, postpone or cancel orders from us while they wait to determine which products, services or features are or will be perceived as technologically superior, more commercially successful or adopted as standards in the industry; such decisions by our customers or potential customers may be influenced by their concerns regarding the potential obsolescence of data generated using our services and features if our services or features are or will not be perceived as technologically superior, commercially successful or adopted as standards in the industry.

Some of our present or potential competitors, including Adela, Inc., BostonGene Corporation, Caris Life Sciences, Inc., Foresight Diagnostics Inc. (“Foresight”), Freenome, Inc., Fulgent Genetics, Inc., Geneseeq Technology Inc., GRAIL, Guardant Health, Inc., Haystack Oncology, Inc., which was acquired by Quest Diagnostics Incorporated in June 2023, Invitae Corporation, MedGenome Inc., Myriad Genetics, Inc., Natera, NeoGenomics, Inc., Novogene Corporation, Predicine, Inc., Roche Molecular Systems, Inc., Tempus, Inc., and Veracyte, Inc. may have more widespread brand recognition or substantially greater financial or technical resources, development or production capacities, or marketing capabilities than we do. They may be able to devote greater resources to the development, promotion and sale of their products and services than we do or sell their products and services at prices designed to win more significant levels of market share. Also, we have had, and may have in the future, customer or supply relationships with our present or potential competitors. For example, we have an agreement with Natera to provide advanced tumor analysis for use in Natera’s MRD testing offerings. During the year ended December 31, 2023, revenue under our agreement accounted for 43% of our total revenue. See “—We currently derive a substantial portion of our revenue from DNA sequencing and data analysis services that we provide to Natera. If Natera’s demand for our DNA sequencing and data analysis services were to be substantially reduced, our business, financial condition, revenue and other operating results, and cash flows may be materially harmed.” In addition, our present or potential competitors may be acquired by, receive investments from, or enter into other commercial relationships with larger, more well-established and well-financed companies. Others may develop lower-priced, less complex products and services that pharmaceutical companies could view as functionally equivalent to our current or planned future services, which could force us to lower the price of our services and impact our operating margins and our ability to achieve and maintain profitability. In addition, companies or governments that control access to genetic testing and related services through umbrella contracts or regional preferences could promote our competitors or prevent us from performing certain services. In addition, technological innovations that result in the creation of enhanced products or diagnostic tools that are more sensitive or specific than ours may enable other clinical laboratories, hospitals, physicians, or medical providers to provide specialized products or services similar to ours in a more patient-friendly, efficient, or cost-effective manner than is currently possible. If we cannot compete successfully against current or future competitors, or if we cannot maintain successful customer or supply relationships with Natera, Illumina or other present or potential competitors, we may be unable to ensure or increase market acceptance and sales of our current or planned future services, which could prevent us from increasing or sustaining our revenue or achieving or sustaining profitability.

We expect that biopharmaceutical companies will increasingly focus attention and resources on the targeted and personalized cancer diagnostic sector as the potential and prevalence of molecularly targeted oncology therapies approved by the FDA along with companion diagnostics increases. For example, the FDA has approved several such targeted oncology therapies that use companion diagnostics, including the anaplastic lymphoma kinase FISH test from Abbott Laboratories, Inc. for use with Xalkori® from Pfizer Inc., the BRAF kinase V600 mutation test from Roche Molecular Systems, Inc. for use with Zelboraf® from Daiichi-Sankyo/Genentech/Roche, and the BRAF kinase V600 mutation test from bioMerieux for use with Tafinlar® from GlaxoSmithKline. Since companion diagnostic tests are part of FDA labeling, non-FDA cleared tests, such as the ones we currently offer as part of our services, would be considered an off-label use and this may limit our access to this market segment. Our customers and potential customers may request, or in some cases have requested, that we consider developing and seeking FDA approval for companion diagnostic tests to accompany those customers’ therapeutic product candidates, and it may be necessary for us to do so in order to successfully compete for the business of these customers. If we do not successfully develop FDA-approved companion diagnostics, we may be at a competitive disadvantage and may be unable to increase market acceptance and sales of our other service or product offerings, which would prevent us from increasing or sustaining our revenue or achieving or sustaining profitability. If we were to develop one or more FDA-approved companion diagnostics, we would incur increased research and development expenses, and such activities may also divert our resources or the attention of our management and may create competing internal priorities for us. In addition, we have limited experience developing diagnostics, have never developed an FDA-approved companion diagnostic, and may be unable to successfully compete against companies with more experience developing and commercializing companion diagnostics.

Additionally, projects related to cancer diagnostics and particularly genomics have received increased government funding, both in the United States of America (the “U.S.”) and internationally. As more information regarding cancer genomics becomes available to the public, we anticipate that more products and services aimed at identifying treatment options will be developed and that these products and services may compete with our services. In addition, competitors may develop their own versions of our current or planned future services and products in countries where we did not apply for or receive patents and compete with us in those countries, including encouraging the use of their products or services by biopharmaceutical companies in other countries.

Table of Contents

Like other genomic profiling companies that sell to the pharmaceutical industry, we have substantial customer concentration. We currently derive a significant portion of our revenue from Natera, which accounted for 43%, 41%, and 10% of our revenue for the years ended December 31, 2023, 2022, and 2021, respectively. We previously derived a significant portion of our revenue from the VA MVP, which more recently accounted for 13%, 13%, and 53% of our revenue for the years ended December 31, 2023, 2022, and 2021, respectively. Our top five customers, including the VA MVP and Natera, accounted for 74%, 76% and 84% of our revenue for the years ended December 31, 2023, 2022 and 2021, respectively. There are inherent risks whenever a large percentage of revenue is concentrated with a limited number of customers. While we have attempted to grow our customer base and diversify our revenue concentration beyond the VA MVP and Natera, we may not be able to successfully do so in the future. Our predictions regarding the future level of demand for our services that will be generated by these customers may be wrong. In addition, revenue from our larger customers have historically fluctuated and may continue to fluctuate based on the commencement and completion of clinical trials or other projects, the timing of which may be affected by market conditions or other factors, some of which may be outside of our control. Some of our customers have in the past suspended or terminated clinical trials or projects, received less funding than expected, experienced declining or delayed sales, or otherwise decided to reduce or eliminate their use of our services, and these and other customers may also do so in the future. As a result, we could be pressured to reduce the prices we charge for our services, which would have an adverse effect on our margins and financial position, and which would likely negatively affect our revenue and results of operations. In particular, if we do not win future VA MVP renewals with a value comparable to that of our historical contracted orders, it may have a material adverse effect on our revenue, cash position, and results of operations. Similarly, if the VA MVP was eliminated, awarded its contract to one of our competitors, further reduced the size of our contract or failed to renew our contract in the future, then our revenue, cash position, and results of operations would be materially adversely impacted. Likewise, if Natera or any of our other significant customers were to reduce or cease their use of our services, then our revenue, cash position, and results of operations may be materially adversely impacted. Further, if any of our significant customers were to stop payment for our services, it would have a material adverse effect on our accounts receivable, increasing our credit risk. The failure of these customers to pay their balances, or any customer to pay future outstanding balances, would result in an operating expense and reduce our cash flows.

We currently derive a substantial portion of our revenue from DNA sequencing and data analysis services that we provide to Natera. If Natera’s demand for our DNA sequencing and data analysis services were to be substantially reduced, our business, financial condition, revenue and other operating results, and cash flows may be materially harmed.

In February 2021, we entered into a partnership in the field of personalized oncology with Natera, pairing our NeXT tumor profiling and diagnostic services and products with Natera’s personalized ctDNA platform SignateraTM for treatment monitoring and MRD assessment. Under this non-exclusive agreement, Natera is responsible for validating the design of, and commercialization of, Signatera personalized ctDNA assays using matched tumor and normal exome sequence data from us. The agreement covers MRD testing for both clinical use and research use. Since that time, Natera’s sample volumes have increased such that we currently derive a significant portion of our revenue from sales of our DNA sequencing and data analysis services to Natera under our agreement. For example, in 2023, revenue under our agreement accounted for 43% of our total revenue. In November 2023, we amended our agreement to extend minimum volume commitments through the end of 2024. We are aware that Natera has at least one third party supplier of DNA sequencing and analysis services, such that Natera has elected, and may continue to elect in the future, to send a portion (or all) of its samples to its other supplier(s) instead of us, which it is not contractually prohibited from doing, given the non-exclusive nature of our agreement. Natera may also bring a portion (or all) of such services in-house in the future, which may result in them purchasing fewer (or no) such services from us, or none from us at all. Our agreement with Natera requires us to achieve certain quality and turnaround time metrics for Natera samples. Recently, the volumes of samples sent to us by Natera have fluctuated significantly and may continue to do so in the future, which could cause us to experience difficulty in achieving such metrics from time to time, or to meet our other obligations under our agreement. If we consistently fail to achieve such metrics, or any of our other obligations under our agreement with Natera, Natera may elect to send a portion (or all) of its samples to its other supplier(s) and/or bring such services in-house.

Additionally, Natera may allege that such failures to achieve the required metrics are a breach of our agreement and seek to terminate our agreement and/or pursue any remedies available to it under the agreement, at law or in equity. Relatedly, we have incurred expenses in connection with our scale-up activities under our agreement with Natera, and we may incur additional expenses to increase our laboratory’s capacity to process increased sample volumes from Natera, in addition to those from our other customers, in the future. Our activities under our agreement with Natera have had, and may continue to have, an impact on our business, including diversion of our resources and the attention of our management, including with respect to our internal research and development objectives and projects for our other customers, collaborators and/or partners. If we are unable to successfully increase our laboratory’s capacity and manage any such competing objectives and/or projects for other customers, we may be unable to meet the quality and timing requirements of our agreement with Natera or our other customers, collaborators and/or partners. We may also be unable to successfully research, develop, launch and/or commercialize our services or service capabilities. Furthermore, our NeXT Personal test is a next-generation, tumor-informed liquid biopsy assay designed to detect and quantify MRD and recurrence in patients previously diagnosed with cancer. If NeXT Personal or any of our other services is seen as competing with Signatera or any of Natera’s other services, we will still be required to fulfill our obligations to Natera under our agreement, although Natera may elect to send a portion (or all) of its samples to its other supplier(s) and/or bring such services in-house. If the volume of samples received under our agreement with Natera were to be significantly reduced or eliminated, or if our agreement with Natera were to be terminated, for these or other reasons, or if we are

Table of Contents

unable to successfully research, develop, launch and/or commercialize our services or service capabilities, including NeXT Personal, our business, financial condition, revenue and other operating results, and cash flows may be materially harmed.

We have derived a substantial portion of our current revenue from DNA sequencing and data analysis services that we provided to one of our largest customers, the VA MVP. If the VA MVP’s demand for and/or funding for our DNA sequencing and data analysis services continues to be substantially reduced, or if our new contract with the VA MVP were to be terminated, our business, financial condition, revenue and other operating results, and cash flows will be materially harmed.

We have derived a substantial portion of our revenue from sales of our DNA sequencing and data analysis services to the VA MVP. In September 2017, we entered into a one-year contract with three one-year optional renewal periods with the VA for the VA MVP, pursuant to which we received contracted orders from the VA MVP in September 2017, 2018, 2019, 2020, and 2021. In September 2022, we entered into a new contract with the VA MVP to continue providing them WGS services and received an initial task order with a value of up to $10.0 million. The performance period under the new contract includes a base period of one year, with four one-year renewal option periods that may be exercised upon discretion of the VA MVP. In August 2023, we received notice of the VA MVP's intention to exercise its first renewal option period and received a second task order with a value of up to $7.5 million, subject to the receipt of samples from the VA MVP. There is no guarantee that the VA MVP will exercise any subsequent renewal option.

The VA MVP’s contracted orders for DNA sequencing and data analysis services have fluctuated significantly in value over time and are subject to the availability of funding, enrollment of veterans in the VA MVP study, and the VA MVP’s continued demand, if any, for our services among other factors. For example, the VA MVP contracted order received in September 2020 had a value of $30.9 million, whereas the VA MVP contracted orders received in September 2021, 2022, and 2023 had values of $9.7 million, $10.0 million, and $7.5 million, respectively, which represents a substantial decline. We have no certainty that funding will be made available for our services, or that the VA MVP will award any future contracts, contract renewals or contracted orders to us. The priorities of the VA, the VA MVP, or the U.S. government may change, including in response to a health epidemic or pandemic. For example, funding for our services may be limited or not available, and our business, financial condition, and operating results and cash flows will be materially harmed. Similarly, if we do not win future VA MVP contracts and renewals (whether due to being outbid by a competitor or the VA MVP’s decision not to award a future contract on a timely basis or at all, or to terminate for convenience or failure to renew any contract, for whatever reason) with a value comparable to that of our historical contracted orders, our business, financial condition, revenue and other operating results and cash flows may be materially harmed.

We have only recognized revenue under our VA MVP contract upon the receipt and processing of samples, and the timing and number of VA MVP samples we have received has been and could in the future be negatively affected by factors beyond our control, which has resulted, and may result in the future, in delaying our ability to process and recognize revenue for such samples. For example, the revenue we recognized during the contract year that began in September 2020 significantly exceeded the value of the VA MVP contracted order we received in September 2020 because we continued to receive after such date, and subsequently processed, samples under VA MVP contracted orders that remained unfulfilled as of September 2020 due to the time required for the VA to select optimal samples from its collection for research and then provide us those samples. Therefore, period-to-period comparisons of our operating results relating to VA MVP contracted orders may not be meaningful. The timing and number of VA MVP samples may also be negatively affected by a public health crisis. For example, in March 2020, the VA MVP announced that it was suspending sample collection due to the COVID-19 pandemic. In addition, we believe the COVID-19 pandemic may have been a contributing factor to the reduction in values of the September 2021 and 2022 VA MVP contracted orders compared to the September 2020 contracted order, as the VA MVP delayed new enrollment and also may have needed to divert resources to respond to the pandemic. A health epidemic or pandemic may negatively impact the value of any potential new VA MVP contract or order.

If we cannot maintain our current customer relationships, or fail to acquire new customers, our revenue prospects will be reduced. Many of our customers are biopharmaceutical companies engaged in clinical trials of new drug candidates, which trials are expensive, can take many years to complete, and have inherently uncertain outcomes.

Our customers other than the VA MVP and Natera are primarily biopharmaceutical companies that use our services to support clinical trials. Our future success is substantially dependent on our ability to maintain our customer relationships and to establish new ones. Many factors have the potential to impact our customer relations, including the type of support our customers and potential customers require and our ability to deliver it, our customers’ satisfaction with our services, and other factors that may be beyond our control. Furthermore, our customers may decide to decrease or discontinue their use of our services due to changes in research and product development plans (including as a result of a public health crisis), failures in their clinical trials (which failures are statistically much more likely to occur than not at some point in the clinical development process, notwithstanding any enhanced patient stratification from the use of our proprietary tests and algorithms), financial constraints, or utilization of internal testing resources or tests performed by other parties, or other circumstances outside of our control.

We engage in conversations with customers regarding potential commercial opportunities on an ongoing basis in the event that one of these customers’ drug candidates is approved. There is no assurance that any of these conversations will result in a commercial agreement, or if an agreement is reached, that the resulting relationship will be successful or that clinical studies conducted as part of the engagement will produce successful outcomes. Speculation in the industry about our existing or potential relationships with biopharmaceutical companies could be a catalyst for adverse speculation about us, our services, and our technology, which can adversely affect our reputation and our business. In addition, the termination of these relationships could result in a temporary or permanent loss of revenue.

Table of Contents

Our customers’ clinical trials are expensive, can take many years to complete, and their outcome is inherently uncertain. Failure can occur at any time during the clinical trial process. Product candidates in later stages of clinical trials may fail to show the desired safety and efficacy traits despite having progressed through pre-clinical studies and early clinical trials. Many of the biopharmaceutical companies that are our customers do not have products approved for commercial sale and are not profitable. These customers must continue to raise capital in order to continue their development programs and to potentially continue as our customers. If our customers’ clinical trials fail or they are unable to raise sufficient capital to continue investing in their clinical programs, our revenue from these customers may decrease or cease entirely, and our business may be harmed. Furthermore, even if these customers have a drug approved for commercial sale, they may not choose to use our services as a companion diagnostic with their drug, thereby limiting our potential revenue.

When we grow our business by developing in vitro diagnostic tests, we may be subject to reimbursement challenges.

The coverage and reimbursement status of newly-approved or cleared laboratory developed tests, including our NeXT Dx and NeXT Personal Dx products, is uncertain. We are seeking reimbursement for our NeXT Dx and NeXT Personal Dx tests, and other in vitro diagnostic tests we may develop, and if such tests are inadequately covered by insurance or ineligible for such reimbursement, this could limit our ability to derive revenue from any such current or future tests. The commercial success of current or future services and products in both domestic and international markets may depend in part on the availability of coverage and adequate reimbursement from third-party payors, including government payors, such as the Medicare and Medicaid programs, or equivalent foreign programs, managed care organizations, and other third-party payors. The government and other third-party payors are increasingly attempting to contain health care costs by limiting both insurance coverage and the level of reimbursement for new diagnostic tests. As a result, they may not cover or provide adequate payment for any current or future in vitro diagnostic tests that we develop. These payors may conclude that our services or products are less safe, less effective, or less cost-effective than existing or later-introduced services or products. These payors may also conclude that the overall cost of using one of our tests exceeds the overall cost of using a competing test, and third-party payors may not approve any current or future in vitro diagnostic tests we develop for insurance coverage and adequate reimbursement.

In January 2024, we announced that we received a final Medicare coverage determination for our NeXT Dx offering, extended retroactively to August 29, 2023. While we estimate that approximately half of new solid tumor cancer cases will be diagnosed in patients covered by Medicare, the Medicare coverage determination may not be indicative of our ability to obtain coverage with other payors. Even if favorable coverage and reimbursement status is attained for one or more of our products, less favorable coverage policies and reimbursement rates may be implemented in the future.

We rely on a limited number of suppliers, or in some cases, a sole supplier, for some of our laboratory instruments and materials, and we may not be able to find replacements or immediately transition to alternative suppliers should we need to do so.

We rely on a limited number of suppliers for sequencers and other equipment and materials that we use in our laboratory operations. For example, we rely on Illumina as our sole supplier of sequencers and various associated reagents and other materials used in our routine laboratory operations, and as the sole provider of maintenance and repair services for these sequencers. Any disruption in Illumina’s operations or our inability to negotiate pricing with Illumina on acceptable terms, or at all, could negatively impact our supply chain and laboratory operations and our ability to conduct our business and generate revenue. Additionally, COVID-19 previously disrupted Illumina’s ability to fulfill our purchase orders for reagents or other materials in a timely manner and another health epidemic or pandemic may disrupt the ability of Illumina and our other suppliers to fulfill our purchase orders in a timely manner or at all. Our suppliers, including Illumina, could cease supplying these materials and equipment at any time, could increase the price of these materials or equipment (including the promotional pricing offered to us by Illumina for our 2022 VA MVP Agreement and certain other projects) or fail to provide us with sufficient quantities of materials or equipment that meet our specifications. Our laboratory operations have been and in the future could be interrupted if we encounter delays or difficulties in securing sequencers or other equipment or materials, or if we cannot obtain an acceptable substitute. We have also experienced, and may experience in the future, delays or difficulties in upgrading to newer versions or replacements of these materials and equipment, which may have better performance or be more cost-effective than the current versions. Any such interruption, delay or difficulty could significantly affect our business, financial condition, results of operations, and reputation.

We believe that there are only a few manufacturers other than Illumina that are currently capable of supplying and servicing the equipment necessary for our laboratory operations, including sequencers and various associated reagents. Likewise, we believe that there are a limited number of manufacturers and suppliers for other reagents and materials necessary for our laboratory operations, such as the sample preparation reagents required for our ACE technology, which enables our NeXT Platform to provide more comprehensive sequencing coverage, as well as those required to create personalized liquid biopsy panels for each patient as part of our NeXT Personal assay. Although we have evaluated and may continue in the future to evaluate equipment and materials from other suppliers, the use of equipment or materials provided by these replacement suppliers would require us to alter our laboratory operations. Transitioning to a new supplier would be time-consuming and expensive, would likely result in interruptions in our laboratory operations, could affect the performance specifications of our laboratory operations, or could require that we revalidate our tests. Additionally, an existing supplier of ours may allege that such activities constitute a breach of its agreement with us and may cease supplying us with sufficient quantities of materials or equipment that meet our specifications, in a timely manner or at all. Moreover, an existing supplier or third party may allege that such activities, replacement equipment or materials infringe, misappropriate or otherwise violate its intellectual property, and may bring infringement or other intellectual property-related claims against us. See “—Litigation or other proceedings or third-party claims of intellectual property infringement, misappropriation or other violations may require us to spend significant time and money, and could in the future prevent us from selling our tests or impact our stock price, any of which could have a material adverse effect.” We cannot

Table of Contents

assure you that, if we were forced to replace Illumina or another supplier on which we rely, we would be able to secure alternative equipment, reagents, and other materials, and bring such equipment, reagents, and other materials on-line and revalidate them without experiencing interruptions in our workflow. If we encounter delays or difficulties in securing, reconfiguring, or revalidating the equipment and reagents we require for our services, our business, financial condition, results of operations, and reputation could be adversely affected.

In addition, the Device Master Files that we filed with the FDA, which are focused on the technology, quality management, and validation of our platform, specifically on its use for the development of personalized immunotherapies, are predicated on our use of specified equipment and processes, including Illumina sequencers and related equipment. The detailed information in the Device Master Files is not shared with our customers, but with our permission they can reference our FDA file numbers in their Investigational New Drug filings with the FDA. If we were required to transition to a new supplier of sequencers or certain other equipment or processes in our laboratory, our Device Master Files would need to be replaced or updated, and until such time as that occurred, customers for which we deliver services after the transition would not be able to reference our Device Master Files, which would cause us to lose a competitive advantage.

We currently derive our revenue from our genomic analysis conducted in our laboratories. Currently, our only clinical reference or research and development laboratory facilities are in Fremont, California. Our facilities and equipment could be harmed or rendered inoperable by natural or man-made disasters, including fires, earthquakes, flooding, and power outages, which may render it difficult or impossible for us to sell or perform our services for some period of time. Northern California continues to experience serious fires and the San Francisco Bay Area is considered to lie in an area with earthquake risk. The inability to sell or to perform our sequencing and analysis services, disruptions in our operations, or the backlog of samples that could develop if our facilities are inoperable for even a short period of time, may result in the loss of customers or harm to our reputation or relationships with scientific or clinical collaborators, and we may be unable to regain those customers or repair our reputation or such relationships in the future. For example, from January 2023 through April 2023, we experienced substantial disruption to our use of the Fremont facility due to a failure of an electrical bus duct serving the facility. See “—The process of opening our new laboratory facilities in Fremont, California has diverted and could continue to divert management’s attention and has disrupted and could continue to disrupt our ongoing business.” Furthermore, our facilities and the equipment we use to perform our services and our research and development work could be costly and time-consuming to repair or replace.

Additionally, a key component of our research and development process involves using biological samples as the basis for the development of our services, and our services typically involve using biological samples provided by or on behalf of our customers or collaborators. In some cases, these samples are difficult to obtain. If the parts of our laboratory facilities where we store these biological samples were damaged or compromised, or if these biological samples or the resulting data were otherwise lost, damaged or compromised due to equipment malfunction, human error or other causes, our ability to pursue our research and development projects or provide our services, as well as our reputation, could be jeopardized. For example, we have experienced from time to time, and may experience in the future, equipment malfunctions that have resulted in lost, damaged or compromised samples or resulting data. We carry insurance for damage to our property or to our customer's property while in our possession, and we also carry insurance for the disruption of our business, but these types of insurance may not be sufficient to cover all of our potential losses or liabilities and may not continue to be available to us on acceptable terms, if at all.

Further, if our laboratory facilities became inoperable, we would likely not be able to license or transfer our technology to other facilities with the qualifications, including state licensure and CLIA certification, that would be necessary to cover the scope of our current and our planned future services. Even if we were to find facilities with such qualifications to perform our services, they may not be available to us on commercially reasonable terms.

Our success depends on our ability to provide reliable and timely, high-quality genomic data and analyses and to rapidly evolve to meet our customers’ needs.

Errors, including if our tests fail to accurately detect gene variants, or mistakes, including if we fail to or incompletely or incorrectly identify the significance of gene variants, could have a significant adverse impact on our business. We classify variants in accordance with guidelines that are subject to change and subject to our interpretation. There have also been and could in the future be flaws in the databases, third-party tools or algorithms we use, or in the software that handles automated parts of our classification protocol. If we receive poor quality or degraded samples, our tests may be unable to accurately detect gene variants or we may fail to or incompletely or incorrectly identify the significance of gene variants, which could have a significant adverse impact on our business. In addition, our customers require timely turnaround of high-quality genomic data and analyses, and if we were not able to meet our customers’ specific requirements, it could also have a significant adverse effect on our business.

Inaccurate results or misunderstandings of, or inappropriate reliance on, the information we provide to our customers could lead to, or be associated with, lack of efficacy, side effects or adverse events in patients who use our tests, or who rely on our tests to determine therapies to develop, select or monitor, including treatment-related death, and could lead to termination of our services or result in claims against us. A product liability or professional liability claim could result in substantial damages and be costly and time-consuming for us to defend.

Table of Contents

Although we maintain liability insurance, including for errors and omissions and professional liability, we cannot assure you that our insurance would be sufficient to protect us from the financial impact of defending against these types of claims, or any judgments, fines, or settlement costs arising out of any such claims. Any liability claim, including an errors and omissions liability claim, brought against us, with or without merit, could increase our insurance rates or prevent us from securing insurance coverage in the future. Additionally, any liability lawsuit could cause injury to our reputation or cause us to suspend sales of our tests or cause a suspension of our license to operate. The occurrence of any of these events could have an adverse effect on our business, reputation, and results of operations.

If we cannot develop services and products to keep pace with rapid advances in technology, medicine, and science, or if we experience delays in developing such services and products, our operating results and competitive position could be harmed.

In recent years, there have been numerous advances in technologies relating to the diagnosis and treatment of cancer. Several new cancer drugs have been approved, and a number of new drugs are in pre-clinical and clinical development. There have also been advances in methods used to identify patients likely to benefit from these drugs based on analysis of biomarkers. We must continuously develop new services and products, enhance any existing services, and avoid delays in such developments and enhancements to keep pace with evolving technologies on a timely and cost-effective basis. Our current services and our planned future services and products could become obsolete unless we continually innovate and expand them to demonstrate benefit in the diagnosis, monitoring, or prognosis of patients with cancer. New cancer therapies typically have only a few years of clinical data associated with them, and much of that data may not be disclosed by the pharmaceutical company that conducted the clinical trials. This could limit our ability to develop services and products based on, for example, biomarker analysis related to the appearance or development of resistance to those therapies. If we cannot adequately demonstrate the clinical utility of our services and our planned future services and products to new treatments, sales of our services could decline, which would have a material adverse effect on our business, financial condition, and results of operations.

We are researching and developing improvements to our tests and test features on a continuous basis, but we may not be able to make these improvements on a timely basis, and even if we do, we may not realize the benefits of these efforts in our financial results.

To remain competitive, we must continually research and develop improvements to our tests or test features. However, we cannot assure you that we will be able to develop and commercialize the improvements to our tests or test features on a timely basis. Our competitors may develop and commercialize competing or alternative tests and improvements faster than we are able to do so. In addition, we must expend significant time and funds in order to conduct research and development, further develop and scale our laboratory processes, and further develop and scale our infrastructure. We may never realize a return on investment on this effort and expense, especially if our improvements fail to perform as expected. If we are not able to realize the benefits of our efforts to improve our tests or test features, it could have an adverse effect on our business, financial condition, and results of operations.

We currently work with certain companies developing personalized cancer therapies, and our future success will in part depend on our personalized cancer customers obtaining regulatory approval for and commercializing their product candidates. Because personalized cancer therapies represent a new approach to immunotherapy for the treatment of cancer and other diseases, developing and commercializing personalized cancer therapies is subject to a number of challenges.

Actual or perceived safety issues, including adoption of new therapeutics or novel approaches to treatment, may adversely influence the willingness of subjects to participate in clinical studies, or if approved by applicable regulatory authorities, of physicians to subscribe to the novel treatment mechanics. The FDA or other applicable regulatory authorities may ask for specific post-market requirements, and additional information regarding benefits or risks of our services may emerge at any time prior to or after regulatory approval.

In the European Economic Area (and Northern Ireland) (“EEA”), in order to place an in vitro diagnostic medical device ("IVD"), or an accessory to an IVD, on the market, or put it into service in the EEA, the device must be designed, developed, manufactured and marketed in compliance with the relevant legal framework. On May 26, 2022, the Regulation on In-Vitro Diagnostic Devices (Regulation (EU) 2017/746) (“IVDR”) entered into application, repealing and replacing the Directive on In-Vitro Diagnostic Devices (98/79/EC) (the “IVDD”). The IVDR and its associated guidance documents and harmonized standards govern, among other things, device design and development, preclinical and clinical or performance testing, premarket conformity assessment, registration and listing, manufacturing, labeling, storage, claims, sales and distribution, export and import and post-market surveillance, vigilance, and market surveillance. IVDs must comply with the General Safety and Performance Requirements (“GSPRs”) set out in Annex I of the IVDR. Compliance with these requirements is a prerequisite to be able to affix the CE Mark to IVDs, without which they cannot be marketed or sold in the EEA.

In accordance with the IVDR, devices that are not placed on the market but are used within the context of a commercial activity, whether in return for payment or free of charge, for the provision of a diagnostic or therapeutic service offered by means of information society services, as defined in point (b) of Article 1(1) of Directive (EU) 2015/1535, or by other means of communication, directly or through intermediaries, to a natural or legal person established in the EEA (and Northern Ireland) will be subject to the IVDR. As a result,

Table of Contents

diagnostic and therapeutic services offered to customers in the EEA (and Northern Ireland) (whether directly or via intermediaries) by providers that are based outside the EEA will be covered by the IVDR.

Fulfillment of the obligations imposed by the IVDR are likely to increase the cost and time required in order to obtain regulatory approval for products and services in the EEA. If we offer tests or services to customers within the EEA (and Northern Ireland) (whether directly or via intermediaries) that fall within the scope of the IVDR, we may be unable to fulfill these obligations, or a notified body, where applicable, may consider that we have not adequately demonstrated compliance with our related obligations to merit a CE Certificate of Conformity on the basis of the IVDR. Our ability, and the ability of our customers, to commercialize diagnostic tests based on our technology will depend in part on the extent to which coverage and reimbursement for these tests will be available from third-party payors. Coverage and reimbursement of new products and services is uncertain, and whether the companies that use our tests or services to develop their own products or services will attain coverage and adequate reimbursement is unknown. In the U.S. and the EU, there is no uniform policy for determining coverage and reimbursement. Coverage can differ from payor to payor, and the process for determining whether a payor will provide coverage may be separate from the process for setting the reimbursement rate. In addition, the U.S. government, state legislatures and foreign governments have shown significant interest in implementing cost containment programs to limit the growth of government-paid healthcare costs, including price controls and restrictions on reimbursement.

Physicians, hospitals, and third-party payors often are slow to adopt new products, services, technologies, and treatment practices that require additional upfront costs and training. Physicians may not be willing to undergo training to adopt personalized cancer therapies, may decide that such therapies are too complex to adopt without appropriate training or not cost-efficient, and may choose not to administer these therapies. Based on these and other factors, hospitals and payors may decide that the benefits of personalized cancer therapies do not or will not outweigh their costs.

The loss of key members of our executive management team could adversely affect our business.

Our success in implementing our business strategy depends largely on the skills, experience, and performance of key members of our executive management team and others in key management positions. The collective efforts of each of our executives and others working with them as a team are critical to us as we continue to develop our technologies, services, products, and research and development programs. As a result of the difficulty in locating qualified new management, the loss or incapacity of existing members of our executive management team could adversely affect our operations. If we were to lose one or more of these key employees, we could experience difficulties in finding qualified successors, competing effectively, developing our technologies, and implementing our business strategy. Effective December 31, 2022, John West retired from his role as our Chief Executive Officer. Aaron Tachibana, our Chief Financial Officer, served as our interim Chief Executive Officer from December 31, 2022 until March 2, 2023, when Christopher Hall, who served as our SVP and Head, Diagnostics Business, was appointed Chief Executive Officer, in addition to his role as our President. As with any change in leadership, there is a risk to organizational effectiveness and employee retention as well as the potential for disruption to our business. Integrating members into new or different management roles could prove disruptive to our operations, require substantial resources and management attention and ultimately prove unsuccessful. Each member of our executive management team has an employment agreement; however, the existence of an employment agreement does not guarantee retention of members of our executive management team, and we may not be able to retain those individuals or replace them in the event we lose their services. We do not maintain “key person” life insurance on any of our employees.

In addition, we rely on collaborators, consultants, and advisors, including scientific and clinical advisors, to assist us in formulating our research and development and commercialization strategy. Our collaborators, consultants, and advisors are generally self-employed or employed by employers other than us and may have commitments under agreements with other entities that may limit their availability to us.

The loss or extended illness of a key employee, the failure of a key employee to perform in his or her current position, or our inability to attract and retain skilled employees could result in our inability to continue to grow our business or to implement our business strategy.

We rely on highly skilled personnel in a broad array of disciplines and if we are unable to hire, retain, or motivate these individuals, or maintain our corporate culture, we may not be able to maintain the quality of our services or grow effectively.

Our performance, including our research and development programs and laboratory operations, largely depends on our continuing ability to identify, hire, develop, motivate, and retain highly skilled personnel for all areas of our organization. Competition in our industry for qualified employees is intense, and we may not be able to attract or retain qualified personnel in the future, including bioinformatic scientists, bioinformatic engineers, software engineers, statisticians, variant curators, clinical laboratory scientists (“CLS”), and genetic counselors, due to the competition for qualified personnel among life science businesses, technology companies, as well as universities and public and private research institutions, particularly in the San Francisco Bay Area. For example, California has a shortage of qualified CLS, who must be licensed by the California Department of Public Health to perform clinical testing in laboratories located in California such as our CLIA-certified and CAP-accredited laboratory. We face intense competition for, and we have experienced and may in the future experience difficulty attracting and retaining, sufficient numbers of licensed and qualified CLS to support the needs of our business and our laboratory capacity expansion efforts. All of our U.S. employees are at-will, which means that either we or the employee may terminate their employment at any time. In addition, our compensation arrangements, such as our equity award programs, may not always be successful in attracting new employees and retaining and motivating our existing employees for reasons that may include movements in our stock price. If we are not able to attract and retain the necessary personnel, including licensed and qualified CLS, to accomplish our business objectives, we may experience constraints that could adversely affect our ability to scale our business and

Table of Contents

support our research and development efforts and our laboratory operations. We believe that our corporate culture fosters innovation, creativity, and teamwork. However, as our organization grows, we may find it increasingly difficult to maintain the beneficial aspects of our corporate culture. This could negatively impact our ability to retain and attract employees and our future success.

We have undertaken in the past, and may in the future undertake, internal restructuring activities that could result in disruptions to our business or otherwise harm our results of operations or financial condition.

From time to time we may undertake internal restructuring activities as we continue to evaluate and attempt to optimize our cost and operating structure in light of developments in our business strategy and long-term operating plans. For example, in the first quarter of 2023 and in the fourth quarter of 2023, we implemented reductions in our workforce to reduce operating costs and improve operating efficiency that collectively affected nearly 50% of our workforce. Any restructuring activities that we may undertake in the future may result in write-offs or other restructuring charges. There can be no assurance that any restructuring activities that we undertake in the future will achieve the cost savings, operating efficiencies or other benefits that we may initially expect. Restructuring activities may also result in a loss of continuity, accumulated knowledge and inefficiency during transitional periods and thereafter. In addition, internal restructurings can require a significant amount of time and focus from management and other employees, which may divert attention from commercial operations and disrupt our ongoing business. If any internal restructuring activities we undertake in the future fail to achieve some or all of the expected benefits therefrom, our business, results of operations and financial condition could be materially and adversely affected.

The process of opening our new laboratory facilities in Fremont, California has diverted and could continue to divert management’s attention and has disrupted and could continue to disrupt our ongoing business.

We have relocated our corporate headquarters and all laboratory facilities to Fremont, California. These efforts have involved significant tenant improvements, construction and regulatory compliance activities to be undertaken. Such efforts have distracted and may continue to distract management from current operations, have disrupted and may continue to disrupt planned research, development or regulatory compliance activities, and have resulted in and may continue to result in greater than expected liabilities and expenses, any of which could result in a material adverse effect on our business prospects, financial condition, or results of operations. For example, delays in the completion of updates to our new corporate headquarters in Fremont delayed our previously planned move-in date. Additionally, from January 2023 through April 2023, we experienced substantial disruption to our use of the Fremont facility due to a failure of an electrical bus duct serving the facility. We used backup generators to power our laboratories and emergency lights at the facility through February 2023 but were unable to use the office portions of the facility, or use the facility's heating, ventilation and air conditioning system during this time. We were able to restore full power to the facility on a temporary basis during March 2023 and April 2023 using additional generators, and regular electrical service to the facility has since been restored. However, we may experience additional disruptions in the future. We incurred costs in maintaining temporary power to the facility and in attempting to permanently remedy the problem, including obtaining additional backup generators, equipment, and back up batteries, and purchasing fuel for the generators on a daily basis. If we experience additional disruptions to our power supply, it may result in a loss in productivity, including delays to research and development programs, and could render it difficult or impossible for us to sell or perform certain of our services for some period of time. Additionally, if the backup generators were to fail, it could result in damage to biological samples stored within the Fremont facility, which may include certain customer samples. See “—If our facilities become damaged or inoperable, or we are required to vacate the facilities, our ability to sell and provide our services and pursue our research and development efforts may be jeopardized."

We may not be able to manage our future growth effectively, which could make it difficult to execute our business strategy.

Our expected future growth could create a strain on our organizational, administrative, and operational infrastructure, including facilities (such as our new facility in Fremont, California), laboratory operations, quality control, customer service, marketing and sales, and management. We may not be able to maintain the quality of or expected turnaround times for our tests, or satisfy customer demand as our test volume grows. Our ability to manage our growth properly will require us to continue to improve our operational, financial, and management controls, as well as our reporting systems and procedures. As a result of our growth, our operating costs may escalate even faster than planned, and some of our internal systems may need to be enhanced or replaced. If we are unable to manage our growth effectively, it may be difficult for us to execute our business strategy and our business could be harmed.

We may need to continue to invest in our infrastructure in advance of increased demand for our services; our failure to accurately forecast demand would have a negative impact on our business and our ability to achieve and sustain profitability.

Our new Fremont facility expanded our laboratory capacity and, in order to execute our business model, we may need to make additional investments to further scale our infrastructure, including purchases of additional equipment, some of which can take several months or more to procure, setup, and validate, or increases to our software and computing capacity. There is no assurance that any of these increases in scale, equipment, software, and computing capacities, or process enhancements will be successfully implemented.

We expanded our laboratory facilities in advance of increased demand for our services. Our current and projected future expense levels are to a large extent fixed and are largely based on our current investment plans and our estimates of future test volume. As a result, if revenue does not meet our expectations we may not be able to promptly adjust or reduce our spending to levels commensurate with our revenue, or at all. If we fail to generate demand commensurate with our infrastructure growth or if we fail to scale our infrastructure sufficiently in advance of demand to successfully meet such demand, our business, prospects, financial condition, and results of operations could be adversely affected.

Table of Contents

As we commercialize additional services or products, we may need to incorporate new equipment, implement new technology systems and laboratory processes, or hire new personnel with different qualifications. Failure to manage this growth or transition could result in turnaround time delays, higher costs, declining service and/or product quality, deteriorating customer service, and slower responses to competitive challenges. A failure in any one of these areas could make it difficult for us to meet market expectations for our services and could damage our reputation and the prospects for our business.

We may acquire businesses or assets, form joint ventures, or make investments in other companies or technologies that could harm our operating results, dilute our stockholders’ ownership, or cause us to incur debt or significant expense.

As part of our business strategy, we may pursue acquisitions of complementary businesses or assets, as well as technology licensing arrangements. We may also pursue strategic alliances that leverage our core technology and industry experience to expand our offerings or distribution, or make investments in other companies. As an organization, we have limited experience with respect to acquisitions as well as the formation of strategic alliances and joint ventures. We may not identify or complete these transactions in a timely manner, on a cost-effective basis, or at all, and we may not realize the anticipated benefits of any acquisition, technology license, strategic alliance, joint venture or investment, and their consideration may be distracting to our management or prevent us from pursuing other opportunities. In addition, we may not be able to find suitable partners or acquisition candidates, and we may not be able to complete such transactions on favorable terms, if at all. Any future such transactions by us also could result in significant write-offs, the incurrence of debt and contingent liabilities, exposure to additional liability, exposure to additional revenue concentration, additional regulatory obligations and exposure to additional potential liability, any of which could harm our operating results and future prospects. If we make any acquisitions in the future, we may not be able to integrate these acquisitions successfully into our existing business, and we could assume unknown or contingent liabilities. Integration of an acquired company or business also may require management resources that otherwise would be available for ongoing development of our existing business.

To finance any acquisitions or investments, we may choose to raise additional funds. The various ways we could raise additional funds carry potential risks. See “—Financial and Market Risks and Risks Related to Owning Our Common Stock—Our inability to raise additional capital on acceptable terms in the future may limit our ability to continue to operate our business and further expand our operations.” If the price of our common stock is low or volatile, we may not be able to acquire other companies using stock as consideration. Alternatively, it may be necessary for us to raise additional funds for these activities through public or private financings. Additional funds may not be available on terms that are favorable to us, or at all.

Ethical, legal, and social concerns related to the use of genetic information could reduce demand for our tests.

Genetic testing has raised ethical, legal, and social concerns regarding privacy and the appropriate uses of the resulting information. Governmental authorities have, through the Genetic Information Nondisclosure Act, and could further, for social or other purposes, limit or regulate the use of genetic information or genetic testing or prohibit testing for genetic predisposition to certain conditions, particularly for those that have no known cure. Ethical and social concerns may also influence governmental authorities to deny or delay the issuance of patents for technology relevant to our business. Similarly, these concerns may lead patients to refuse to use, or clinicians to be reluctant to order, genetic tests even if permissible. These and other ethical, legal, and social concerns may limit market acceptance of our tests or reduce the potential markets for our tests, either of which could have an adverse effect on our business, financial condition, or results of operations.

Any collaboration arrangements that we have entered into or may enter into in the future may not be successful, which could adversely affect our ability to develop and commercialize our services and products.

Any current or future collaborations, including any strategic alliances or any collaborations to develop companion diagnostic tests, that we have entered (for example, our collaborations with Tempus; Myriad; ClearNote Health, Inc.; Cancer Research UK, University College London, and the Francis Crick Institute (the TRACERx study); The Royal Marsden; the Vall d'Hebron Institute of Oncology (VHIO); Duke University; the Dana-Farber Cancer Institute; University Medical Center Hamburg-Eppendorf (also known as UKE); and Criterium and the Academic Breast Cancer Consortium) or may enter into may not be successful. The success of our collaboration arrangements will depend heavily on the efforts and activities of our collaborators. Collaborations are subject to numerous risks, which include that:

•

we may incur increased research and development expenses, and such activities may also divert management attention and resources and/or create competing internal priorities for us, which could prevent us from successfully conducting other parts of our business or collaborating with others;

•

collaborators have significant discretion in determining the efforts and resources that they will apply to collaborations;

•

collaborators may not pursue development and commercialization of our services or products or may elect not to continue or renew development or commercialization programs based on trial or test results, changes in their strategic focus due to the acquisition of competitive services or products, availability of funding, or other external factors, such as a business combination that diverts resources or creates competing priorities for our collaborator;

•

collaborators could independently develop, or develop with third parties, services or products that compete directly or indirectly with our services or products;

•

collaborators with marketing, manufacturing, and distribution rights to one or more services or products may not commit sufficient resources to or otherwise not perform satisfactorily in carrying out these activities;

Table of Contents

•

we could grant exclusive rights to our collaborators that would prevent us from collaborating with others;

•

a large percentage of our revenue may be concentrated with the collaborators if the collaborations are successful and we may experience further losses if they are or later become unsuccessful;

•

collaborators may not properly maintain or defend our intellectual property rights or may use our intellectual property or proprietary information in a way that gives rise to actual or threatened litigation that could jeopardize or invalidate our intellectual property or proprietary information or expose us to potential liability;

•

disputes may arise between us and a collaborator that causes the delay or termination of the research, development, or commercialization of our current or future services or products or that results in costly litigation or arbitration that diverts management attention and resources;

•

collaborations may be terminated, and, if terminated, may result in a need for additional capital to pursue further development or commercialization of the applicable current or future services or products;

•

collaborators may own or co-own intellectual property covering our services or products that results from our collaborating with them, and in such cases, we would not have the exclusive right to develop or commercialize such intellectual property;

•

collaborators’ activities or use of our services or deliverables may create additional regulatory obligations and could lead to side effects or adverse events in patients, exposing us to potential liability or regulatory review; and

•

collaborators’ sales and marketing activities or other operations may not be in compliance with applicable laws resulting in civil or criminal proceedings.

If we are unable to successfully obtain rights to required third-party intellectual property rights or maintain the existing intellectual property rights we have, we may have to abandon development of that program and our business and financial condition could suffer.

Our operations and employees face risks related to health crises that could adversely affect our operations, our financial condition, and the business or operations of our customers or other third parties with whom we conduct business.

Our business could be adversely impacted by the effects of a health crisis that could cause significant disruption in the operations of our customers and third-party suppliers upon whom we rely. Our laboratory facilities, executive team, and most of our employees are located in the San Francisco Bay Area. In the event of a health crisis that becomes widespread in or around the San Francisco Bay Area, we may proactively, or be ordered by government officials to, take precautionary measures such as suspending our lab operations, implementing alternative work arrangements for our employees, and limiting our employees’ travel activities.

Our operations were previously impacted by the COVID-19 pandemic. For example, the previous shelter-in-place order and health orders negatively impacted productivity, disrupted our business, and slowed research and development activities due to us limiting access to our laboratory space that would otherwise be used by our research and development group, and, to the extent such orders return in similar or more stringent form, they may cause similar effects on our operations. COVID-19 disrupted, and a future health epidemic or pandemic may disrupt in the future, the ability of our suppliers to fulfill our purchase orders in a timely manner or at all. Additionally, we use certain consumables in our operations, and we have faced, and may face in the future, difficulties in acquiring such consumables if our suppliers prioritize orders related to a health epidemic or pandemic or if other supply chain issues arise as a result of such a public health crisis. Several of our customers were delayed in sending us samples due to the inability to collect or ship samples during the COVID-19 pandemic, and these and additional customers may be disrupted from collecting samples or sending purchase orders or samples to us in the future in the event of the emergence of another health epidemic or pandemic.

Moreover, the ultimate impact of a health epidemic or pandemic on our business, operations, or the global economy as a whole is highly uncertain, but a continued and prolonged public health crisis could have a material negative impact on our business, financial condition, and operating results.

Expansion into international markets would subject us to increased regulatory oversight and regulatory, economic, social, health and political uncertainties, which could cause a material adverse effect on our business, financial position, and results of operations.

We may in the future expand our business and operations into international jurisdictions in which we have limited operating experience, including with respect to seeking regulatory approvals and marketing and selling products and services. As we expand internationally, our operations in these jurisdictions may be adversely affected by general economic conditions and economic and fiscal policy, including changes in exchange rates and controls, interest rates and taxation policies, increased government regulation, social instability, local or regional health crises, and political, economic or diplomatic developments in the future. Certain jurisdictions have, from time to time, experienced instances of civil unrest and hostilities, both internally and with neighboring countries. Rioting, military activity, terrorist attacks, or armed hostilities could cause our operations in such jurisdictions to be adversely affected or suspended. We generally do not have insurance for losses and interruptions caused by terrorist attacks, military conflicts and wars. In addition, anti-bribery and anti-corruption laws may conflict with some local customs and practices in foreign jurisdictions. Our international operations may subject us to heightened scrutiny under the Foreign Corrupt Practices Act of 1977, as amended (the “FCPA”), the United Kingdom (the “U.K.”) Bribery Act and similar anti-bribery laws, and could subject us to liability under such laws despite our best efforts to comply with such laws. As a result of our policy to comply with the FCPA, the U.K. Bribery Act and similar anti-bribery laws, we may be at a competitive disadvantage to competitors that are not subject to, or do not comply with, such laws. Further, notwithstanding our compliance programs,

Table of Contents

there can be no assurances that our policies will prevent our employees or agents from violating these laws or protect us from any such violations. Additionally, we cannot predict the nature, scope or impact of any future regulatory requirements that may apply to our international operations or how foreign governments will interpret existing or new laws. Alleged, perceived, or actual violations of any such existing or future laws by us or due to the acts of others, may result in criminal or civil sanctions, including contract cancellations or debarment, and damage to our reputation, any of which could have a material adverse effect on our business.

Regulatory, Legal and Cybersecurity Risks

Our tests may be subject to regulatory action if regulatory agencies or authorities determine that our tests do not appropriately comply with statutory and regulatory requirements enforced by the FDA, or equivalent foreign regulatory authorities and/or CLIA requirements for quality laboratory testing or equivalent foreign requirements.

The laws and regulations governing the marketing of clinical laboratory tests are extremely complex and in many instances there are no significant regulatory or judicial interpretations of these laws and regulations. The Federal Food, Drug and Cosmetic Act (the “FDC Act”) defines a medical device to include any instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent or other similar or related article, including a component, part, or accessory, intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment or prevention of disease, in man or other animals. Some of our tests may be considered by the FDA to be in vitro diagnostic products that are subject to regulation as medical devices. Among other things, pursuant to the FDC Act and its implementing regulations, the FDA regulates the research, testing, manufacturing, safety, labeling, storage, recordkeeping, premarket clearance or approval, marketing and promotion, and sales and distribution of medical devices in the U.S. to ensure that medical devices distributed domestically are safe and effective for their intended uses. In addition, the FDA regulates the import and export of medical devices.

Although the FDA has statutory authority to assure that medical devices are safe and effective for their intended uses, the FDA has generally exercised its enforcement discretion and not enforced applicable regulations with respect to LDTs, which are a subset of in vitro diagnostic devices that are intended for clinical use and designed, manufactured, and used entirely within a single laboratory. We currently market our tests as LDTs and, therefore, we believe that they are not currently subject to the FDA’s enforcement of its medical device regulations and the applicable FDC Act provisions.

On October 3, 2023 FDA issued proposed regulations under which it would phase out its enforcement discretion approach to LDTs over a period of four years (the "Proposed Rule"). If the Proposed Rule is finalized as proposed, we anticipate that we would be required to obtain PMA approval for certain of our tests by October 1, 2027. We would also be subject to device registration and listing requirements, medical device reporting requirements and the requirements of the FDA’s Quality System Regulation. If the FDA determines that our tests are subject to enforcement as medical devices, we could be subject to enforcement action, including administrative and judicial sanctions, and additional regulatory controls and submissions for our tests, all of which could be burdensome. We and/or our collaborators may also be required to submit one or more of our tests for premarket notification, review, clearance or approval by the FDA as medical devices. See “—Failure to comply with federal, state, and foreign laboratory licensing requirements and the applicable requirements of the FDA or any other regulatory authority, could cause us to lose the ability to perform our tests, experience disruptions to our business or become subject to administrative or judicial sanctions.”

In early December 2023, following the close of a public comment period, FDA announced its intention to publish the Proposed Rule in final form in April 2024. On January 18, 2024, the Director of FDA’s Center for Devices and Radiological Health, which oversees IVD regulation within the FDA, and the Chief Medical Officer and Acting Director of CMS’ Center for Clinical Standards and Quality, which oversees CLIA within CMS, issued a joint press release supporting the Proposed Rule, indicating broad support within the Department of Health and Human Services for FDA’s Proposed Rule.

Legislative proposals addressing oversight of genetic testing and LDTs have been introduced in previous Congresses, and we expect that new legislative proposals will be introduced from time to time in the future. For example, the proposed “Verifying Accurate, Leading-edge IVCT Development” Act (the “VALID Act”) would clarify and enhance FDA’s authority to regulate LDTs, including premarket review of non-exempted tests. We cannot predict whether the VALID Act will become legislation and cannot provide any assurance that FDA regulation, including premarket review, will not be required in the future for our tests, whether through finalization of the Proposed Rule, new enforcement policies adopted by the FDA or new legislation enacted by Congress.

It is possible that legislation will be enacted into law or guidance such as the Proposed Rule could be issued by the FDA that may result in increased regulatory burdens for us to continue to offer our tests or to develop and introduce new tests. This legislative and regulatory uncertainty exposes us to the possibility of enforcement action or additional regulatory controls and submissions for our tests, both of which could be burdensome. In addition, we cannot be certain that the FDA will not enact rules or guidance documents that could impact our ability to purchase certain materials necessary for the performance of our tests, such as products labeled for research use only. Should any of the reagents obtained by us from suppliers and used in conducting our tests be affected by future regulatory actions, our business could be adversely affected by those actions, including increasing the cost of testing or delaying, limiting, or prohibiting the purchase of reagents necessary to perform testing.

In the EEA, IVDs are governed by the IVDR and must comply with the requirements of the IVDR in order to be placed on the market or put into service in the EEA. The IVDR does not specifically address the regulation of products falling within the description "laboratory-developed tests". Moreover, while the Regulation includes only limited exemptions for devices that are manufactured and used only within health institutions established in the EEA, diagnostic and therapeutic services undertaken outside of the EEA (for example at our facilities in the U.S.) would not fall within the scope of such exemptions. We believe that we do not currently offer tests or services

Table of Contents

to customers established in the EEA which would fall within the scope of the IVDR. If, in the future, we offer tests or services to customers within the EEA (whether directly or via intermediaries) that fall within the scope of the IVDR, it is unlikely that we will benefit from IVDR exemptions foreseen for health institutions established in the EEA. This means that we will have to comply with the IVDR in full.

If the FDA determines that our services are subject to enforcement as medical devices, or if foreign regulatory authorities regulate our products as IVDs, we could incur substantial costs and time delays associated with satisfying statutory and regulatory requirements such as pre-market clearance, approval or certification, and we could incur additional expense in offering our tests and tests that we may develop in the future.

If the FDA determines that our tests and associated software do not fall within the definition of an LDT, or there are regulatory or legislative changes such as FDA's Proposed Rule, or if we voluntarily submit one or more of our tests for premarket notification, review, clearance or approval by the FDA as medical devices, we may be required to obtain premarket clearance for our tests and associated software under Section 510(k) of the FDC Act or approval of a premarket approval application (“PMA”). We would also be subject to ongoing regulatory requirements such as registration and listing requirements, medical device reporting requirements, and quality control requirements. If our tests are considered medical devices not subject to enforcement discretion, or if we voluntarily submit one or more of our tests for premarket notification, review, clearance or approval by the FDA as medical devices, the regulatory requirements to which our tests are subject would depend on the FDA’s classification of our tests. The FDA has issued regulations classifying generic types of medical devices into one of three regulatory control categories (Class I, Class II, or Class III) depending on the degree of regulation that the FDA finds necessary to provide reasonable assurance of their safety and effectiveness. The class into which a device is placed determines the requirements that a medical device manufacturer must meet both pre- and post-market. On January 31, 2024, FDA announced its intent to initiate a reclassification process for most IVDs that are currently Class III (high risk), the majority of which are infectious disease and companion diagnostic IVDs, into Class II (moderate risk). This reclassification would allow manufacturers of certain types of IVDs to seek marketing clearance through the less burdensome Class II 510(k) premarket notification pathway rather than the Class III premarket approval (PMA) pathway, the most stringent type of FDA medical device review.

Generally, Class I devices do not require premarket authorization, but are subject to a comprehensive set of regulatory authorities referred to as general controls. Class II devices, in addition to general controls, generally require special controls and premarket clearance through the submission of a section 510(k) premarket notification. Class III devices are subject to general controls and special controls, and also require premarket approval prior to commercial distribution, which is a more rigorous process than premarket clearance. Under the FDC Act, a device that is first marketed after May 28, 1976 is by default a Class III device requiring premarket approval unless it is within a type of generic device class that has been classified as Class I or Class II. Even if a device falls under an existing Class II, non-exempt, device classification, the device must also be shown to be “substantially equivalent” to a legally marketed predicate device through submission of a section 510(k) premarket notification. If after reviewing a firm’s 510(k) premarket notification, the FDA determines that a device is not substantially equivalent to a legally marketed predicate device, the new device is classified into Class III, requiring premarket approval. It is possible for a manufacturer to obtain a Class I or Class II designation without an appropriate predicate by submitting a de novo request for reclassification.

The process for submitting a 510(k) premarket notification and receiving FDA clearance usually takes from three to 12 months, but it can take significantly longer and clearance is never guaranteed. The process for submitting and obtaining FDA approval of a PMA is much more costly, lengthy, and uncertain. It generally takes from one to three years or even longer and approval is not guaranteed. PMA approval typically requires extensive clinical data and can be significantly longer, more expensive and more uncertain than the 510(k) clearance process. Despite the time, effort and expense expended, there can be no assurance that a particular device ultimately will be cleared or approved by the FDA through either the 510(k) clearance process or the PMA process on a timely basis, or at all.

If our tests are considered medical devices not subject to enforcement discretion, or if we voluntarily submit one or more of our tests for premarket notification, review, clearance or approval by the FDA as medical devices, one classification regulation that could be relevant to one or more of our tests is a classification for genetic health risk (“GHR”) assessment tests, codified at 21 C.F.R. § 866.5950. If our tests are considered medical devices that are not subject to enforcement discretion, or if we voluntarily submit one or more of our tests for premarket notification, review, clearance or approval by the FDA as medical devices, and one or more of our tests is considered to fall under the 21 C.F.R. § 866.5950 classification regulation for GHR tests, or under another Class II classification that is subject to a premarket notification requirement, we would be required to obtain marketing clearance for such tests. Further, if considered to fall under the 21 C.F.R. § 866.5950 classification for GHR tests, our tests would be required to adhere to specified special controls, such as labeling and testing specifications and information about the test to be posted on the manufacturer’s website. If any of our current or pipeline tests are not considered by the FDA to be GHR tests or do not qualify for the limited exemption for a sponsor’s subsequent GHR tests once the assessment system has been reviewed and cleared by FDA, or if any of our tests fall under a different non-exempt classification or are unclassified, we could be required to obtain 510(k) clearance or approval of a PMA for such test in the future.

If premarket review of our tests is required, the premarket review process may involve, among other things, successfully completing additional clinical trials. If we are required to conduct premarket clinical trials, whether using prospectively acquired samples or archival samples, delays in the commencement or completion of clinical testing could significantly increase our service and product development costs, delay commercialization of any future services or products, and interrupt sales of our current services and products. Many of the factors that may cause or lead to a delay in the commencement or completion of clinical trials may also ultimately lead to delay or denial of regulatory clearance or approval. The commencement of clinical trials may be delayed due to insufficient patient enrollment, which is a function of many factors, including the size of the patient population, the concerns around genetic testing, the nature of the protocol, the proximity of patients to clinical sites, and the eligibility criteria for the clinical trial.

Table of Contents

If we are required to conduct clinical trials, we and any third-party contractors we engage would be required to comply with good clinical practices (“GCPs”), which are regulations and guidelines enforced by the FDA, for devices in clinical development. The FDA enforces these GCPs through periodic inspections of trial sponsors, principal investigators, and trial sites. If we or any third-party contractor fails to comply with applicable GCPs, the clinical data generated in clinical trials may be deemed unreliable and the FDA may require us to perform additional clinical trials before clearing or approving our marketing applications. A failure to comply with these regulations may require us to repeat clinical trials, which would delay the regulatory clearance or approval process. In addition, if these parties do not successfully carry out their contractual duties or obligations or meet expected deadlines, or if the quality, completeness or accuracy of the clinical data they obtain is compromised due to the failure to adhere to our clinical protocols or for other reasons, our clinical trials may have to be extended, delayed or terminated. Many of these factors would be beyond our control. We may not be able to enter into replacement arrangements without undue delays or considerable expenditures. If there are delays in testing or approvals as a result of the failure to perform by third parties, our research and development costs would increase, and we may not be able to obtain regulatory clearance or approval for our tests. In addition, we may not be able to establish or maintain relationships with these parties on favorable terms, if at all. Each of these outcomes would harm our ability to market our tests or to achieve or sustain profitability. Similar actions and obligations may be imposed by the competent authorities of an EU Member State, or a foreign regulatory authority.

The FDA requires medical device manufacturers to comply with, among other things, current good manufacturing practices for medical devices, set forth in the Quality System Regulation at 21 C.F.R. Part 820, which requires manufacturers to follow elaborate design, testing, control, documentation, and other quality assurance procedures during the manufacturing process; the medical device reporting regulation, which requires that manufacturers report to the FDA if their device or a similar device they market may have caused or contributed to a death or serious injury or malfunctioned in a way that would likely cause or contribute to a death or serious injury if it were to recur; labeling regulations, including the FDA’s general prohibition against promoting devices for unapproved or “off-label” uses; the reports of corrections and removals regulation, which requires manufacturers to report to the FDA if a device correction or removal was initiated to reduce a risk to health posed by the device or to remedy a violation of the FDC Act caused by the device which may present a risk to health; and the establishment registration and device listing regulation.

Moreover, there can be no assurance that any cleared or approved labeling claims will be consistent with our current claims or adequate to support continued adoption of our services and products. If premarket review is required for some or all of our services and products, the FDA may require that we stop selling such services and products pending clearance or approval, which would negatively impact our business. Even if our services and products are allowed to remain on the market prior to clearance or approval, demand for our services and products may decline if there is uncertainty about our services or products, if we are required to label our services or products as investigational by the FDA, or if the FDA limits the labeling claims we are permitted to make for our services or products. As a result, we could experience significantly increased development costs and a delay in generating additional revenue from our services and products, or from other services or products now in development.

In addition, any clearance or approval we obtain for our services or products may contain requirements for costly post-market testing and surveillance to monitor the safety or efficacy of the product. The FDA has broad post-market enforcement powers, and if unanticipated problems with our services or products arise, or if we or our suppliers fail to comply with regulatory requirements following FDA clearance or approval, we may become subject to enforcement actions such as:

•

restrictions on manufacturing processes;

•

restrictions on service or product marketing;

•

warning letters;

•

withdrawal or recall of services or products from the market;

•

refusal to approve pending PMAs, 510(k)s, or supplements to approved PMAs or cleared 510(k)s that we submit;

•

fines, restitution, or disgorgement of profits or revenue;

•

suspension or withdrawal of regulatory clearances or approvals;

•

limitation on, or refusal to permit, import or export of our products;

•

product seizures;

•

injunctions; or

•

imposition of civil or criminal penalties.

Moreover, the FDA strictly regulates the promotional claims that may be made about medical devices. In particular, a medical device may not be promoted for uses that are not approved by the FDA as reflected in the device’s approved labeling. However, companies may share truthful and not misleading information that is otherwise consistent with the device’s FDA approved labeling. The FDA and other agencies or authorities actively enforce the laws and regulations prohibiting the promotion of off-label uses, and a company that is found to have improperly promoted off-label uses may be subject to significant civil, criminal, and administrative penalties.

In addition, many of the products we use to perform our tests, including sequencers and various associated reagents supplied to us by Illumina, are labeled as research use only (“RUO”) in the U.S. RUO products are exempt from FDA medical device requirements provided their manufacturers comply with specified labeling and restrictions on distribution. The products must bear the statement: “For Research Use Only. Not for Use in Diagnostic Procedures.” Manufacturers of RUO products cannot make any claims related to safety,

Table of Contents

effectiveness or diagnostic utility, and RUO products cannot be intended by the manufacturer for clinical diagnostic use. A product promoted for diagnostic use may be viewed by the FDA as adulterated and misbranded under the FDC Act and is subject to FDA enforcement activities, including requiring the manufacturer to seek marketing authorization for the products. We currently use Illumina and other RUO products for our clinical diagnostic tests. If the FDA were to require clearance, approval or authorization for the sale of Illumina’s RUO products and if Illumina does not obtain such clearance, approval or authorization, we would have to find an alternative sequencing platform for some or all of our clinical diagnostic tests. We currently have not validated an alternative sequencing platform on which our tests could be run in a commercially viable manner. If we were not successful in selecting, acquiring on commercially reasonable terms and implementing an alternative platform on a timely basis, our business, financial condition and results of operations would be adversely affected. Similarly, a finding that any of our other suppliers failed to comply with applicable requirements could result in interruptions in our ability to supply our services to the market and adversely affect our operations.

In addition, if we offer tests or services to customers within the EEA (and Northern Ireland) (whether directly or via intermediaries) that fall within the scope of the IVDR, we would be required to comply with strict requirements in order to affix the CE mark to our products, including requirements for clinical evidence, pre-market assessment of safety and performance, quality management system, traceability of products, promotion and advertising, and conduct costly post-market testing and surveillance to monitor the safety or effectiveness of our products in the EEA and detailed reporting obligations.

Failure to comply with federal, state, and foreign laboratory licensing requirements and the applicable requirements of the FDA or any other regulatory authority, or equivalent foreign regulatory authority, could cause us to lose the ability to perform our tests, experience disruptions to our business, or become subject to administrative or judicial sanctions.

We are subject to CLIA, a federal law that regulates clinical laboratories that perform testing on specimens derived from humans for the purpose of providing information for the diagnosis, prevention, or treatment of disease. CLIA regulations establish specific standards with respect to personnel qualifications, facility administration, proficiency testing, quality control, quality assurance, and inspections. We have a current CLIA certificate to conduct our tests at our laboratory in Fremont, California. To renew this certificate, we are subject to survey and inspection every two years. Because we are a CAP-accredited laboratory, the Centers for Medicare & Medicaid Services ("CMS") does not perform this survey and inspection and relies on our CAP survey and inspection. We also may be subject to additional unannounced inspections.

We are also required to maintain a license to conduct testing in California. California laws establish standards for day-to-day operation of our clinical reference laboratory, including the training and skills required of personnel and quality control. Several other states in which we operate also require that we hold licenses to test specimens from patients in those states, under certain circumstances. For example, our clinical reference laboratory is required to be licensed on a test-specific basis by New York as an out-of-state laboratory, and our LDTs must be approved by the New York State Department of Health (the “NYDOH”) on a test-by-test basis before they are offered in New York. We are subject to periodic inspection by the NYDOH and are required to demonstrate ongoing compliance with NYDOH regulations and standards. To the extent NYDOH identified any non-compliance and we are unable to implement satisfactory corrective actions to remedy such non-compliance, the State of New York could withdraw approval for our tests. Additionally, states such as Maryland, Pennsylvania, and Rhode Island also require us to maintain out-of-state licenses. Other states may have similar requirements or may adopt similar requirements in the future. Although we have obtained licenses from states for our clinical reference laboratory where we believe we are required to be licensed, we may become aware of other states that require out-of-state laboratories to obtain licensure in order to accept specimens from the state, and it is possible that other states currently have such requirements or will have such requirements in the future. We may also be subject to regulation in foreign jurisdictions as we seek to expand international utilization of our tests or such jurisdictions adopt new licensure requirements, which may require review of our tests in order to offer them or may have other limitations such as restrictions on the transport of human blood necessary for us to perform our tests that may limit our ability to make our tests available outside of the U.S. Complying with licensure requirements in new jurisdictions may be expensive and/or time-consuming, may subject us to significant and unanticipated delays, or may be in conflict with other applicable requirements.

Failure to comply with applicable clinical laboratory licensure requirements may result in a range of enforcement actions, including license suspension, limitation, or revocation, directed plan of action, onsite monitoring, civil monetary penalties, and criminal sanctions as well as significant adverse publicity. Any sanction imposed under CLIA, its implementing regulations or state or foreign laws or regulations governing clinical laboratory licensure, or our failure to renew our CLIA certificate, a state or foreign license or accreditation, could have a material adverse effect on our business, financial condition, and results of operations. Even if we were able to bring our laboratory back into compliance, we could incur significant expenses and potentially lose revenue in doing so.

Failure to comply with the IVDR may result in a range of enforcement actions by the regulatory authorities of EU Member States as well as repercussions for any CE Certificates of Conformity issued by notified bodies, including fines, suspension variation or withdrawal of CE Certificates of Conformity, product seizures, injunctions or the imposition of civil or criminal penalties which would adversely affect our business, operating results and prospects.

Although we market our tests as LDTs that are currently subject to the FDA’s exercise of enforcement discretion, if we fail to operate within the conditions of that exercise of enforcement discretion, if any of our services or products otherwise fail to comply with FDA regulatory requirements as enforced, or if we are required or voluntarily submit one or more of our tests for premarket notification, review, clearance or approval by the FDA as medical devices, we would be subject to the applicable requirements of the FDC Act and the FDA’s implementing regulations. The FDA is empowered to impose sanctions for violations of the FDC Act and the FDA’s implementing regulations, including warning letters, civil and criminal penalties, injunctions, product seizure or recall, import bans, restrictions on the conduct of our operations and total or partial suspension of production. Any of the aforementioned sanctions could cause reputational damage, undermine our ability to maintain and increase our revenue, and harm our business, financial condition, and

Table of Contents

results of operations. In particular, if we or the FDA discover that any of our services or products have defects that call into question the accuracy of their results, we may be required to undertake a retest of all results and analyses provided during the period relevant to the defect, or recall the affected services and products. The direct costs incurred in connection with such a recall in terms of management time, administrative, and legal expenses and lost revenue, together with the indirect costs to our reputation, could harm our business, financial condition, and results of operations, and our ability to execute our business strategy. While we believe that we are currently in material compliance with applicable laws and regulations as currently enforced, the FDA or other regulatory agencies and authorities may not agree, and a determination that we have violated these laws or a public announcement that we are being investigated for possible violations of these laws could adversely affect our business, financial condition, results of operations, and prospects.

If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences.

In the ordinary course of our business, we, and the third parties upon which we rely, collect, process, receive, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, share and store (collectively, “process”) proprietary, confidential, and sensitive information, including protected health information (“PHI”), personal information, credit card and other financial information, intellectual property, trade secrets, medical information, biometric information and genomic information (collectively, “sensitive information”) owned or controlled by ourselves or our customers, payors, and other parties.

Cyberattacks, malicious internet-based activity, and online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties upon which we rely. Such threats are prevalent and continue to increase, are becoming increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyberattacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, including the war between Russia and Ukraine, the state of war between Israel and Hamas and the risk of a larger regional conflict, we, and the third parties upon which we rely, may be vulnerable to a heightened risk of these attacks, including retaliatory cyberattacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell, and distribute our platform, products, and services.

We and the third parties upon which we rely are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, attacks enhanced or facilitated by artificial intelligence ("AI"), software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, natural disasters, terrorism, and other similar threats. In particular, ransomware attacks are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, ability to provide our services, loss of data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Most of our employees are working remotely at least part of the time and such remote work has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations. Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.

We rely on third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, on-site systems and cloud-based data centers, systems handling human resources, financial reporting and controls, customer relationship management, regulatory compliance, and other infrastructure operations. We also communicate sensitive data, including patient data, electronically, and through relationships with multiple third-party vendors and their subcontractors. These applications and data encompass a wide variety of sensitive information, including research and development information, patient data, commercial information, and business and financial information. Our ability to monitor these third parties’ security practices is limited, and these third parties may not have adequate security measures in place. If any of our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if any of our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our information technology systems or the third-party information technology systems that support us and our services.

Despite the measures we have taken to prevent unanticipated problems that could affect our information technology and telecommunications systems, failures or significant downtime of our information technology or telecommunications systems or those used by our third-party service providers could prevent us from conducting tests, preparing and providing reports to our customers, billing customers, collecting revenue, handling inquiries from our customers, conducting research and development activities, and managing the administrative aspects of our business. For example, in 2018, we experienced downtime in our information technology systems in

Table of Contents

connection with the adoption of certain new information technology, and our results of operations in the first and second quarters of 2018 were adversely affected as a result. Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our platform, products, and services.

We may expend significant resources or modify our business activities (including our clinical trial activities) to try to protect against security incidents. Additionally, certain data privacy and security obligations may require us to implement and maintain certain measures to protect our information technology systems and sensitive information.

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps designed to detect, mitigate and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties upon which we rely). We may not, however, detect and remediate all such vulnerabilities, including on a timely basis. Further, we may experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities, but we may not be able to detect and remediate all vulnerabilities because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred. Further, if the information technology systems of the third parties upon which we rely become subject to security incidents, we may have insufficient recourse against such third parties, and we may have to expend significant resources to mitigate the impact of such an event, and to develop and implement protections to prevent future events of this nature from occurring. Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our tests and services and otherwise conduct our business in the ordinary course.

Unauthorized access, loss, or dissemination could also damage our reputation or disrupt our operations, including our ability to conduct our analyses, deliver test results, process claims and appeals, provide customer assistance, conduct research and development activities, collect, process, and prepare company financial information, provide information about our tests and other patient and physician education and outreach efforts through our website, and manage the administrative aspects of our business. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. For example, like many companies, we use Log4j with respect to certain software or systems to log security and performance information. In early 2022, we discovered a Log4j vulnerability in our environment although to date we have found no indication that our or our partners’ data was exposed. Upon learning of this vulnerability, we applied a patch and made updates to our systems and infrastructure intended to reduce risks associated with the vulnerability.

Applicable data privacy and security obligations, including applicable federal and/or state breach notification laws and foreign equivalents, as well as public company disclosure obligations, may require us to notify relevant stakeholders, including affected individuals, regulatory authorities and our stockholders, of certain security incidents. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal information); litigation (including class claims) and mass arbitration; indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may prevent or cause customers or partners to stop using our platform, products, and services, deter new customers or partners from using our platform, products, and services, and negatively impact our ability to grow and operate our business. Whether a cybersecurity incident is reportable to our stockholders may not be straightforward, may take considerable time to determine, and may be subject to change as the investigation of the incident progresses, including changes that may significantly alter any initial disclosure that we provide.

Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our data privacy and security practices. Additionally, we cannot be sure that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.

In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, our sensitive information could be leaked, disclosed, or revealed as a result of or in connection with our employee’s, personnel’s, or vendor’s use of generative AI technologies.

Table of Contents

We are subject to stringent and evolving U.S. and foreign laws, regulations, rules, contractual obligations, industry standards, policies and other obligations related to data privacy and security. Our actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions; litigation (including class claims) and mass arbitration demands; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse business consequences.

In the ordinary course of business, we process sensitive information, including data we collect from our customers about trial participants in connection with clinical trials. Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security.

In the United States, federal, state, and local governments have enacted numerous data privacy, and security laws, including data breach notification laws, personal information privacy laws, and consumer protection laws. For example, the Health Insurance Portability and Accountability Act ("HIPAA"), as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH"), imposes specific requirements relating to the privacy, security, and transmission of individually identifiable health information. Penalties for failure to comply with HIPAA and HITECH include significant civil monetary penalties and criminal penalties in certain circumstances with fines up to $250,000 per violation and/or imprisonment. Further, various states, such as California and Massachusetts, have implemented similar privacy laws and regulations, such as the California Confidentiality of Medical Information Act, that impose restrictive requirements regulating the use and disclosure of health information and other personally identifiable information. These laws and regulations are not necessarily preempted by HIPAA, particularly if a state affords greater protection to individuals than HIPAA. Where state laws are more protective and applicable to us, we may have to comply with the stricter provisions. In addition to fines and penalties imposed upon violators, some of these state laws also afford private rights of action to individuals who believe their personal information has been misused. Similarly, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CPRA”) (collectively, "CCPA") applies to personal information of consumers, business representatives, and employees, and requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights, including those noted below. The CCPA provides for fines of up to $7,500 per intentional violation and allows private litigants affected by certain data breaches to recover significant statutory damages. Although the CCPA exempts some data processed in the context of clinical trials, the CCPA increases compliance costs and potential liability with respect to other personal information we maintain about California residents. In addition, the CPRA expands the CCPA’s requirements, including by adding a new right for individuals to correct their personal information and establishing a new regulatory agency to implement and enforce the law. Other states, such as Virginia, Colorado, Connecticut and Utah have also enacted comprehensive privacy laws, and similar laws are being considered in several other states, as well as at the federal and local levels. These state laws and the CCPA provide individuals with certain rights concerning their personal information, including the right to access, correct, or delete certain personal information, and opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. While these states, like the CCPA, also exempt some data processed in the context of clinical trials, these developments further complicate compliance efforts, and increase legal risk and compliance costs for us, the third parties upon whom we rely and our customers. Additionally, several states and localities have enacted statutes banning or restricting the collection of biometric information and regulators, such as the Federal Trade Commission, have indicated that use of biometric technologies (including facial recognition technologies) may be subject to additional scrutiny.

We may be subject to new laws governing the privacy of consumer health data, including reproductive, sexual orientation, and gender identity privacy rights. For example, Washington’s My Health My Data Act (“MHMD”) broadly defines consumer health data, places restrictions on processing consumer health data (including imposing stringent requirements for consents), provides consumers certain rights with respect to their health data, and creates a private right of action to allow individuals to sue for violations of the law. Other states are considering and may adopt similar laws. California also recently passed a law protecting privacy of abortion-related records and other reproductive healthcare services.

Outside the U.S., an increasing number of laws, regulations, and industry standards govern data privacy and security. For example, the General Data Protection Regulation 2016/679 (“EU GDPR”), the United Kingdom’s GDPR (“UK GDPR”), Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais) (Law No. 13,709/2018), and China’s Personal Information Protection Law (“PIPL”) impose strict requirements for processing personal information. Under the EU GDPR and UK GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros under the EU GDPR, 17.5 million pounds sterling under the UK GDPR or, in each case, 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal information brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. In Canada, the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and various related provincial laws, as well as Canada’s Anti-Spam Legislation (“CASL”), applies to our operations. We also receive personal information from customers in Asia and may be subject to new and emerging data privacy and security regimes in Asia, including Japan’s Act on the Protection of Personal Information, and Singapore's Personal Data Protection Act.

In the ordinary course of business, we may transfer personal information from Europe and other jurisdictions to the U.S. or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal information to other countries. In particular, the EEA and the U.K. have significantly restricted the transfer of personal information to the U.S. and other countries whose data privacy and security laws they generally believe are inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal information from the EEA and U.K. to the U.S. in compliance with law, such as the EEA’s standard contractual clauses, the U.K.'s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework (and U.K. extension thereto) (which allows for transfers for relevant U.S.-based organizations who self-certify compliance and participate in such

Table of Contents

framework), these mechanisms are susceptible to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal information to the U.S. If there is no lawful manner for us to transfer personal information from the EEA, the U.K. or other jurisdictions to the U.S., or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal information necessary to operate our business. Additionally, companies that transfer personal information out of the EEA and U.K. to other jurisdictions, particularly to the U.S., are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations. EEA countries may also introduce national legislation further limiting the processing of personal genetic, biometric, or health data, which could limit our ability to collect, use and share data originating from the EEA, or could cause our compliance costs to increase, require us to change our practices, adversely impact our business, and harm our financial condition.

In addition to data privacy and security laws, because we process some credit card payments through a third-party payment processing partner, we are contractually subject to industry standards adopted by industry groups and may become subject to such obligations in the future. For example, we may also be subject to the Payment Card Industry Data Security Standard (“PCI DSS”). The PCI DSS requires companies to adopt certain measures to ensure the security of cardholder information, including using and maintaining firewalls, adopting proper password protections for certain devices and software, and restricting data access. Noncompliance with PCI-DSS can result in penalties ranging from $5,000 to $100,000 per month by credit card companies, litigation, damage to our reputation, and revenue losses.

We also rely on vendors to process payment card data, who may be subject to PCI DSS, and our business may be negatively affected if our vendors are fined or suffer other consequences as a result of PCI DSS noncompliance. We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. For example, certain privacy laws, such as the GDPR, require our customers to impose specific contractual restrictions on their service providers. We publish privacy policies, marketing materials and other statements regarding data privacy and security. If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.

Our employees and personnel may use generative AI technologies to perform their work, and the disclosure and use of personal information in generative AI technologies is subject to various data privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and consumer lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages.

Obligations related to data privacy and security (and consumers' data privacy and security expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources, which may necessitate changes to our platform, products and/or services, information technologies, systems, and practices and to those of any third parties that process personal information on our behalf. In addition, these obligations may require us to change our business model. Our business model materially depends on our ability to process personal information, so we are particularly exposed to the risks associated with the rapidly changing legal landscape. For example, because we process PHI, personal information and sensitive information, we may be at heightened risk of regulatory scrutiny, and any changes in the regulatory framework could require us to fundamentally change our business model, including causing us to take on more onerous obligations in our contracts, restrict our ability to collect, use and disclose data, or in some cases, impact our ability to operate in certain jurisdictions. We typically rely on our customers to obtain valid and appropriate consents from data subjects whose genetic samples and data we process on such customers’ behalf particularly with respect to our RUO and clinical trial services, and we also typically rely on each provider ordering our LDTs or diagnostic services to obtain valid and appropriate consent from each of his or her patients whose genetic samples and data we process on such patient's behalf. Given that we do not typically obtain direct consent from such data subjects or patients, and we do not audit our customers or the ordering providers to ensure that they have obtained the necessary consents required by law, the failure of our customers or the order providers to obtain consents that are valid under applicable law could result in our own non-compliance with data privacy and security laws. For example, our NeXT Personal RUO test leverages WGS, and the scope of existing consents from our customers' clinical trial subjects may be insufficient to cover use of NeXT Personal on their samples, which may either limit uptake of NeXT Personal or expose our customers and ourselves to risk of exceeding the scope of prior consent for specimen testing. A failure, or a perceived failure, to address or comply with U.S. and foreign data privacy and security laws could result in government enforcement actions (which could include civil or criminal penalties), private litigation and/or adverse publicity and could negatively affect our operating results and business. Claims that we have violated individuals’ privacy rights, failed to comply with data privacy and security laws, or breached our contractual obligations, even if we are not found liable, could be expensive and time consuming to defend, could result in adverse publicity and could have a material adverse effect on our business, financial condition, and results of operations.

If we or the third parties on which we rely fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including but not limited to: government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class-action claims) and mass arbitration demands; additional reporting requirements and/or oversight; bans on processing personal information; orders to destroy or not use personal information; and imprisonment of company officials. In particular, plaintiffs have become increasingly more active in bringing data privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of

Table of Contents

statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business operations (including, clinical trials); interruptions or stoppages of data collection needed to train our algorithms; inability to process personal information or to operate in certain jurisdictions; limited ability to develop or commercialize our platform, products, and services; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations.

Our employees may engage in misconduct or other improper activities, including noncompliance with regulatory standards and requirements, which could cause significant liability for us and harm our reputation.

We are exposed to the risk of employee fraud or other misconduct, including intentional failures to comply with government regulations, including federal and state healthcare fraud and abuse laws and regulations, to misuse information, including patient information, and to report financial information or data accurately or disclose unauthorized activities to us. Such misconduct could also involve the improper use of information obtained in the course of clinical studies, which could result in regulatory sanctions and cause serious harm to our reputation.

We have a code of conduct and ethics for our directors, officers and employees, but it is not always possible to identify and deter employee misconduct, and the precautions we take to detect and prevent this activity may not be effective in controlling risks or losses or in protecting us from governmental investigations or other actions or lawsuits stemming from a failure to be in compliance with such laws or regulations. If any such actions are instituted against us, and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business and results of operations, including the imposition of significant administrative, civil and criminal penalties, damages, fines, imprisonment, exclusion from government healthcare programs, contractual damages, refunding of payments received by us, reputational harm, additional reporting, or oversight obligations if we become subject to a corporate integrity agreement or other agreement to resolve allegations of non-compliance with the law and curtailment or restructuring of our operations. Whether or not we are successful in defending against such actions or investigations, we could incur substantial costs, including legal fees, and divert the attention of management in defending ourselves against any of these claims or investigations.

Complying with numerous statutes and regulations pertaining to our business is an expensive and time-consuming process, and any failure to comply could result in substantial penalties.

Our operations are or may be subject to other extensive federal, state, local, and foreign laws and regulations, all of which are subject to change. These laws and regulations currently include, among others:

•

the federal Anti-Kickback Statute, which prohibits knowingly and willfully offering, paying, soliciting, or receiving remuneration, directly or indirectly, overtly or covertly, in cash or in kind, in return for or to induce such person to refer an individual, or to purchase, lease, order, arrange for, or recommend purchasing, leasing or ordering, any good, facility, item or service that is reimbursable, in whole or in part, under a federal healthcare program. A person or entity does not need to have actual knowledge of the statute or specific intent to violate it in order to have committed a violation. In addition, the government may assert that a claim including items or services resulting from a violation of the federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the false claims statutes;

•

the federal Stark physician self-referral law, which prohibits a physician from making a referral for certain designated health services covered by the Medicare program, including laboratory and pathology services, if the physician or an immediate family member has a financial relationship with the entity providing the designated health services, and prohibits that entity from billing or presenting a claim for the designated health services furnished pursuant to the prohibited referral, unless an exception applies. Failure to refund amounts received as a result of a prohibited referral on a timely basis may constitute a false or fraudulent claim under the False Claims Act;

•

PSNL US Equity

PSNL · 10-K · period ended 2023-12-31

Item 1A. Risk Factors.

PSNL US Equity☆

PSNL · 10-K · period ended 2023-12-31

Item 1A. Risk Factors.

PSNL US Equity