Item 1A. Risk Factors.
Our operations and financial results are subject to various risks and uncertainties including those described below. You should consider carefully the risks and uncertainties described below, in addition to other information contained in this Annual Report on Form 10-K, including our audited consolidated financial statements and related notes. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, may also become important factors that adversely affect our business. If any of the following risks or others not specified below materialize, our business, financial condition, and results of operations could be materially and adversely affected. In that case, the trading price of our common stock could decline.
Operational, Strategic and Business Risks
We have a history of losses and we expect to incur significant losses for the foreseeable future and may not be able to generate sufficient revenue to achieve or sustain profitability.
We have incurred net losses since our inception. For each of the years ended December 31, 2025 and 2024, we had a net loss of $81.3 million. As of December 31, 2025, we had an accumulated deficit of $631.3 million. To date, we have not generated sufficient revenue to achieve profitability, and we may never achieve or sustain profitability. In addition, we expect to continue to incur net losses for the foreseeable future, and we expect our accumulated deficit to continue to increase as we focus on scaling our business and operations. Our efforts to sustain and grow our business may be more costly than we expect, and we may not be able to increase our revenue sufficiently to offset our higher operating expenses. Our prior losses and expected future losses have had and will continue to have an adverse effect on our stockholders’ equity and working capital. Our failure to achieve and sustain profitability in the future would negatively affect our business, financial condition, results of operations, and cash flows, and could cause the market price of our common stock to decline.
If we are unable to increase sales of our current services or successfully develop and commercialize other services, or if we are unable to execute our sales and marketing strategy for our testing services or unable to gain sufficient acceptance in the market, or if we are unable to generate sufficient reimbursement or coverage by insurance or governmental payors for our testing services, we may fail to generate sufficient revenue to achieve profitability and sustain our business.
We currently derive substantially all of our revenue from sales of our testing services. We began offering our testing services through our CLIA-certified, CAP-accredited, and state-licensed laboratory in 2013. We are in varying stages of research and development for other services that we may offer. If we are unable to increase sales of our existing services or successfully develop and commercialize other services, we will not generate sufficient revenue to become profitable.
In addition, as a growing genomics company, we have engaged in targeted sales and marketing activities for our testing services. Although we have had revenue from sales of our testing services since 2013, our testing services may never gain significant acceptance in the marketplace and therefore may never generate substantial revenue or permit us to become profitable. We will need to further establish and grow the market for our testing services through the expansion of our current relationships and development of new relationships with biopharmaceutical customers and through gaining acceptance in medical communities. Gaining acceptance in medical communities can be supported by, among other things, publications in leading peer-reviewed journals of results from studies using our testing services. The process of publication in leading medical journals is subject to a peer review process and peer reviewers may not consider the results of our studies sufficiently novel or worthy of publication. Failure to have our studies published in peer-reviewed journals would limit the adoption of our testing services.
Our ability to successfully market our testing services that we have developed, and may develop in the future, will depend on numerous factors, including:
•
generation of sufficient reimbursement or coverage by insurance or governmental payors for our testing services;
•
our ability to demonstrate the utility and value of our testing services to our customers and potential customers;
•
the success of our commercial team, including sales and business development personnel;
•
the recruitment, hiring, and retention of our commercial team personnel;
•
whether our customers and potential customers accept that our testing services are sufficiently sensitive and specific;
•
our ability to educate our customers and potential customers of the utility of the comprehensiveness of our testing services and of testing patients at multiple time points;
•
our ability to continue to fund sales and marketing activities;
•
whether our testing services are considered superior to those of our competitors;
•
any negative publicity regarding our or our competitors’ services resulting from defects or errors;
•
our success obtaining and maintaining patent and trade secret protection for our testing services and technologies; and
16
Table of Contents
•
our success enforcing and defending intellectual property rights and claims.
Failure to achieve broad market acceptance of our testing services would materially harm our business, financial condition, and results of operations.
If we cannot compete successfully with our competitors, we may be unable to increase or sustain our revenue or achieve and sustain profitability.
Our principal competition comes from commercial and academic organizations that employ various approaches to produce information that is similar to the information that we generate for our customers. These commercial and academic organizations may not utilize our testing services or may not believe them to be superior to those tests that they currently use or others that are developed. Further, it may be difficult to educate our customers and potential customers on the benefits of our comprehensive tests compared to simpler panels provided by our competitors. For example, the information that we provide may be more challenging or require additional resources for our customers to interpret than the information provided by our competitors’ less comprehensive assays. In addition, our suppliers or competitors may announce the development of new products, services or features that results in our customers’ or potential customers’ decision to reduce, postpone or cancel orders from us while they wait to determine which products, services or features are or will be perceived as technologically superior, more commercially successful or adopted as standards in the industry; such decisions by our customers or potential customers may be influenced by their concerns regarding the potential obsolescence of data generated using our testing services and features if our testing services or features are or will not be perceived as technologically superior, commercially successful or adopted as standards in the industry.
Some of our present or potential competitors, including Adela, Inc., Caris Life Sciences, Inc., DELFI Diagnostics, Inc., Exact Sciences Corporation, which it is expected to be acquired by Abbott Laboratories, Inc., in the second quarter of 2026, Foresight, which was acquired by Natera in December 2025, Foundation Medicine Inc., GRAIL, Inc., Guardant Health, Inc., Haystack Oncology, Inc., which was acquired by Quest Diagnostics Incorporated in June 2023, Laboratory Corporation of America Holdings, MedGenome Inc., Myriad, Natera, NeoGenomics, Inc., Predicine, Inc., SAGA Diagnostics AB, and Veracyte, Inc. may have more widespread brand recognition or substantially greater financial or technical resources, development or production capacities, or marketing capabilities than we do. They may be able to devote greater resources to the development, promotion and sale of their products and services than we do or sell their products and services at prices designed to win more significant levels of market share. Also, we have had, and may have in the future, customer or supply relationships with our present or potential competitors. For example, we have an agreement with Natera to provide advanced tumor analysis for use in Natera’s MRD test. During the year ended December 31, 2025, revenue under our agreement accounted for 8% of our total revenue. See “—We have historically derived a substantial portion of our revenue from DNA sequencing and data analysis services provided to Natera. We no longer have a material commercial relationship with Natera and if we are unable to grow our customer base and diversify our revenue concentration, our business, financial condition, revenue and other operating results, and cash flows may be materially harmed.” Further, we have partnered with Tempus to expand the sales and marketing of our NeXT Personal Dx tests in four indications and Tempus could in the future develop tests that compete directly or indirectly with our tests or partner with our competitors. If Tempus were to develop competitive tests or partner with our competitors, we or Tempus may terminate the agreement and, upon termination of the agreement, we may be unable to expand our sales force timely to replace the Tempus sales and marketing efforts, which could adversely impact our business or affect our ability to commercialize our testing services. In addition, our present or potential competitors have been or may be acquired by, receive investments from, or enter into other commercial relationships with larger, more well-established and well-financed companies. We may also have disputes with our present or potential competitors. See “—Litigation or other proceedings or third-party claims of intellectual property infringement, misappropriation or other violations may require us to spend significant time and money, and could in the future prevent us from selling our tests or impact our stock price, any of which could have a material adverse effect.”
Others may develop lower-priced, less complex products and services that pharmaceutical companies could view as functionally equivalent to our current or planned future services, and our competitors may develop services with the same attributes and features as our testing services, which could force us to lower the price of our testing services and impact our operating margins and our ability to achieve and maintain profitability. In addition, companies or governments that control access to genetic testing and related services through umbrella contracts or regional preferences could promote our competitors or prevent us from performing certain services. In addition, technological innovations that result in the creation of enhanced services or diagnostic tools that are more sensitive or specific than ours may enable other clinical laboratories, hospitals, physicians, or medical providers to provide specialized services similar to ours in a more patient-friendly, efficient, or cost-effective manner than is currently possible. If we cannot compete successfully against current or future competitors, or if we cannot maintain successful customer or supply relationships with Moderna, Illumina or other present or potential competitors, we may be unable to ensure or increase market acceptance and sales of our current or planned future services, which could prevent us from increasing or sustaining our revenue or achieving or sustaining profitability.
We expect that biopharmaceutical companies will increasingly focus attention and resources on the targeted and personalized cancer diagnostic sector as the potential and prevalence of molecularly targeted oncology therapies approved by the FDA along with companion diagnostics increases. For example, the FDA has approved several such targeted oncology therapies that use companion diagnostics, including the anaplastic lymphoma kinase FISH test from Abbott Laboratories, Inc. for use with Xalkori® from Pfizer Inc., the BRAF kinase V600 mutation test from Roche Molecular Systems, Inc. for use with Zelboraf® from Daiichi-Sankyo/Genentech/Roche, and the BRAF kinase V600 mutation test from bioMerieux for use with Tafinlar® from GlaxoSmithKline. Since companion diagnostic tests are part of FDA labeling, non-FDA cleared tests, such as the ones we currently offer as part of our testing services, would be considered an off-label use and this may limit our access to this market segment. Our customers and potential customers may request, or in some cases
17
Table of Contents
have requested, that we consider developing and seeking FDA approval for companion diagnostic tests to accompany those customers’ therapeutic product candidates, and it may be necessary for us to do so in order to successfully compete for the business of these customers. If we do not successfully develop FDA-approved companion diagnostics, we may be at a competitive disadvantage and may be unable to increase market acceptance and sales of our other service or product offerings, which would prevent us from increasing or sustaining our revenue or achieving or sustaining profitability. If we were to develop one or more FDA-approved companion diagnostics, we would incur increased research and development expenses, and such activities may also divert our resources or the attention of our management and may create competing internal priorities for us. In addition, we have limited experience developing diagnostics, have never developed an FDA-approved companion diagnostic, and may be unable to successfully compete against companies with more experience developing and commercializing companion diagnostics.
Additionally, projects related to cancer diagnostics and particularly genomics have in the past received, and may in the future receive, increased government funding, both in the United States of America (the “U.S.”) and internationally. As more information regarding cancer genomics becomes available to the public, we anticipate that more products and services aimed at identifying treatment options will be developed and that these products and services may compete with our testing services. In addition, competitors may develop their own versions of our current or planned future services in countries where we did not apply for or receive patents and compete with us in those countries, including encouraging the use of their products or services by biopharmaceutical companies in other countries.
We have substantial customer concentration, with a limited number of customers accounting for a substantial portion of our revenue and accounts receivable; in particular, we currently derive a substantial portion of our revenue from two of our largest customers, Moderna and the VA MVP, and in the past have derived a substantial portion of our revenue from other large customers.
Like other genomic profiling companies that sell to the pharmaceutical industry, we have substantial customer concentration. We currently derive a significant portion of our revenue from Moderna, which accounted for 22% and 28% of our revenue for the years ended December 31, 2025 and 2024, respectively. We also derive a significant portion of our revenue from the VA MVP, which accounted for 17% and 9% of our revenue for the years ended December 31, 2025 and 2024, respectively. We previously derived a significant portion of our revenue from Natera, which accounted for 8% and 30% of our revenue for the years ended December 31, 2025 and 2024, respectively. Our top five customers, including Moderna, the VA MVP and Natera, accounted for 62% and 81% of our revenue for the years ended December 31, 2025 and 2024, respectively. There are inherent risks whenever a large percentage of revenue is concentrated with a limited number of customers. While we have attempted to grow our customer base and diversify our revenue concentration beyond Moderna, the VA MVP and Natera, we may not be able to successfully do so in the future. Our predictions regarding the future level of demand for our testing services that will be generated by these customers may be wrong. In addition, revenue from our larger customers have historically fluctuated and may continue to fluctuate based on the commencement and completion of clinical trials or other projects, the timing of which may be affected by market conditions or other factors, some of which may be outside of our control. Some of our customers have in the past suspended or terminated clinical trials or projects, received less funding than expected, experienced declining or delayed sales, or otherwise decided to reduce or eliminate their use of our testing services, and these and other customers may also do so in the future. As a result, we could be pressured to reduce the prices we charge for our testing services, which would have an adverse effect on our margins and financial position, and which would likely negatively affect our revenue and results of operations. In particular, if we do not win future VA MVP renewals with a value comparable to that of our historical contracted orders, it may have a material adverse effect on our revenue, cash position, and results of operations. See “—We derive a substantial portion of our revenue from DNA sequencing and data analysis services that we provide to one of our largest customers, the VA MVP. If the VA MVP’s demand for and/or funding for our DNA sequencing and data analysis services continues to be substantially reduced, or if our new contract with the VA MVP were to be terminated, our business, financial condition, revenue and other operating results, and cash flows will be materially harmed.” Similarly, if the VA MVP was eliminated, awarded its contract to one of our competitors, further reduced the size of our contract or failed to renew our contract in the future, then our revenue, cash position, and results of operations would be materially adversely impacted. Likewise, if Moderna or any of our other significant customers were to reduce or cease their use of our testing services, then our revenue, cash position, and results of operations may be materially adversely impacted. Further, if any of our significant customers were to stop payment for our testing services, it would have a material adverse effect on our accounts receivable, increasing our credit risk. The failure of these customers to pay their balances, or any customer to pay future outstanding balances, would result in an operating expense and reduce our cash flows.
We have historically derived a substantial portion of our revenue from DNA sequencing and data analysis services provided to Natera. We no longer have a material commercial relationship with Natera and, if we are unable to grow our customer base and diversify our revenue concentration, our business, financial condition, revenue and other operating results, and cash flows may be materially harmed.
In February 2021, we entered into a partnership in the field of personalized oncology with Natera, pairing our NeXT tumor profiling and diagnostic services with Natera’s personalized ctDNA test SignateraTM for treatment monitoring and MRD assessment. Under this non-exclusive agreement, Natera is responsible for validating the design of, and commercialization of, Signatera personalized ctDNA assays using matched tumor and normal exome sequence data from us. The agreement covers MRD testing for both clinical use and research use. Since that time, Natera’s sample volumes have increased such that we currently derive a significant portion of our revenue from sales of our DNA sequencing and data analysis services to Natera under our agreement. For example, revenue under our agreement with Natera accounted for 30% of our total revenue for the year ended December 31, 2024 and only 8% of our total revenue for the year ended December 31, 2025. In December 2024, we amended our agreement with Natera to extend minimum volume
18
Table of Contents
commitments through the second quarter of 2025, after which such commitments expired and were not renewed. We no longer have a material commercial relationship with Natera and do not expect to have one going forward, as we are aware that Natera brought such services in-house in lieu of purchasing such services from us. We are also aware of at least one third party supplier of DNA sequencing and analysis services, such that Natera has elected, and may continue to elect in the future, to send a portion (or all) of its samples to its other supplier(s) instead of us, which it is not contractually prohibited from doing, given the non-exclusive nature of our agreement.
Additionally, Natera or other customers may allege that any failures to achieve the required metrics are a breach of our agreement and seek to terminate our agreement prior to its expiration and/or pursue any remedies available to it under the agreement, at law or in equity. Relatedly, we have incurred expenses in connection with our scale-up activities under our agreement with Natera, and we may incur additional expenses in the future to increase our laboratory’s capacity to process increased sample volumes from our other customers. Our activities under our agreement with Natera have had, and activities with our other customers may in the future have, an impact on our business, including diversion of our resources and the attention of our management, including with respect to our internal research and development objectives and projects for our other customers, collaborators and/or partners. If we are unable to successfully increase our laboratory’s capacity and manage any such competing objectives and/or projects for other customers, we may be unable to meet the quality and timing requirements of our agreement with Natera or our other customers, collaborators and/or partners. We may also be unable to successfully research, develop, launch and/or commercialize our testing services or service capabilities. Furthermore, our NeXT Personal test is a next-generation, tumor-informed liquid biopsy assay designed to detect and quantify MRD and recurrence in patients previously diagnosed with cancer. If NeXT Personal or any of our other services is seen as competing with Signatera or any of Natera’s other services, we will still be required to fulfill our obligations to Natera under our agreement, although Natera may elect to send a portion (or all) of its samples to its other supplier(s) and/or bring such services in-house. If the volume of samples received under our agreement with Natera were to be significantly reduced or eliminated, or if our agreement with Natera were to be terminated or not renewed after expiration, and we are unable to grow our customer base and diversify our revenue concentration timely, our business, financial condition, revenue and other operating results, and cash flows may be materially harmed.
We derive a substantial portion of our revenue from DNA sequencing and data analysis services that we provide to one of our largest customers, the VA MVP. If the VA MVP’s demand for and/or funding for our DNA sequencing and data analysis services continues to be substantially reduced, or if our new contract with the VA MVP were to be terminated, our business, financial condition, revenue and other operating results, and cash flows will be materially harmed.
We derive a substantial portion of our revenue from sales of our DNA sequencing and data analysis services to the VA MVP. In September 2017, we entered into a one-year contract with three one-year optional renewal periods with the VA for the VA MVP, pursuant to which we received contracted orders from the VA MVP in September 2017, 2018, 2019, 2020, and 2021. In September 2022, we entered into a new contract with the VA MVP to continue providing them WGS services and received an initial task order with a value of up to $10.0 million (the "2022 VA MVP Agreement"). The performance period under the new contract includes a base period of one year, with four one-year renewal option periods that may be exercised upon discretion of the VA MVP. In August 2025, we received a fourth task order with a value of up to $13.5 million. There is no guarantee that the VA MVP will exercise any subsequent renewal option.
The VA MVP’s contracted orders for DNA sequencing and data analysis services have fluctuated significantly in value over time and are subject to the availability of funding, enrollment of veterans in the VA MVP study, and the VA MVP’s continued demand, if any, for our testing services among other factors. For example, the VA MVP contracted order received in September 2020 had a value of $30.9 million, whereas annual orders (other than 2025) received in subsequent years had values of $10.0 million, or less, which represents a substantial decline. We have no certainty that funding will be made available for our testing services, or that the VA MVP will honor its payment obligations under the current contract and task order, or award any future contracts, contract renewals or contracted orders to us. The priorities of the VA, the VA MVP, or the U.S. government may change, including in response to a health epidemic pandemic, or federal cost-cutting initiatives such as those recently announced and enacted by the current administration. Future task orders from the VA MVP for our DNA sequencing and data analysis services may be reduced or eliminated as a result of reductions in government research spending and federal cost-cutting initiatives. For example, funding for our testing services may be limited or not available, and our business, financial condition, and operating results and cash flows will be materially harmed. Similarly, if we do not win future VA MVP contracts and renewals (whether due to being outbid by a competitor or the VA MVP’s decision not to award a future contract on a timely basis or at all, or to terminate for convenience or failure to renew any contract, for whatever reason) with a value comparable to that of our historical contracted orders, our business, financial condition, revenue and other operating results and cash flows may be materially harmed.
We have only recognized revenue under our VA MVP contract upon the receipt and processing of samples, and the timing and number of VA MVP samples we have received has been and could in the future be negatively affected by factors beyond our control, which has resulted, and may result in the future, in delaying our ability to process and recognize revenue for such samples. For example, the revenue we recognized during the contract year that began in September 2020 significantly exceeded the value of the VA MVP contracted order we received in September 2020 because we continued to receive after such date, and subsequently processed, samples under VA MVP contracted orders that remained unfulfilled as of September 2020 due to the time required for the VA to select optimal samples from its collection for research and then provide us those samples. Therefore, period-to-period comparisons of our operating results relating to VA MVP contracted orders may not be meaningful. The timing and number of VA MVP samples may also be negatively affected by a public health crisis. For example, in March 2020, the VA MVP announced that it was suspending sample collection due to the COVID-19 pandemic. In addition, we believe the COVID-19 pandemic may have been a contributing factor to the reduction in values of contracted orders received in 2021 and later years compared to the September 2020 contract order, as the VA MVP delayed new
19
Table of Contents
enrollment and also may have needed to divert resources to respond to the pandemic. Another health epidemic or pandemic may negatively impact the value of any potential new VA MVP contract or order.
If we cannot maintain our current customer relationships, or fail to acquire new customers, our revenue prospects will be reduced. Many of our customers are biopharmaceutical companies engaged in clinical trials of new drug candidates, which trials are expensive, can take many years to complete, and have inherently uncertain outcomes.
Our corporate customers, other than Natera, are primarily biopharmaceutical companies that use our testing services to support clinical trials, including Moderna. Our future success is substantially dependent on our ability to maintain our customer relationships and to establish new ones. Many factors have the potential to impact our customer relationships, including the type of support our customers and potential customers require and our ability to deliver it, our customers’ satisfaction with our testing services, and other factors that may be beyond our control. Furthermore, our customers may decide to decrease or discontinue their use of our testing services due to changes in research and product development plans (including as a result of a public health crisis), failures in their clinical trials (which failures are statistically much more likely to occur than not at some point in the clinical development process, notwithstanding any enhanced patient stratification from the use of our proprietary tests and algorithms), financial constraints, or utilization of internal testing resources or tests performed by other parties, or other circumstances outside of our control.
We engage in conversations with corporate customers regarding potential commercial opportunities on an ongoing basis in the event that one of these customers’ drug candidates is approved. There is no assurance that any of these conversations will result in a commercial agreement, or if an agreement is reached, that the resulting relationship will be successful or that clinical studies conducted as part of the engagement will produce successful outcomes. Speculation in the industry about our existing or potential relationships with biopharmaceutical companies could be a catalyst for adverse speculation about us, our testing services, and our technology, which can adversely affect our reputation and our business. In addition, the termination of these relationships could result in a temporary or permanent loss of revenue.
Our corporate customers’ clinical trials are expensive, can take many years to complete, and their outcome is inherently uncertain. Failure can occur at any time during the clinical trial process. Product candidates in later stages of clinical trials may fail to show the desired safety and efficacy traits despite having progressed through pre-clinical studies and early clinical trials. Many of the biopharmaceutical companies that are our customers do not have products approved for commercial sale and are not profitable. These customers must continue to raise capital in order to continue their development programs and to potentially continue as our customers. If our customers’ clinical trials fail or they are unable to raise sufficient capital to continue investing in their clinical programs, our revenue from these customers may decrease or cease entirely, and our business may be harmed. Furthermore, even if these customers have a drug approved for commercial sale, they may not choose to use our testing services as a companion diagnostic with their drug or they may impose additional customization requirements for commercialization, thereby limiting our potential revenue and profits.
Building our clinical laboratory business is subject to a number of reimbursement challenges and we may not be able to establish the medical necessity of our tests for coverage or reimbursement rates that cover our costs.
The coverage and reimbursement status of newly-approved or cleared laboratory developed tests, including our NeXT Dx and NeXT Personal Dx testing services, is uncertain. We are seeking reimbursement for our NeXT Dx and NeXT Personal Dx tests, and other in vitro diagnostic tests we may develop, and if such tests are inadequately covered by insurance or ineligible for such reimbursement, this could limit our ability to derive revenue from any such current or future tests. The commercial success of current or future services in both domestic and international markets may depend in part on the availability of coverage and adequate reimbursement from third-party payors, including government payors, such as the Medicare and Medicaid programs, or equivalent foreign programs, managed care organizations, and other third-party payors. The government and other third-party payors are increasingly attempting to contain health care costs by limiting both insurance coverage and the level of reimbursement for new diagnostic tests. As a result, they may not cover or provide adequate payment for any current or future in vitro diagnostic tests that we develop. These payors may conclude that our testing services are not medically necessary, or are less safe, less effective, or less cost-effective than existing or later-introduced services. These payors may also conclude that the overall cost of using one of our tests exceeds the overall cost of using a competing test, and third-party payors may not approve any current or future in vitro diagnostic tests we develop for insurance coverage and adequate reimbursement.
In January 2024, we announced that we received a final Medicare coverage determination for our NeXT Dx offering, extended retroactively to August 29, 2023. In November 2025, we announced that we received Medicare coverage for NeXT Personal Dx for post-treatment surveillance of cancer recurrence in patients with Stage II and III breast cancer, with an effective date of October 7, 2025. In February 2026, we also announced that we received Medicare coverage for NeXT Personal Dx for surveillance of patients with Stage I to III NSCLC with an effective date of January 9, 2026. While we estimate that approximately half of new solid tumor cancer cases will be diagnosed in patients covered by Medicare, the Medicare coverage determination may not be indicative of our ability to obtain coverage with other payors. Even if favorable coverage and reimbursement status is attained for one or more of our testing services, less favorable coverage policies and reimbursement rates may be implemented in the future.
We are pursuing a partner-centric strategy and have key relationships with Tempus, Myriad, Moderna and Merck, among others. These and any other partnering and/or collaboration arrangements that we have entered into or may
20
Table of Contents
enter into in the future may not be successful, or may terminate, which could adversely impact our business or affect our ability to develop and commercialize our testing services.
Any current or future collaborations, including any strategic alliances or any collaborations to develop companion diagnostic tests, that we have entered (for example, our strategic alliances with Moderna and Merck; and our collaborations with Tempus; Myriad; ClearNote Health, Inc.; Cancer Research UK, University College London, and the Francis Crick Institute (the TRACERx study); Institut Curie; The Royal Marsden; the Vall d'Hebron Institute of Oncology (VHIO); the University of California, San Diego; Duke University; Vanderbilt University and Johns Hopkins University (the PREDICT study); the Dana-Farber Cancer Institute; the University of Texas M.D. Anderson Cancer Center; University Medical Center Hamburg-Eppendorf (also known as UKE); Criterium and the Academic Breast Cancer Consortium; Yale Cancer Center; Aarhus University; British Columbia Cancer; and University Health Network, or may enter into may not be successful. The success of our collaboration arrangements will depend heavily on the efforts and activities of our collaborators. Collaborations are subject to numerous risks, which include that:
•
we may incur increased research and development expenses, and such activities may also divert management attention and resources and/or create competing internal priorities for us, which could prevent us from successfully conducting other parts of our business or collaborating with others;
•
collaborators have significant discretion in determining the efforts and resources that they will apply to collaborations;
•
collaborators may not pursue development and commercialization of our testing services or may elect not to continue or renew development or commercialization programs based on trial or test results, changes in their strategic focus due to the acquisition of competitive services or products, availability of funding, or other external factors, such as a business combination that diverts resources or creates competing priorities for our collaborator;
•
collaborators could independently develop, or develop with third parties, services that compete directly or indirectly with our testing services;
•
collaborators with marketing, manufacturing, and distribution rights to one or more services or products may not commit sufficient resources to or otherwise not perform satisfactorily in carrying out these activities;
•
we could grant exclusive rights to our collaborators that would prevent us from collaborating with others;
•
a large percentage of our revenue may be concentrated with the collaborators if the collaborations are successful and we may experience further losses if they are or later become unsuccessful;
•
collaborators may not properly maintain or defend our intellectual property rights or may use our intellectual property or proprietary information in a way that gives rise to actual or threatened litigation that could jeopardize or invalidate our intellectual property or proprietary information or expose us to potential liability;
•
disputes may arise between us and a collaborator that causes the delay or termination of the research, development, or commercialization of our current or future services or that results in costly litigation or arbitration that diverts management attention and resources;
•
collaborations may be terminated, and, if terminated, may result in a need for additional capital to pursue further development or commercialization of the applicable current or future services;
•
collaborators may own or co-own intellectual property covering our testing services that results from our collaborating with them, and in such cases, we would not have the exclusive right to develop or commercialize such intellectual property;
•
collaborators’ activities or use of our testing services or deliverables may create additional regulatory obligations and could lead to side effects or adverse events in patients, exposing us to potential liability or regulatory review;
•
collaborators’ sales and marketing activities or other operations may not be in compliance with applicable laws resulting in civil or criminal proceedings; and
•
we may choose or our collaborators may request or require us to expand our facilities and/or establish new facilities domestically and/or internationally, which may significantly increase our expenses and divert resources and management’s attention. See “—We may need to continue to invest in our infrastructure in advance of increased demand for our testing services; our failure to accurately forecast demand would have a negative impact on our business and our ability to achieve and sustain profitability.” and “—Expansion into international markets would subject us to increased regulatory oversight and regulatory, economic, social, health and political uncertainties, which could cause a material adverse effect on our business, financial position, and results of operations.”
If we are unable to successfully obtain rights to required third-party intellectual property rights or maintain the existing intellectual property rights we have, we may have to abandon development of that program and our business and financial condition could suffer.
21
Table of Contents
We rely on a limited number of suppliers, or in some cases, a sole supplier, for some of our laboratory instruments and materials, and we may not be able to find replacements or immediately transition to alternative suppliers should we need to do so.
We rely on a limited number of suppliers for sequencers and other equipment and materials that we use in our laboratory operations. For example, we rely on Illumina as our sole supplier of sequencers and various associated reagents and other materials used in our routine laboratory operations, and as the sole provider of maintenance and repair services for these sequencers. Any disruption in Illumina’s operations or our inability to negotiate pricing with Illumina on acceptable terms, or at all, could negatively impact our supply chain and laboratory operations and our ability to conduct our business and generate revenue. Additionally, COVID-19 previously disrupted Illumina’s ability to fulfill our purchase orders for reagents or other materials in a timely manner and another health epidemic or pandemic may disrupt the ability of Illumina and our other suppliers to fulfill our purchase orders in a timely manner or at all. Our suppliers, including Illumina, could cease supplying these materials and equipment at any time, could increase the price of these materials or equipment (including the promotional pricing offered to us by Illumina for our 2022 VA MVP Agreement and certain other projects) or fail to provide us with sufficient quantities of materials or equipment that meet our specifications. Our laboratory operations have been and in the future could be interrupted if we encounter delays or difficulties in securing sequencers or other equipment or materials, or if we cannot obtain an acceptable substitute. We have also experienced, and may experience in the future, delays or difficulties in upgrading to newer versions or replacements of these materials and equipment, which may have better performance or be more cost-effective than the current versions. Any such interruption, delay or difficulty could significantly affect our business, financial condition, results of operations, and reputation.
We believe that there are only a few manufacturers other than Illumina that are currently capable of supplying and servicing the equipment necessary for our laboratory operations, including sequencers and various associated reagents. Likewise, we believe that there are a limited number of manufacturers and suppliers for other reagents and materials necessary for our laboratory operations, such as the sample preparation reagents required for our ACE technology, which enables our NeXT Platform to provide more comprehensive sequencing coverage, as well as those required to create personalized liquid biopsy panels for each patient as part of our NeXT Personal assay. Although we have evaluated and may continue in the future to evaluate equipment and materials from other suppliers, the use of equipment or materials provided by these replacement suppliers would require us to alter our laboratory operations. Transitioning to a new supplier would be time-consuming and expensive, would likely result in interruptions in our laboratory operations, could affect the performance specifications of our laboratory operations, or could require that we revalidate our tests. Additionally, an existing supplier of ours may allege that such activities constitute a breach of its agreement with us and may cease supplying us with sufficient quantities of materials or equipment that meet our specifications, in a timely manner or at all. Moreover, an existing supplier or third party may allege that such activities, replacement equipment or materials infringe, misappropriate or otherwise violate its intellectual property, and may bring infringement or other intellectual property-related claims against us. See “—Litigation or other proceedings or third-party claims of intellectual property infringement, misappropriation or other violations may require us to spend significant time and money, and could in the future prevent us from selling our tests or impact our stock price, any of which could have a material adverse effect.” We cannot assure you that, if we were forced to replace Illumina or another supplier on which we rely, we would be able to secure alternative equipment, reagents, and other materials, and bring such equipment, reagents, and other materials on-line and revalidate them without experiencing interruptions in our workflow. If we encounter delays or difficulties in securing, reconfiguring, or revalidating the equipment and reagents we require for our testing services, our business, financial condition, results of operations, and reputation could be adversely affected.
In addition, the Device Master Files that we filed with the FDA, which are focused on the technology, quality management, and validation of our platform, specifically on its use for the development of personalized immunotherapies, are predicated on our use of specified equipment and processes, including Illumina sequencers and related equipment. The detailed information in the Device Master Files is not shared with our customers, but with our permission they can reference our FDA file numbers in their Investigational New Drug filings with the FDA. If we were required to transition to a new supplier of sequencers or certain other equipment or processes in our laboratory, our Device Master Files would need to be replaced or updated, and until such time as that occurred, customers for which we deliver services after the transition would not be able to reference our Device Master Files, which would cause us to lose a competitive advantage.
International trade policies, including tariffs, sanctions and trade barriers may adversely affect our business, financial condition, results of operations and prospects.
We operate in a global economy, which includes partners and suppliers in certain countries outside the United States. There is inherent risk, based on the complex relationships among the U.S. and the countries in which our partners and suppliers reside, that political, diplomatic, and national security factors can lead to global trade restrictions and changes in trade policies and export regulations that may adversely affect our business and operations. The current international trade and regulatory environment is subject to significant ongoing uncertainty. The U.S. government has announced substantial new tariffs affecting a wide range of products and jurisdictions and has indicated an intention to continue developing new trade policies, including with respect to the pharmaceutical industry. In response, certain foreign governments have announced or implemented retaliatory tariffs and other protectionist measures. These developments have created a dynamic and unpredictable trade landscape, which may adversely impact our business, results of operations, financial condition and prospects.
22
Table of Contents
We do not own or operate, and currently have no plans to establish, any manufacturing facilities. We currently rely, and expect to continue to rely, on third parties for the manufacture of the specialized laboratory equipment, raw materials and other supplies we use in our business. Currently, certain of our direct suppliers are located outside of the United States. In addition, our suppliers in the United States source or may source components of the products we purchase from them from sources outside the United States. Current or new tariffs may adversely impact our supply chain.
Unlike many industries, our ability to pass increased costs to customers is limited by the structure of reimbursement systems and, if the FDA determines our tests are subject to enforcement as medical devices, medical device pricing. The pricing of many of our testing services are, or will be, established through annual or multi-year contracts with commercial, third-party payors, customers, and group purchasing organizations, and reimbursement methodologies established by government programs, such as Medicare. These arrangements typically include fixed pricing terms that may be negotiated prior to the implementation of the recently announced tariffs. As a result, and depending on the timing and scope of the implementation of these tariffs, cost increases due to tariffs may be difficult or impossible to pass through to customers until the next negotiation cycle, which could be years away.
Current or future tariffs may also result in increased research and development expenses, including with respect to increased costs associated with raw materials, laboratory equipment and research materials and components. Trade restrictions affecting the import of materials necessary for our tests could result in increased costs to process tests and delays to delivery of our testing services. Increased costs and extended delivery timelines could place us at a competitive disadvantage compared to companies operating in regions with more favorable trade relationships and could reduce investor confidence and negatively impact our business, results of operations, financial condition and growth prospects.
The complexity of announced or future tariffs may also increase the risk that we or our customers or suppliers may be subject to civil or criminal enforcement actions in the United States or foreign jurisdictions related to compliance with trade regulations. Foreign governments may also adopt non-tariff measures, such as procurement preferences or informal disincentives to engage with, purchase from or invest in U.S. entities, which may limit our ability to compete internationally and attract non-U.S. investment, employees, customers and suppliers. Foreign governments may also take other retaliatory actions against U.S. entities, such as decreased intellectual property protection, increased enforcement actions, or delays in regulatory approvals, which may result in heightened international legal and operational risks. In addition, the United States and other governments have imposed and may continue to impose additional sanctions, such as trade restrictions or trade barriers, which could restrict us from doing business directly or indirectly in or with certain countries or parties and may impose additional costs and complexity to our business.
Trade disputes, tariffs, restrictions and other political tensions between the United States and other countries may also exacerbate unfavorable macroeconomic conditions including inflationary pressures, foreign exchange volatility, financial market instability, and economic recessions or downturns. The ultimate impact of current or future tariffs and trade restrictions remains uncertain and could materially and adversely affect our business, financial condition, and prospects. While we actively monitor these risks, any prolonged economic downturn, escalation in trade tensions, or deterioration in international perception of U.S.-based companies could materially and adversely affect our business, ability to access the capital markets or other financing sources, results of operations, financial condition and prospects. In addition, tariffs and other trade developments have and may continue to heighten the risks related to the other risk factors described elsewhere in this report.
We have a single facility and if it becomes damaged or inoperable, or we are required to vacate our facility, our ability to sell and provide our testing services and pursue research and development efforts may be jeopardized.
We currently derive our revenue from our genomic analysis conducted in our laboratories. Currently, our only clinical reference or research and development laboratory facility is in Fremont, California. Our laboratory facility and equipment could be harmed or rendered inoperable by natural or man-made disasters, including fires, earthquakes, flooding, and power outages, which may render it difficult or impossible for us to sell or perform our testing services for some period of time. Northern California continues to experience serious fires and the San Francisco Bay Area is considered to lie in an area with earthquake risk. The inability to sell or to perform our sequencing and analysis services, disruptions in our operations, or the backlog of samples that could develop if our laboratory facility is inoperable for even a short period of time, may result in the loss of customers or harm to our reputation or relationships with scientific or clinical collaborators, and we may be unable to regain those customers or repair our reputation or such relationships in the future. For example, from January 2023 through April 2023, we experienced substantial disruption to use of our laboratory facility due to a failure of an electrical bus duct serving that facility. Furthermore, our laboratory facility and the equipment we use to perform our testing services and our research and development work could be costly and time-consuming to repair or replace.
Additionally, a key component of our research and development process involves using biological samples as the basis for the development of our testing services, and our testing services typically involve using biological samples provided by or on behalf of our customers or collaborators. In some cases, these samples are difficult to obtain. If the parts of our laboratory facility where we store these biological samples were damaged or compromised, or if these biological samples or the resulting data were otherwise lost, damaged or compromised due to equipment malfunction, human error or other causes, our ability to pursue our research and development projects or provide our testing services, as well as our reputation, could be jeopardized. For example, we have experienced from time to time, and may experience in the future, equipment malfunctions that have resulted in lost, damaged or compromised samples or resulting data. We carry insurance for damage to our property or to our customer's property while in our possession, and we also carry insurance for the
23
Table of Contents
disruption of our business, but these types of insurance may not be sufficient to cover all of our potential losses or liabilities and may not continue to be available to us on acceptable terms, if at all.
Further, if our laboratory facility becomes inoperable, we would likely not be able to license or transfer our technology to other facilities with the qualifications, including state licensure and CLIA certification, that would be necessary to cover the scope of our current and our planned future services. Even if we were to find facilities with such qualifications to perform our testing services, they may not be available to us on commercially reasonable terms.
Our success depends on our ability to provide reliable and timely, high-quality genomic data and analyses and to rapidly evolve to meet our customers’ needs.
Errors, including if our tests fail to accurately detect gene variants, or mistakes, or any other quality issues, including if we fail to or incompletely or incorrectly identify the significance of gene variants, could have a significant adverse impact on our business. We classify variants in accordance with guidelines that are subject to change and subject to our interpretation. There have also been and could in the future be flaws in the databases, third-party tools or algorithms we use, or in the software that handles automated parts of our classification protocol. If we receive poor quality or degraded samples, our tests may be unable to accurately detect gene variants or we may fail to or incompletely or incorrectly identify the significance of gene variants, which could have a significant adverse impact on our business, including our customers returning our tests. In addition, our customers require timely turnaround of high-quality genomic data and analyses, and if we were not able to meet our customers’ specific requirements, it could also have a significant adverse effect on our business. Many of our agreements with our customers grant our customers the right to audit our quality assurance processes. If we fail to meet the standards required by these audits, or if we are unable to remediate any deficient findings from these audits, in a timely manner our customers may terminate their agreements with us and it could have an adverse effect on our business, reputation, and results of operations.
Inaccurate results or misunderstandings of, or inappropriate reliance on, the information we provide to our customers could lead to, or be associated with, lack of efficacy, side effects or adverse events in patients who use our tests, or who rely on our tests to determine therapies to develop, select or monitor, including treatment-related death, and could lead to termination of our testing services or result in claims against us. A product liability or professional liability claim could result in substantial damages and be costly and time-consuming for us to defend.
Although we maintain liability insurance, including for errors and omissions and professional liability, we cannot assure you that our insurance would be sufficient to protect us from the financial impact of defending against these types of claims, or any judgments, fines, or settlement costs arising out of any such claims. Any liability claim, including an errors and omissions liability claim, brought against us, with or without merit, could increase our insurance rates or prevent us from securing insurance coverage in the future. Additionally, any liability lawsuit could cause injury to our reputation or cause us to suspend sales of our tests or cause a suspension of our license to operate. The occurrence of any of these events could have an adverse effect on our business, reputation, and results of operations.
If we cannot develop services to keep pace with rapid advances in technology, medicine, and science, or if we experience delays in developing such services, our operating results and competitive position could be harmed.
In recent years, there have been numerous advances in technologies relating to the diagnosis and treatment of cancer. Several new cancer drugs have been approved, and a number of new drugs are in pre-clinical and clinical development. There have also been advances in methods used to identify patients likely to benefit from these drugs based on analysis of biomarkers. We must continuously develop new services, enhance any existing services, and avoid delays in such developments and enhancements to keep pace with evolving technologies on a timely and cost-effective basis. Our current services and our planned future services could become obsolete unless we continually innovate and expand them to demonstrate benefit in the diagnosis, monitoring, or prognosis of patients with cancer. New cancer therapies typically have only a few years of clinical data associated with them, and much of that data may not be disclosed by the pharmaceutical company that conducted the clinical trials. This could limit our ability to develop services based on, for example, biomarker analysis related to the appearance or development of resistance to those therapies. If we cannot adequately demonstrate the clinical utility of our testing services and our planned future services to new treatments, sales of our testing services could decline, which would have a material adverse effect on our business, financial condition, and results of operations.
We are researching and developing improvements to our tests and test features on a continuous basis, but we may not be able to make these improvements on a timely basis, and even if we do, we may not realize the benefits of these efforts in our financial results.
To remain competitive, we must continually research and develop improvements to our tests or test features. However, we cannot assure you that we will be able to develop and commercialize the improvements to our tests or test features on a timely basis. Our competitors may develop and commercialize competing or alternative tests and improvements faster than we are able to do so. In addition, we must expend significant time and funds in order to conduct research and development, further develop and scale our laboratory processes, and further develop and scale our infrastructure. We may never realize a return on investment on this effort and expense, especially if our improvements fail to perform as expected. If we are not able to realize the benefits of our efforts to improve our tests or test features, it could have an adverse effect on our business, financial condition, and results of operations.
24
Table of Contents
Personalized cancer therapies represent new therapeutic approaches that could result in heightened regulatory scrutiny, delays in clinical development, or delays in or inability to achieve, regulatory approval, commercialization, or payor coverage, any of which could adversely affect our business.
We currently work with certain companies developing personalized cancer therapies, and our future success will in part depend on our personalized cancer customers obtaining regulatory approval for and commercializing their product candidates. Because personalized cancer therapies represent a new approach to immunotherapy for the treatment of cancer and other diseases, developing and commercializing personalized cancer therapies is subject to a number of challenges.
Actual or perceived safety issues, including adoption of new therapeutics or novel approaches to treatment, may adversely influence the willingness of subjects to participate in clinical studies, or if approved by applicable regulatory authorities, of physicians to subscribe to the novel treatment mechanics. The FDA or other applicable regulatory authorities may ask for specific post-market requirements, and additional information regarding benefits or risks of our testing services may emerge at any time prior to or after regulatory approval.
In the European Economic Area (and Northern Ireland) (“EEA”), in order to place an in vitro diagnostic medical device ("IVD"), or an accessory to an IVD, on the market, or put it into service in the EEA, the device must be designed, developed, manufactured and marketed in compliance with the relevant legal framework. On May 26, 2022, the Regulation on In-Vitro Diagnostic Devices (Regulation (EU) 2017/746) (“IVDR”) entered into application, repealing and replacing the Directive on In-Vitro Diagnostic Devices (98/79/EC) (the “IVDD”). The IVDR and its associated guidance documents and harmonized standards govern, among other things, device design and development, preclinical and clinical or performance testing, premarket conformity assessment, registration and listing, manufacturing, labeling, storage, claims, sales and distribution, export and import and post-market surveillance, vigilance, and market surveillance. IVDs must comply with the General Safety and Performance Requirements set out in Annex I of the IVDR. Compliance with these requirements is a prerequisite to be able to affix the CE Mark to IVDs, without which they cannot be marketed or sold in the EEA.
In accordance with the IVDR, devices that are not placed on the market but are used within the context of a commercial activity, whether in return for payment or free of charge, for the provision of a diagnostic or therapeutic service offered by means of information society services, as defined in point (b) of Article 1(1) of Directive (EU) 2015/1535, or by other means of communication, directly or through intermediaries, to a natural or legal person established in the EEA (and Northern Ireland) will be subject to the IVDR. As a result, diagnostic and therapeutic services offered to customers in the EEA (and Northern Ireland) (whether directly or via intermediaries) by providers that are based outside the EEA will be covered by the IVDR.
Fulfillment of the obligations imposed by the IVDR are likely to increase the cost and time required in order to obtain regulatory approval for products and services in the EEA. If we offer tests or services to customers within the EEA (and Northern Ireland) (whether directly or via intermediaries) that fall within the scope of the IVDR, we may be unable to fulfill these obligations, or a notified body, where applicable, may consider that we have not adequately demonstrated compliance with our related obligations to merit a CE Certificate of Conformity on the basis of the IVDR. Our ability, and the ability of our customers, to commercialize diagnostic tests based on our technology will depend in part on the extent to which coverage and reimbursement for these tests will be available from third-party payors. Coverage and reimbursement of new products and services is uncertain, and whether the companies that use our tests or services to develop their own products or services will attain coverage and adequate reimbursement is unknown. In the U.S. and the EU, there is no uniform policy for determining coverage and reimbursement. Coverage can differ from payor to payor, and the process for determining whether a payor will provide coverage may be separate from the process for setting the reimbursement rate. In addition, the U.S. government, state legislatures and foreign governments have shown significant interest in implementing cost containment programs to limit the growth of government-paid healthcare costs, including price controls and restrictions on reimbursement.
Physicians, hospitals, and third-party payors often are slow to adopt new products, services, technologies, and treatment practices that require additional upfront costs and training. Physicians may not be willing to undergo training to adopt personalized cancer therapies, may decide that such therapies are too complex to adopt without appropriate training or not cost-efficient, and may choose not to administer these therapies. Based on these and other factors, hospitals and payors may decide that the benefits of personalized cancer therapies do not or will not outweigh their costs.
The loss of key members of our executive management team could adversely affect our business.
Our success in implementing our business strategy depends largely on the skills, experience, and performance of key members of our executive management team and others in key management positions. The collective efforts of each of our executives and others working with them as a team are critical to us as we continue to develop our technologies, services, and research and development programs. As a result of the difficulty in locating qualified new management, the loss or incapacity of existing members of our executive management team could adversely affect our operations. If we were to lose one or more of these key employees, we could experience difficulties in finding qualified successors, competing effectively, developing our technologies, and implementing our business strategy. If there are changes to our leadership team, there is a risk to organizational effectiveness and employee retention as well as the potential for disruption to our business. Integrating members into new or different management roles could prove disruptive to our operations, require substantial resources and management attention and ultimately prove unsuccessful. Each member of our executive management team has an employment agreement; however, the existence of an employment agreement does not guarantee retention of members of
25
Table of Contents
our executive management team, and we may not be able to retain those individuals or replace them in the event we lose their services. We do not maintain “key person” life insurance on any of our employees.
In addition, we rely on collaborators, consultants, and advisors, including scientific and clinical advisors, to assist us in formulating our research and development and commercialization strategy. Our collaborators, consultants, and advisors are generally self-employed or employed by employers other than us and may have commitments under agreements with other entities that may limit their availability to us.
The loss or extended illness of a key employee, the failure of a key employee to perform in his or her current position, or our inability to attract and retain skilled employees could result in our inability to continue to grow our business or to implement our business strategy.
We rely on highly skilled personnel in a broad array of disciplines and if we are unable to hire, retain, or motivate these individuals, or maintain our corporate culture, we may not be able to maintain the quality of our testing services or grow effectively.
Our performance, including our research and development programs and laboratory operations and the quality of our testing services, largely depends on our continuing ability to identify, hire, develop, motivate, and retain highly skilled personnel for all areas of our organization. Competition in our industry for qualified employees is intense, and we may not be able to attract or retain qualified personnel in the future, including bioinformatic scientists, bioinformatic engineers, software engineers, statisticians, variant curators, clinical laboratory scientists (“CLS”), and genetic counselors, due to the competition for qualified personnel among life science businesses, technology companies, as well as universities and public and private research institutions, particularly in the San Francisco Bay Area. For example, California has a shortage of qualified CLS, who must be licensed by the California Department of Public Health to perform clinical testing in laboratories located in California such as our CLIA-certified and CAP-accredited laboratory. We face intense competition for, and we have experienced and may in the future experience difficulty attracting and retaining, sufficient numbers of licensed and qualified CLS to support the needs of our business and our laboratory capacity expansion efforts. All of our U.S. employees are at-will, which means that either we or the employee may terminate their employment at any time. In addition, our compensation arrangements, such as our equity award programs, may not always be successful in attracting new employees and retaining and motivating our existing employees for reasons that may include movements in our stock price. If we are not able to attract and retain the necessary personnel, including licensed and qualified CLS, to accomplish our business objectives, we may experience constraints that could adversely affect our ability to scale our business and support our research and development efforts and our laboratory operations. We believe that our corporate culture fosters innovation, creativity, and teamwork. However, as our organization grows, we may find it increasingly difficult to maintain the beneficial aspects of our corporate culture. This could negatively impact our ability to retain and attract employees and our future success.
We have undertaken in the past, and may in the future undertake, internal restructuring activities that could result in disruptions to our business or otherwise harm our results of operations or financial condition.
From time to time, we may undertake internal restructuring activities as we continue to evaluate and attempt to optimize our cost and operating structure in light of developments in our business strategy and long-term operating plans. For example, in the first quarter of 2023 and in the fourth quarter of 2023, we implemented reductions in our workforce to reduce operating costs and improve operating efficiency that collectively affected nearly 50% of our workforce. Any restructuring activities that we may undertake in the future may result in write-offs or other restructuring charges. There can be no assurance that any restructuring activities that we undertake in the future will achieve the cost savings, operating efficiencies or other benefits that we may initially expect. Restructuring activities may also result in a loss of continuity, accumulated knowledge and inefficiency during transitional periods and thereafter. In addition, internal restructurings can require a significant amount of time and focus from management and other employees, which may divert attention from commercial operations and disrupt our ongoing business. If any internal restructuring activities we undertake in the future fail to achieve some or all of the expected benefits therefrom, our business, results of operations and financial condition could be materially and adversely affected.
We may not be able to manage our future growth effectively, which could make it difficult to execute our business strategy.
Our expected future growth could create a strain on our organizational, administrative, and operational infrastructure, including facilities, information technology systems, laboratory operations, quality control, customer service, marketing and sales, and management. We may not be able to maintain the quality of or expected turnaround times for our tests, or satisfy customer demand as our test volume grows. Our ability to manage our growth properly will require us to continue to improve our operational, financial, and management controls, as well as our reporting systems and procedures. As a result of our growth, our operating costs may escalate even faster than planned, and some of our internal systems may need to be enhanced or replaced. If we are unable to manage our growth effectively, it may be difficult for us to execute our business strategy and our business could be harmed.
26
Table of Contents
We may need to continue to invest in our infrastructure in advance of increased demand for our testing services; our failure to accurately forecast demand would have a negative impact on our business and our ability to achieve and sustain profitability.
Our Fremont facility expanded our laboratory capacity and, in order to execute our business model, we will need to make additional investments to further scale our infrastructure, including purchases of additional equipment and applications, some of which can take several months or more to procure, setup, and validate, or increases to our software and computing capacity. There is no assurance that any of these increases in scale, equipment, software, and computing capacities, or process enhancements will be successfully implemented. In addition, we have experienced, and expect to continue to experience, significant fluctuations in the timing of receipt and volume of samples from our customers and collaborators, including as a result of factors outside our control, such as health epidemics or pandemics and government shutdowns. These fluctuations have in the past adversely impacted, and may in the future adversely impact, our ability to process samples timely and in an efficient fashion, particularly when the sample volume at any given time exceeds our then current capacity.
We expanded our laboratory facility in advance of increased demand for our testing services. Our current and projected future expense levels are to a large extent fixed and are largely based on our current investment plans and our estimates of future test volume. As a result, if revenue does not meet our expectations we may not be able to promptly adjust or reduce our spending to levels commensurate with our revenue, or at all. If we fail to generate demand commensurate with our infrastructure growth or if we fail to scale our infrastructure sufficiently in advance of demand to successfully meet such demand, our business, prospects, financial condition, and results of operations could be adversely affected.
As we commercialize additional services, we may need to incorporate new equipment, implement new technology systems and laboratory processes, or hire new personnel with different qualifications. Failure to manage this growth or transition could result in turnaround time delays, higher costs, declining service and/or quality, deteriorating customer service, and slower responses to competitive challenges. A failure in any one of these areas could make it difficult for us to meet market expectations for our testing services and could damage our reputation and the prospects for our business.
We may acquire businesses or assets, form joint ventures, or make investments in other companies or technologies that could harm our operating results, dilute our stockholders’ ownership, or cause us to incur debt or significant expense.
As part of our business strategy, we may pursue acquisitions of complementary businesses or assets, as well as technology licensing arrangements. We may also pursue strategic alliances that leverage our core technology and industry experience to expand our offerings or distribution, or make investments in other companies. As an organization, we have limited experience with respect to acquisitions as well as the formation of strategic alliances and joint ventures. We may not identify or complete these transactions in a timely manner, on a cost-effective basis, or at all, and we may not realize the anticipated benefits of any acquisition, technology license, strategic alliance, joint venture or investment, and their consideration may be distracting to our management or prevent us from pursuing other opportunities. In addition, we may not be able to find suitable partners or acquisition candidates, and we may not be able to complete such transactions on favorable terms, if at all. Any future such transactions by us also could result in significant write-offs, the incurrence of debt and contingent liabilities, exposure to additional liability, exposure to additional revenue concentration, additional regulatory obligations and exposure to additional potential liability, any of which could harm our operating results and future prospects. If we make any acquisitions in the future, we may not be able to integrate these acquisitions successfully into our existing business, and we could assume unknown or contingent liabilities. Integration of an acquired company or business also may require management resources that otherwise would be available for ongoing development of our existing business.
To finance any acquisitions or investments, we may choose to raise additional funds. The various ways we could raise additional funds carry potential risks. See “—Our inability to raise additional capital on acceptable terms in the future may limit our ability to continue to operate our business and further expand our operations.” If the price of our common stock is low or volatile, we may not be able to acquire other companies using stock as consideration. Alternatively, it may be necessary for us to raise additional funds for these activities through public or private financings. Additional funds may not be available on terms that are favorable to us, or at all.
Ethical, legal, and social concerns related to the use of genetic information could reduce demand for our tests.
Genetic testing has raised ethical, legal, and social concerns regarding privacy and the appropriate uses of the resulting information. Governmental authorities have, through the Genetic Information Nondisclosure Act, and could further, for social or other purposes, limit or regulate the use of genetic information or genetic testing or prohibit testing for genetic predisposition to certain conditions, particularly for those that have no known cure. Ethical and social concerns may also influence governmental authorities to deny or delay the issuance of patents for technology relevant to our business. Similarly, these concerns may lead patients to refuse to use, or clinicians to be reluctant to order, genetic tests even if permissible. These and other ethical, legal, and social concerns may limit market acceptance of our tests or reduce the potential markets for our tests, either of which could have an adverse effect on our business, financial condition, or results of operations.
27
Table of Contents
Our operations and employees face risks related to health crises that could adversely affect our operations, our financial condition, and the business or operations of our customers or other third parties with whom we conduct business.
Our business could be adversely impacted by the effects of a health crisis that could cause significant disruption in the operations of our customers and third-party suppliers upon whom we rely. Our laboratory facility, executive team, and most of our employees are located in the San Francisco Bay Area. In the event of a health crisis that becomes widespread in or around the San Francisco Bay Area, we may proactively, or be ordered by government officials to, take precautionary measures such as suspending our lab operations, implementing alternative work arrangements for our employees, and limiting our employees’ travel activities.
For example, our operations were previously impacted by the COVID-19 pandemic. The shelter-in-place order and health orders during the COVID-19 pandemic negatively impacted productivity, disrupted our business, and slowed research and development activities due to us limiting access to our laboratory space that would otherwise be used by our research and development group, and, to the extent such orders return in similar or more stringent form, they may cause similar effects on our operations. COVID-19 disrupted, and a future health epidemic or pandemic may disrupt in the future, the ability of our suppliers to fulfill our purchase orders in a timely manner or at all. Additionally, we use certain consumables in our operations, and we have faced, and may face in the future, difficulties in acquiring such consumables if our suppliers prioritize orders related to a health epidemic or pandemic or if other supply chain issues arise as a result of such a public health crisis. Several of our customers were delayed in sending us samples due to their inability to collect or ship samples during the COVID-19 pandemic, and these and additional customers may be disrupted from collecting samples or sending purchase orders or samples to us in the future in the event of the emergence of another health epidemic or pandemic.
Moreover, the ultimate impact of a health epidemic or pandemic on our business, operations, or the global economy as a whole is highly uncertain, but a continued and prolonged public health crisis could have a material negative impact on our business, financial condition, and operating results.
Expansion into international markets would subject us to increased regulatory oversight and regulatory, economic, social, health and political uncertainties, which could cause a material adverse effect on our business, financial position, and results of operations.
We may in the future expand our business and operations into international jurisdictions in which we have limited operating experience, including with respect to seeking regulatory approvals and marketing and selling products and services. As we expand internationally, our operations in these jurisdictions may be adversely affected by general economic conditions and economic and fiscal policy, including changes in exchange rates and controls, interest rates and taxation policies, increased government regulation, social instability, local or regional health crises, and political, economic or diplomatic developments in the future. Certain jurisdictions have, from time to time, experienced instances of civil unrest and hostilities, both internally and with neighboring countries. Rioting, military activity, terrorist attacks, or armed hostilities could cause our operations in such jurisdictions to be adversely affected or suspended. We generally do not have insurance for losses and interruptions caused by terrorist attacks, military conflicts and wars. In addition, anti-bribery and anti-corruption laws may conflict with some local customs and practices in foreign jurisdictions. Our international operations may subject us to heightened scrutiny under the Foreign Corrupt Practices Act of 1977, as amended (the “FCPA”), the United Kingdom (the “U.K.”) Bribery Act and similar anti-bribery laws, and could subject us to liability under such laws despite our best efforts to comply with such laws. As a result of our policy to comply with the FCPA, the U.K. Bribery Act and similar anti-bribery laws, we may be at a competitive disadvantage to competitors that are not subject to, or do not comply with, such laws. Further, notwithstanding our compliance programs, there can be no assurances that our policies will prevent our employees or agents from violating these laws or protect us from any such violations. Additionally, we cannot predict the nature, scope or impact of any future regulatory requirements that may apply to our international operations or how foreign governments will interpret existing or new laws. Alleged, perceived, or actual violations of any such existing or future laws by us or due to the acts of others, may result in criminal or civil sanctions, including contract cancellations or debarment, and damage to our reputation, any of which could have a material adverse effect on our business.
Regulatory, Legal and Cybersecurity Risks
Our tests may be subject to regulatory action if regulatory agencies or authorities determine that our tests do not appropriately comply with statutory and regulatory requirements enforced by the FDA, or equivalent foreign regulatory authorities and/or CLIA requirements for quality laboratory testing or equivalent foreign requirements.
The laws and regulations governing the marketing of clinical laboratory tests are extremely complex and in many instances there are no significant regulatory or judicial interpretations of these laws and regulations. The Federal Food, Drug and Cosmetic Act (the “FDC Act”) defines a medical device to include any instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent or other similar or related article, including a component, part, or accessory, intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment or prevention of disease, in man or other animals, and which does not achieve its primary intended purposes via chemical or metabolic means. Some of our tests may be considered by the FDA to be in vitro diagnostic products that are subject to regulation as medical devices. Among other things, pursuant to the FDC Act and its implementing regulations, the FDA regulates the research, testing, manufacturing, safety, labeling, storage, recordkeeping, premarket authorization, marketing and
28
Table of Contents
promotion, and sales and distribution of medical devices in the U.S. to provide reasonable assurance that medical devices distributed domestically are safe and effective for their intended uses. In addition, the FDA regulates the import and export of medical devices.
Although the FDA has statutory authority to assure that medical devices are safe and effective for their intended uses, the FDA has generally exercised its enforcement discretion and not enforced applicable regulations with respect to LDTs, which are a subset of in vitro diagnostic devices that are intended for clinical use and designed, manufactured, and used entirely within a single laboratory. We currently market our tests used in our testing services as LDTs and, therefore, we believe that they are not currently subject to the FDA’s enforcement of its medical device regulations and the applicable FDC Act provisions.
In addition, we cannot be certain that the FDA will not enact rules or guidance documents that could impact our ability to purchase certain materials necessary for the performance of our testing services, such as products labeled for research use only. Should any of the reagents obtained by us from suppliers and used in providing our testing services be affected by future regulatory actions, our business could be adversely affected by those actions, including increasing the cost of testing or delaying, limiting, or prohibiting the purchase of reagents necessary to perform testing.
In the EEA, IVDs are governed by the IVDR and must comply with the requirements of the IVDR in order to be placed on the market or put into service in the EEA. The IVDR does not specifically address the regulation of products falling within the description "laboratory-developed tests". Moreover, while the Regulation includes only limited exemptions for devices that are manufactured and used only within health institutions established in the EEA, diagnostic and therapeutic services undertaken outside of the EEA (for example at our facility in the U.S.) would not fall within the scope of such exemptions. We believe that we do not currently offer tests or services to customers established in the EEA which would fall within the scope of the IVDR. If, in the future, we offer tests or services to customers within the EEA (whether directly or via intermediaries) that fall within the scope of the IVDR, it is unlikely that we will benefit from IVDR exemptions foreseen for health institutions established in the EEA. This means that we will have to comply with the IVDR in full.
If the FDA determines that our tests are subject to enforcement as medical devices, or if foreign regulatory authorities regulate our tests as IVDs, we could incur substantial costs and time delays associated with satisfying statutory and regulatory requirements such as pre-market clearance, approval or certification, and we could incur additional expense in offering our tests and tests that we may develop in the future.
If the FDA determines that our tests and associated software do not fall within the definition of an LDT, or if we voluntarily submit one or more of our tests for premarket authorization from the FDA as medical devices, we may be required to obtain premarket clearance for our tests and associated software under Section 510(k) of the FDC Act, granting of a De Novo authorization request under Section 513(f)(2) of the FDC Act, or approval of a premarket approval application (“PMA”) under Section 515(c) of the FDC Act. We would also be subject to ongoing regulatory requirements such as registration and listing requirements, labeling requirements, medical device reporting requirements, and current good manufacturing practice requirements. If our tests are considered medical devices not subject to enforcement discretion, or if we voluntarily submit one or more of our tests for marketing authorization from the FDA as medical devices, the regulatory requirements to which our tests are subject would depend on the FDA’s classification of our tests. The FDA has issued regulations classifying generic types of medical devices into one of three classes (Class I, Class II, or Class III) depending on the risk of the device for use as intended and the degree of regulation that the FDA finds necessary to provide reasonable assurance of their safety and effectiveness. The class into which a device is placed determines the requirements that a medical device manufacturer must meet both pre- and post-market. On January 31, 2024, FDA announced its intent to initiate a reclassification process for most IVDs that are currently Class III (high risk), the majority of which are infectious disease and companion diagnostic IVDs, into Class II (moderate risk) with special controls. This reclassification would allow manufacturers of certain types of IVDs to seek marketing clearance through the less burdensome Class II 510(k) premarket notification pathway rather than the Class III premarket approval (PMA) pathway, the most stringent type of FDA medical device review.
Generally, Class I devices do not require premarket authorization, but are subject to a comprehensive set of regulatory requirements referred to as general controls. Class II devices, in addition to general controls, generally require special controls and premarket authorization through either the submission of a section 510(k) premarket notification or the submission of a De Novo authorization request under Section 513(f)(2) of the FDC Act. Class III devices are subject to general controls and special controls, and also require premarket approval prior to commercial distribution, which is a more rigorous process than premarket clearance. Under the FDC Act, a device that is first marketed after May 28, 1976 is by default a Class III device requiring premarket approval unless it is within a type of generic device class that has been classified as Class I or Class II. Even if a device falls under an existing Class II, non-exempt, device classification, the device must also be shown to be “substantially equivalent” to a legally marketed predicate device through submission of a section 510(k) premarket notification. If after reviewing a firm’s 510(k) premarket notification, the FDA determines that a device is not substantially equivalent to a legally marketed predicate device, the new device is classified into Class III, requiring premarket approval. It is possible for a manufacturer of a device of a new type to obtain a Class I or Class II designation, if there is no appropriate predicate and the device is low to moderate risk by submitting a De Novo request for reclassification.
The process for submitting a 510(k) premarket notification and receiving FDA clearance usually takes from three to 12 months, but it can take significantly longer and clearance is never guaranteed. Similarly, the process for submitting a De Novo authorization request and receiving FDA’s granting of the request usually takes from four to 18 months, but it can take significantly longer and such granting of the request is never guaranteed. The process for submitting and obtaining FDA approval of a PMA is much more costly, lengthy, and uncertain. It generally takes from one to three years or even longer and approval is not guaranteed. PMA approval typically requires extensive clinical data and can be significantly longer, more expensive and more uncertain than the De Novo authorization or
29
Table of Contents
510(k) clearance process. Despite the time, effort and expense expended, there can be no assurance that a particular device ultimately will receive marketing authorization from the FDA.
If premarket review of our tests is required, the premarket review process may involve, among other things, successfully completing additional clinical trials. If we are required to conduct premarket clinical trials, whether using prospectively acquired samples or archival samples, delays in the commencement or completion of clinical testing could significantly increase our service development costs, delay commercialization of any future services, and interrupt sales of our current testing services. Many of the factors that may cause or lead to a delay in the commencement or completion of clinical trials may also ultimately lead to delay or denial of regulatory clearance or approval. The commencement of clinical trials may be delayed due to insufficient patient enrollment, which is a function of many factors, including the size of the patient population, the concerns around genetic testing, the nature of the protocol, the proximity of patients to clinical sites, and the eligibility criteria for the clinical trial.
If we are required to conduct clinical trials, we and any third-party contractors we engage would be required to comply with good clinical practices (“GCPs”), which are regulations and guidelines enforced by the FDA, for devices in clinical development. The FDA enforces these GCPs through periodic inspections of trial sponsors, principal investigators, and trial sites. If we or any third-party contractor fails to comply with applicable GCPs, the clinical data generated in clinical trials may be deemed unreliable and the FDA may require us to perform additional clinical trials before clearing or approving our marketing applications. A failure to comply with these regulations may require us to repeat clinical trials, which would delay the regulatory clearance or approval process. In addition, if these parties do not successfully carry out their contractual duties or obligations or meet expected deadlines, or if the quality, completeness or accuracy of the clinical data they obtain is compromised due to the failure to adhere to our clinical protocols or for other reasons, our clinical trials may have to be extended, delayed or terminated. Many of these factors would be beyond our control. We may not be able to enter into replacement arrangements without undue delays or considerable expenditures. If there are delays in testing or approvals as a result of the failure to perform by third parties, our research and development costs would increase, and we may not be able to obtain regulatory clearance or approval for our tests. In addition, we may not be able to establish or maintain relationships with these parties on favorable terms, if at all. Each of these outcomes would harm our ability to market our tests or to achieve or sustain profitability. Similar actions and obligations may be imposed by the competent authorities of a European Union ("EU") Member State, or a foreign regulatory authority.
The FDA requires medical device manufacturers to comply with, among other things, current good manufacturing practices for medical devices, set forth in the Quality Management System Regulation at 21 C.F.R. Part 820, which took effect on February 2, 2026, and requires manufacturers to follow elaborate design, testing, control, documentation, and other quality assurance procedures during the manufacturing process; the medical device reporting regulation, which requires that manufacturers report to the FDA if their device or a similar device they market may have caused or contributed to a death or serious injury or malfunctioned in a way that would likely cause or contribute to a death or serious injury if it were to recur; labeling regulations, including the FDA’s general prohibition against promoting devices for unapproved or “off-label” uses; the reports of corrections and removals regulation, which requires manufacturers to report to the FDA if a device correction or removal was initiated to reduce a risk to health posed by the device or to remedy a violation of the FDC Act caused by the device which may present a risk to health; and the establishment registration and device listing regulation.
Moreover, there can be no assurance that any authorized labeling claims will be consistent with our current claims or adequate to support continued adoption of our testing services. If premarket review is required for some or all of our tests, the FDA may require that we stop using such tests in our testing services pending marketing authorization, which would negatively impact our business. Even if our testing services are allowed to remain on the market prior to marketing authorization of our tests, demand for our testing services may decline if there is uncertainty about our tests, if we are required to label our tests as investigational by the FDA, or if the FDA limits the labeling claims we are permitted to make for our testing services. As a result, we could experience significantly increased development costs and a delay in generating additional revenue from our testing services, or from other services now in development.
In addition, any marketing authorization that we may obtain for our tests may contain requirements for costly post-market testing and surveillance to monitor the safety or effectiveness of the tests. The FDA has broad post-market enforcement powers, and if unanticipated problems with our tests arise, or if we or our suppliers fail to comply with regulatory requirements following FDA marketing authorization, we may become subject to enforcement actions such as:
•
restrictions on manufacturing processes;
•
restrictions on marketing of our tests;
•
warning letters;
•
withdrawal or recall of our tests from the market;
•
refusal to provide marketing authorization for pending PMAs, De Novo requests, or 510(k)s, or supplements to approved PMAs, granted De Novo authorization requests, or cleared 510(k)s that we submit;
•
fines, restitution, or disgorgement of profits or revenue;
•
suspension or withdrawal of regulatory clearances or approvals;
•
limitation on, or refusal to permit, import or export of our tests;
30
Table of Contents
•
seizures;
•
injunctions; or
•
imposition of civil or criminal penalties.
Moreover, the FDA strictly regulates the promotional claims that may be made about medical devices. In particular, a medical device may not be promoted for uses that are not approved by the FDA as reflected in the device’s approved labeling. However, companies may share truthful and not misleading information that is otherwise consistent with the device’s FDA approved labeling. The FDA and other agencies or authorities actively enforce the laws and regulations prohibiting the promotion of off-label uses, and a company that is found to have improperly promoted off-label uses may be subject to significant civil, criminal, and administrative penalties.
In addition, many of the products we use to perform our tests, including sequencers and various associated reagents supplied to us by Illumina, are labeled as research use only (“RUO”) in the U.S. RUO products are exempt from FDA medical device requirements provided their manufacturers comply with specified labeling and restrictions on distribution. The products must bear the statement: “For Research Use Only. Not for Use in Diagnostic Procedures.” Manufacturers of RUO products cannot make any claims related to safety, effectiveness or diagnostic utility, and RUO products cannot be intended by the manufacturer for clinical diagnostic use. A product promoted for diagnostic use may be viewed by the FDA as adulterated and misbranded under the FDC Act and is subject to FDA enforcement activities, including requiring the manufacturer to seek marketing authorization for the products. We currently use Illumina and other RUO products for our clinical diagnostic tests. If the FDA were to require clearance, approval or authorization for the sale of Illumina’s RUO products and if Illumina does not obtain such clearance, approval or authorization, we would have to find an alternative sequencing platform for some or all of our clinical diagnostic tests. We currently have not validated an alternative sequencing platform on which our tests could be run in a commercially viable manner. If we were not successful in selecting, acquiring on commercially reasonable terms and implementing an alternative platform on a timely basis, our business, financial condition and results of operations would be adversely affected. Similarly, a finding that any of our other suppliers failed to comply with applicable requirements could result in interruptions in our ability to supply our testing services to the market and adversely affect our operations.
In addition, if we offer tests or services to customers within the EEA (and Northern Ireland) (whether directly or via intermediaries) that fall within the scope of the IVDR, we would be required to comply with strict requirements in order to affix the CE mark to products related to our testing services, including requirements for clinical evidence, pre-market assessment of safety and performance, quality management system, traceability of products, promotion and advertising, and conduct costly post-market testing and surveillance to monitor the safety or effectiveness of the tests related to our testing services in the EEA and detailed reporting obligations.
Failure to comply with federal, state, and foreign laboratory licensing requirements and the applicable requirements of the FDA or any other regulatory authority, or equivalent foreign regulatory authority, could cause us to lose the ability to perform our tests, experience disruptions to our business, or become subject to administrative or judicial sanctions.
We are subject to CLIA, a federal law that regulates clinical laboratories that perform testing on specimens derived from humans for the purpose of providing information for the diagnosis, prevention, or treatment of disease. CLIA regulations establish specific standards with respect to personnel qualifications, facility administration, proficiency testing, quality control, quality assurance, and inspections. We have a current CLIA certificate to conduct our tests at our laboratory in Fremont, California. To renew this certificate, we are subject to survey and inspection every two years. Because we are a CAP-accredited laboratory, the Centers for Medicare & Medicaid Services ("CMS") does not perform this survey and inspection and relies on our CAP survey and inspection. We also may be subject to additional unannounced inspections.
We are also required to maintain a license to conduct testing in California. California laws establish standards for day-to-day operation of our clinical reference laboratory, including the training and skills required of personnel and quality control. Several other states in which we operate also require that we hold licenses to test specimens from patients in those states, under certain circumstances. For example, our clinical reference laboratory is required to be licensed on a test-specific basis by New York as an out-of-state laboratory, and our LDTs must be approved by the New York State Department of Health (the “NYDOH”) on a test-by-test basis before they are offered in New York. We are subject to periodic inspection by the NYDOH and are required to demonstrate ongoing compliance with NYDOH regulations and standards. To the extent NYDOH identified any non-compliance and we are unable to implement satisfactory corrective actions to remedy such non-compliance, the State of New York could withdraw approval for our tests. Additionally, states such as Maryland, Pennsylvania, and Rhode Island also require us to maintain out-of-state licenses. Other states may have similar requirements or may adopt similar requirements in the future. Although we have obtained licenses from states for our clinical reference laboratory where we believe we are required to be licensed, we may become aware of other states that require out-of-state laboratories to obtain licensure in order to accept specimens from the state, and it is possible that other states currently have such requirements or will have such requirements in the future. We may also be subject to regulation in foreign jurisdictions as we seek to expand international utilization of our tests or such jurisdictions adopt new licensure requirements, which may require review of our tests in order to offer them or may have other limitations such as restrictions on the transport of human blood necessary for us to perform our tests that may limit our ability to make our tests available outside of the U.S. Complying with licensure requirements in new jurisdictions may be expensive and/or time-consuming, may subject us to significant and unanticipated delays, or may be in conflict with other applicable requirements.
31
Table of Contents
Failure to comply with applicable clinical laboratory licensure requirements may result in a range of enforcement actions, including license suspension, limitation, or revocation, directed plan of action, onsite monitoring, civil monetary penalties, and criminal sanctions as well as significant adverse publicity. Any sanction imposed under CLIA, its implementing regulations or state or foreign laws or regulations governing clinical laboratory licensure, or our failure to renew our CLIA certificate, a state or foreign license or accreditation, could have a material adverse effect on our business, financial condition, and results of operations. Even if we were able to bring our laboratory back into compliance, we could incur significant expenses and potentially lose revenue in doing so.
Failure to comply with the IVDR may result in a range of enforcement actions by the regulatory authorities of EU Member States as well as repercussions for any CE Certificates of Conformity issued by notified bodies, including fines, suspension variation or withdrawal of CE Certificates of Conformity, product seizures, injunctions or the imposition of civil or criminal penalties which would adversely affect our business, operating results and prospects.
Although we market our test services as LDTs that are currently subject to the FDA’s exercise of enforcement discretion, if any of our testing services fail to comply with FDA regulatory requirements as enforced, or if we are required or voluntarily submit one or more of our test services for marketing authorization from the FDA as medical devices, we would be subject to the applicable requirements of the FDC Act and the FDA’s implementing regulations. The FDA is empowered to impose sanctions for violations of the FDC Act and the FDA’s implementing regulations, including warning letters, civil and criminal penalties, injunctions, product seizure or recall, import bans, restrictions on the conduct of our operations and total or partial suspension of production. Any of the aforementioned sanctions could cause reputational damage, undermine our ability to maintain and increase our revenue, and harm our business, financial condition, and results of operations. In particular, if we or the FDA discover that any of our testing services have defects that call into question the accuracy of their results, we may be required to undertake a retest of all results and analyses provided during the period relevant to the defect, or recall the affected services. The direct costs incurred in connection with such a recall in terms of management time, administrative, and legal expenses and lost revenue, together with the indirect costs to our reputation, could harm our business, financial condition, and results of operations, and our ability to execute our business strategy. While we believe that we are currently in material compliance with applicable laws and regulations as currently enforced, the FDA or other regulatory agencies and authorities may not agree, and a determination that we have violated these laws or a public announcement that we are being investigated for possible violations of these laws could adversely affect our business, financial condition, results of operations, and prospects.
Disruptions to the operations of the FDA, the SEC and other government agencies, including those caused by funding shortages or executive branch policies, in addition to substantial uncertainty regarding the current administration’s initiatives and staffing cuts and how these might impact the FDA, the SEC and other governmental agencies implementation of laws, regulations, policies and guidance, and its personnel, could hinder their ability to hire and retain key leadership and other personnel, prevent new products and services from being developed or commercialized in a timely manner or otherwise prevent those agencies from performing normal functions on which the operation of our business and our business partners may rely, which could negatively impact our business.
The ability of the FDA to review and approve new products or take action with respect to other regulatory matters can be affected by a variety of factors, including government budget and funding levels, the ability to hire and retain key personnel and accept payment of user fees, the availability of personnel and other resources, statutory, regulatory and policy changes that may otherwise affect the FDA’s or comparable foreign regulatory authorities’ ability to perform routine functions, and business disruptions, such as those caused by the COVID-19 pandemic. Average review times at the agency have fluctuated in recent years as a result. In addition, government funding of the SEC and other government agencies on which our operations may rely, including grants that fund research and development activities by academic institutions, is subject to the political process, which is inherently fluid and unpredictable.
Disruptions at the FDA and other agencies, including substantial leadership departures, personnel cuts, and policy changes, may also slow the time necessary for new drugs to be reviewed and/or approved by necessary government agencies, which would adversely affect our business through our commercial relationships with pharmaceutical companies and collaborations with academic institutions. For example, over the last several years, the U.S. government has shut down several times and certain regulatory agencies, such as the FDA and the SEC, have had to furlough FDA, SEC and other government employees and stop activities. In addition, there have recently been terminations of large numbers of federal employees at various federal agencies, including the FDA. Changes and cuts in FDA staffing could result in delays in the FDA’s responsiveness or in its ability to review submissions or applications, issue regulations or guidance, or implement or enforce regulatory requirements in a timely fashion or at all. If a subsequent prolonged government shutdown occurs, it and/or employee terminations or resignations could significantly impact the ability of the FDA or other federal agencies to timely review and process regulatory submissions of our pharma customers or collaboration partners, which could have a material adverse effect on our business. Further, future government shutdowns and/or employee terminations or resignations or could impact our ability to access the public markets and obtain necessary capital in order to properly capitalize and continue our operations, or to timely obtain patent protection in the U.S. to protect our technology. Moreover, federal funding under the current administration of certain activities such as research and development grants to academic institutions has been, and may continue to be, more limited than recent historical funding.
There is substantial uncertainty as to whether and how the current administration will seek to modify or revise the requirements and policies of the FDA and other regulatory agencies with jurisdiction over the product candidates of our customers and collaboration partners and any products for which they obtain approval. This uncertainty could present new challenges to navigating development and approval of product candidates. Some of these efforts have manifested to date in the form of personnel cuts and measures that could impact the FDA’s ability to hire and retain key personnel, which could result in delays or limitations on the ability of our pharma customers
32
Table of Contents
or collaboration partners to obtain guidance from the FDA on their product candidates in development and obtain the requisite regulatory approvals in the future. There remains general uncertainty regarding future activities. The current administration could issue or promulgate executive orders, regulations, policies or guidance that adversely affect us or our customers or collaboration partners, or create a more challenging or costly environment to pursue the development of new products.
If our information technology systems or data, or those of third parties with whom we work or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences.
In the ordinary course of our business, we, and the third parties with whom we work, collect, process, receive, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, share and store (collectively, “process”) proprietary, confidential, and sensitive information, including protected health information (“PHI”), personal information, credit card and other financial information, intellectual property, trade secrets, medical information, biometric information and genomic information (collectively, “sensitive information”) owned or controlled by ourselves or our customers, payors, and other parties.
Cyberattacks, malicious internet-based activity, and online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties with whom we work. Such threats are prevalent and continue to increase, are becoming increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyberattacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we, and the third parties with whom we work, may be vulnerable to a heightened risk of these attacks, including retaliatory cyberattacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell, and distribute our testing services.
We and the third parties with whom we work are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which are increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, attacks enhanced or facilitated by artificial intelligence ("AI"), software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, natural disasters, terrorism, and other similar threats. In particular, ransomware attacks are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, ability to provide our testing services, loss of data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful.
Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. For example, threat actors may use an initial compromise of one part of our environment to gain access to other parts of our environment, or leverage a compromise of our networks or systems to gain access to the networks or systems of third parties with whom we work, such as through phishing or supply chain attacks. Most of our employees are working remotely at least part of the time and such remote work has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations. Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.
We rely on third parties to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, on-site systems and cloud-based data centers, systems handling human resources, financial reporting and controls, customer relationship management, regulatory compliance, and other infrastructure operations. We also communicate sensitive data, including patient data, electronically, and through relationships with multiple third-party vendors and their subcontractors. These applications and data encompass a wide variety of sensitive information, including research and development information, patient data, commercial information, and business and financial information. Our ability to monitor these third parties’ security practices is limited, and these third parties may not have adequate security measures in place. For example, in December 2025, we received notice from our e-mail service provider about certain suspicious Personalis email account activity. Upon notification of this incident, we conducted a thorough investigation and determined that a threat actor had gained access to a small number of user accounts and some patients’ PHI may have been accessed. We are not aware of any unauthorized access to our financial systems or records or any impact to our test processing systems. While we have taken steps to (a) notify the affected patients and the U.S Department of Health and Human Services, Office of Civil Rights of the incident, as required by law, and (b) mitigate the potential for incidents to occur in the future, there can be no assurance that these measures will be effective.
33
Table of Contents
If the third parties with whom we work experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or that of the third parties with whom we work have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our information technology systems or the third-party information technology systems that support us and our testing services.
Despite the measures we have taken to prevent unanticipated problems that could affect our information technology and telecommunications systems, failures or significant downtime of our information technology or telecommunications systems or those used by our third-party service providers could prevent us from conducting tests, preparing and providing reports to our customers, billing customers, collecting revenue, handling inquiries from our customers, conducting research and development activities, and managing the administrative aspects of our business. For example, in 2018, we experienced downtime in our information technology systems in connection with the adoption of new information technology, and our results of operations in the first and second quarters of 2018 were adversely affected as a result. In 2024, we experienced downtime in our information technology systems due to human error in connection with an upgrade by one of our third-party vendors to one of our information technology systems. Our results of operations were not materially adversely affected in the case of the latter downtime. Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to provide our testing services.
We may expend significant resources or modify our business activities (including our clinical trial activities) to try to protect against security incidents. Additionally, certain data privacy and security obligations may require us to implement and maintain certain measures to protect our information technology systems and sensitive information.
While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps designed to detect, mitigate and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties with whom we work). However, we have not detected, and may not in the future, detect, and remediate all such vulnerabilities, including on a timely basis. Further, we have experienced, and may in the future experience, delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities, but we may not be able to detect and remediate all vulnerabilities because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred. Further, if the information technology systems of the third parties with whom we work become subject to security incidents, we may have insufficient recourse against such third parties, and we may have to expend significant resources to mitigate the impact of such an event, and to develop and implement protections to prevent future events of this nature from occurring.
We employ a shared responsibility model where our customers and partners are responsible for configuring and implementing security measures related to our platform. As part of this model, we make certain security features available to users that can be implemented at their discretion or identify security areas or measures for which they are responsible. For example, users can choose whether to implement and enforce multifactor authentication to access their accounts. In certain cases where users choose not to implement, or incorrectly implement, those features or measures, misuse our testing services, or otherwise experience their own vulnerabilities, policy violations, credential exposure or security incidents, even if we are not the cause of a resulting customer security issue or incident, our customer and partner relationships, reputation, and revenue may be adversely impacted.
Any of the previously identified or similar threats have in the past, and may in the future, cause a security incident or other interruption that have in the past, and may in the future, result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties with whom we work. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to provide our testing services and otherwise conduct our business in the ordinary course.
Unauthorized access, loss, or dissemination could also damage our reputation or disrupt our operations, including our ability to conduct our analyses, deliver test results, process claims and appeals, provide customer assistance, conduct research and development activities, collect, process, and prepare company financial information, provide information about our tests and other patient and physician education and outreach efforts through our website, and manage the administrative aspects of our business. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. For example, like many companies, we use Log4j with respect to certain software or systems to log security and performance information. In early 2022, we discovered a Log4j vulnerability in our environment although to date we have found no indication that our or our partners’ data was exposed. Upon learning of this vulnerability, we applied a patch and made updates to our systems and infrastructure intended to reduce risks associated with the vulnerability. In December 2025, we received notice from our e-mail service provider about certain Personalis suspicious account email activity. See “— If our information technology systems or data, or those of third parties with whom we work or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences.” We are not aware of any unauthorized access to our financial systems or records.
34
Table of Contents
Applicable data privacy and security obligations, including applicable federal and/or state breach notification laws and foreign equivalents, as well as public company disclosure obligations, may require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, regulatory authorities and our stockholders, of certain security incidents or to take other actions, such as providing credit monitoring and identity theft protection services. Such disclosures and related actions can be costly, and the disclosure or the failure to comply with such applicable requirements could lead to adverse consequences. If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal information); litigation (including class claims) and mass arbitration; indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may prevent or cause customers or partners to stop using our testing services, deter new customers or partners from using our testing services, and negatively impact our ability to grow and operate our business. Whether a cybersecurity incident is reportable to our stockholders may not be straightforward, may take considerable time to determine, and may be subject to change as the investigation of the incident progresses, including changes that may significantly alter any initial disclosure that we provide.
Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our data privacy and security practices. Additionally, we cannot be sure that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.
In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, our sensitive information could be leaked, disclosed, or revealed as a result of or in connection with our employee’s, personnel’s, or vendor’s use of AI technologies.
We are subject to stringent and evolving U.S. and foreign laws, regulations, rules, contractual obligations, industry standards, policies and other obligations related to data privacy and security. Our actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions; litigation (including class claims) and mass arbitration demands; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse business consequences.
In the ordinary course of business, we process sensitive information, including data we collect from our customers about trial participants in connection with clinical trials. Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security.
In the United States, federal, state, and local governments have enacted numerous data privacy, and security laws, including data breach notification laws, personal information privacy laws, and consumer protection laws. For example, the Health Insurance Portability and Accountability Act ("HIPAA"), as amended by the Health Information Technology for Economic and Clinical Health Act ("HITECH"), imposes specific requirements relating to the privacy, security, and transmission of individually identifiable health information. Penalties for failure to comply with HIPAA and HITECH include significant civil monetary penalties and criminal penalties in certain circumstances with fines up to $250,000 per violation and/or imprisonment. Further, various states, such as California and Massachusetts, have implemented similar privacy laws and regulations, such as the California Confidentiality of Medical Information Act, that impose restrictive requirements regulating the use and disclosure of health information and other personally identifiable information. These laws and regulations are not necessarily preempted by HIPAA, particularly if a state affords greater protection to individuals than HIPAA. Where state laws are more protective and applicable to us, we may have to comply with the stricter provisions. In addition to fines and penalties imposed upon violators, some of these state laws also afford private rights of action to individuals who believe their personal information has been misused. Similarly, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CPRA”) (collectively, "CCPA") applies to personal information of consumers, business representatives, and employees, and requires businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain privacy rights, including those noted below. The CCPA provides for fines and allows private litigants affected by certain data breaches to recover significant statutory damages. Although the CCPA exempts some data processed in the context of clinical trials, the CCPA increases compliance costs and potential liability with respect to other personal information we maintain about California residents. In addition, the CPRA expands the CCPA’s requirements, including by adding a new right for individuals to correct their personal information and establishing a new regulatory agency to implement and enforce the law. Other states, such as Virginia, Colorado, Connecticut and Utah have also enacted comprehensive privacy laws, and similar laws are being considered in several other states, as well as at the federal and local levels. These state laws and the CCPA provide individuals with certain rights concerning their personal information, including the right to access, correct, or delete certain personal information, and opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our testing services. While these states, like the CCPA, also exempt some data processed in the context of clinical trials, these developments further complicate compliance efforts, and increase legal risk and compliance costs for us, the third parties upon whom we rely and our customers. Additionally, several states and localities have enacted statutes banning or restricting the collection of biometric information and regulators, such as the Federal Trade Commission, have indicated that use of biometric technologies (including facial recognition technologies) may be subject to additional scrutiny.
35
Table of Contents
We may be subject to new laws governing the privacy of consumer health data, including reproductive, sexual orientation, and gender identity privacy rights. For example, Washington’s My Health My Data Act broadly defines consumer health data, places restrictions on processing consumer health data (including imposing stringent requirements for consents), provides consumers certain rights with respect to their health data, and creates a private right of action to allow individuals to sue for violations of the law. Other states are considering and may adopt similar laws. California also recently passed a law protecting privacy of abortion-related records and other reproductive healthcare services.
Outside the U.S., an increasing number of laws, regulations, and industry standards govern data privacy and security. For example, the General Data Protection Regulation 2016/679 (“EU GDPR”), the United Kingdom’s GDPR (“UK GDPR”), Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais) (Law No. 13,709/2018), and China’s Personal Information Protection Law impose strict requirements for processing personal information. Under the EU GDPR and UK GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros under the EU GDPR, 17.5 million pounds sterling under the UK GDPR or, in each case, 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal information brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. In Canada, the Personal Information Protection and Electronic Documents Act and various related provincial laws, as well as Canada’s Anti-Spam Legislation, applies to our operations. We also receive personal information from customers in Asia and may be subject to new and emerging data privacy and security regimes in Asia, including Japan’s Act on the Protection of Personal Information, and Singapore's Personal Data Protection Act.
In the ordinary course of business, we may transfer personal information from Europe and other jurisdictions to the U.S. or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal information to other countries. In particular, the EEA and the U.K. have significantly restricted the transfer of personal information to the U.S. and other countries whose data privacy and security laws they generally believe are inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal information from the EEA and U.K. to the U.S. in compliance with law, such as the EEA’s standard contractual clauses, the U.K.'s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework (and U.K. extension thereto) (which allows for transfers for relevant U.S.-based organizations who self-certify compliance and participate in such framework), these mechanisms are susceptible to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal information to the U.S. If there is no lawful manner for us to transfer personal information from the EEA, the U.K. or other jurisdictions to the U.S., or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal information necessary to operate our business. Additionally, companies that transfer personal information out of the EEA and U.K. to other jurisdictions, particularly to the U.S., are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations. EEA countries may also introduce national legislation further limiting the processing of personal genetic, biometric, or health data, which could limit our ability to collect, use and share data originating from the EEA, or could cause our compliance costs to increase, require us to change our practices, adversely impact our business, and harm our financial condition. The U.S. is also increasingly scrutinizing certain personal data transfers and may impose data localization requirements, for example, the U.S. Department of Justice’s rule entitled the Preventing Access to U.S Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons.
In addition to data privacy and security laws, because we process some credit card payments through a third-party payment processing partner, we are contractually subject to industry standards adopted by industry groups and may become subject to such obligations in the future. For example, we also are subject to the Payment Card Industry Data Security Standard (“PCI DSS”). The PCI DSS requires companies to adopt certain measures to ensure the security of cardholder information, including using and maintaining firewalls, adopting proper password protections for certain devices and software, and restricting data access. Noncompliance with PCI-DSS can result in penalties ranging from $5,000 to $100,000 per month by credit card companies, litigation, damage to our reputation, and revenue losses.
We also rely on vendors to process payment card data, who may be subject to PCI DSS, and our business may be negatively affected if our vendors are fined or suffer other consequences as a result of PCI DSS noncompliance. We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. For example, certain privacy laws, such as the GDPR, require our customers to impose specific contractual restrictions on their service providers. We publish privacy policies, marketing materials and other statements regarding data privacy and security. If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.
36
Table of Contents
Our employees and personnel may use generative AI, agentic AI, and/or automated decision-making technologies (collectively, “AI”) to perform their work, and the disclosure and use of personal information in AI technologies is subject to various data privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and consumer lawsuits. If we are unable to use AI, it could make our business less efficient and result in competitive disadvantages.
Obligations related to data privacy and security (and consumers' data privacy and security expectations) are quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources, which may necessitate changes to our platform, services, information technologies, systems, and practices and to those of any third parties that process personal information on our behalf. In addition, these obligations may require us to change our business model. Our business model materially depends on our ability to process personal information, so we are particularly exposed to the risks associated with the rapidly changing legal landscape. For example, because we process PHI, personal information and sensitive information, we may be at heightened risk of regulatory scrutiny, and any changes in the regulatory framework could require us to fundamentally change our business model, including causing us to take on more onerous obligations in our contracts, restrict our ability to collect, use and disclose data, or in some cases, impact our ability to operate in certain jurisdictions. We typically rely on our customers to obtain valid and appropriate consents from data subjects whose genetic samples and data we process on such customers’ behalf particularly with respect to our RUO and clinical trial services, and we also typically rely on each provider ordering our LDTs or diagnostic services to obtain valid and appropriate consent from each of his or her patients whose genetic samples and data we process on such patient's behalf. Given that we do not typically obtain direct consent from such data subjects or patients, and we do not audit our customers or the ordering providers to ensure that they have obtained the necessary consents required by law, the failure of our customers or the order providers to obtain consents that are valid under applicable law could result in our own non-compliance with data privacy and security laws. For example, our NeXT Personal RUO test leverages WGS, and the scope of existing consents from our customers' clinical trial subjects may be insufficient to cover use of NeXT Personal on their samples, which may either limit uptake of NeXT Personal or expose our customers and ourselves to risk of exceeding the scope of prior consent for specimen testing. A failure, or a perceived failure, to address or comply with U.S. and foreign data privacy and security laws could result in government enforcement actions (which could include civil or criminal penalties), private litigation and/or adverse publicity and could negatively affect our operating results and business. Claims that we have violated individuals’ privacy rights, failed to comply with data privacy and security laws, or breached our contractual obligations, even if we are not found liable, could be expensive and time consuming to defend, could result in adverse publicity and could have a material adverse effect on our business, financial condition, and results of operations.