Harrow, Inc.: Form 10-Q for the period ended Sep 30, 2024

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our unaudited condensed consolidated financial statements and the related notes thereto contained in Part I, Item 1 of this Quarterly Report on Form 10-Q (this “Quarterly Report”). Our condensed consolidated financial statements have been prepared and, unless otherwise stated, the information derived therefrom as presented in this discussion and analysis is presented, in accordance with accounting principles generally accepted in the United States of America (“GAAP”).

The information contained in this Quarterly Report is not a complete description of our business or the risks associated with an investment in our common stock. We urge you to carefully review and consider the various disclosures made by us in this Quarterly Report and in our other reports filed with the U.S. Securities and Exchange Commission (the “SEC”), including our Annual Report on Form 10-K for the fiscal year ended December 31, 2023 and subsequent reports, which discuss our business in greater detail. As used in this discussion and analysis, unless the context indicates otherwise, the terms the “Company,” “Harrow,” “we,” “us” and “our” refer to Harrow, Inc. and its consolidated subsidiaries, including ImprimisRx, LLC, ImprimisRx NJ, LLC dba ImprimisRx, Imprimis NJOF, LLC, Harrow IP, LLC and Harrow Eye, LLC. In this discussion and analysis, we refer to our consolidated subsidiaries ImprimisRx, LLC, ImprimisRx NJ, LLC and Imprimis NJOF, LLC collectively as “ImprimisRx.”

In addition to historical information, the following discussion contains forward-looking statements regarding future events and our future performance. In some cases, you can identify forward-looking statements by terminology such as “will,” “may,” “should,” “expects,” “plans,” “anticipates,” “believes,” “estimates,” “predicts,” “forecasts,” “potential” or “continue” or the negative of these terms or other comparable terminology. All statements made in this Quarterly Report other than statements of historical fact are forward-looking statements. These forward-looking statements involve risks and uncertainties and reflect only our current views, expectations and assumptions with respect to future events and our future performance. If risks or uncertainties materialize or assumptions prove incorrect, actual results or events could differ materially from those expressed or implied by such forward-looking statements. Risks that could cause actual results to differ from those expressed or implied by the forward-looking statements we make include, among others, risks related to: liquidity or results of operations; our ability to successfully implement our business plan, develop and commercialize our products, product candidates and proprietary formulations in a timely manner or at all, identify and acquire additional products, manage our pharmacy operations, service our debt, obtain financing necessary to operate our business, recruit and retain qualified personnel, manage any growth we may experience and successfully realize the benefits of our previous acquisitions and any other acquisitions and collaborative arrangements we may pursue; competition from pharmaceutical companies, outsourcing facilities and pharmacies; general economic and business conditions, including inflation and supply chain challenges; regulatory and legal risks and uncertainties related to our pharmacy operations and the pharmacy and pharmaceutical business in general; physician interest in and market acceptance of our current and any future formulations and compounding pharmacies generally; and the other risks and uncertainties described under the heading “Risk Factors” in Part II, Item 1A of this Quarterly Report and in our other filings with the SEC. You should not place undue reliance on forward-looking statements. Forward-looking statements speak only as of the date they are made and, except as required by law, we undertake no obligation to revise or publicly update any forward-looking statement for any reason.

Overview

We are a leading eyecare pharmaceutical company engaged in the discovery, development, and commercialization of innovative ophthalmic pharmaceutical products for the U.S. market. Harrow helps U.S. eyecare professionals preserve the gift of sight by making its comprehensive portfolio of prescription and non-prescription pharmaceutical products accessible and affordable to millions of Americans each year. We own commercial rights to one of the largest portfolios of branded ophthalmic pharmaceutical products in North America, all of which are marketed under the Harrow name. We also own and operate ImprimisRx, one of the nation’s leading ophthalmology-focused pharmaceutical-compounding businesses.

Factors Affecting Our Performance

We believe the primary factors affecting our performance are (1) our ability to increase revenues of our branded pharmaceutical products, proprietary compounded formulations and certain non-proprietary products, and grow and gain operating efficiencies in our operations, (2) potential and ongoing regulatory-related restrictions, (3) our ability to optimize pricing and obtain reimbursement options for our drug products, and continue to pursue development and commercialization opportunities for certain of our ophthalmology and other assets that we have not yet made commercially available. We believe we have built a tangible and intangible infrastructure that will allow us to scale revenues efficiently in the near and long-term. All of these activities will require significant costs and other resources, which we may not have or be able to obtain from operations or other sources. See “Liquidity and Capital Resources” below.

Recent Developments

The following is a summary of selected significant developments affecting our business that occurred since December 31, 2023. For additional developments, see our Annual Report on Form 10-K for the year ended December 31, 2023.

Cybersecurity Incident

In November 2024, we became aware of a cybersecurity incident that involved unauthorized access of an employee’s email account. Through this unauthorized access the threat actor was able to fraudulently divert Company funds to its bank account. We detected the incident in a time that management believes minimized any financial, operational or reputational risk to the Company, we believe this early detection will result in an immaterial impact to the Company’s financial results and at no point was our ability to generate revenues disrupted. We, along with our external cybersecurity experts, are continuing to work diligently to fully investigate and assess the impact of the incident and we have notified, and are cooperating with, federal law enforcement. As the investigation of the incident is ongoing, the full scope, nature and impact of the incident are not yet fully known.

TRIESENCE Re-Launch, Oaktree Second Amendment and Draw

In October 2024, we announced the re-launch of TRIESENCE following the successful manufacturing of three process performance qualification batches of the product. In connection with the re-launch, during October 2024 we made a one-time payment of $37,000,000 to Novartis Technology, LLC and Novartis Innovative Therapies AG (together, “Novartis”) pursuant to terms of an asset purchase agreement between Novartis and the Company. Also, during October 2024, we entered into the Second Amendment (the “Second Amendment”) to the Credit Agreement and Guaranty originally entered into on March 27, 2023, as amended by that certain First Amendment to Credit Agreement and Guaranty and Consent, dated as of July 18, 2023 (as amended, the “Oaktree Loan”), with the lenders from time to time party thereto and Oaktree Fund Administration, LLC, as administrative agent for the lenders (“Oaktree”). Upon satisfaction of certain conditions to funding, the Company drew down the principal amount of $30,000,000 (the “$30,000,000 Draw”) under a pre-existing commitment under the Oaktree Loan to partially fund the one-time payment to Novartis.

In the Second Amendment, the Company and Oaktree agreed to certain changes to the Oaktree Loan in connection with the Company’s draw under the Oaktree Loan. Pursuant to the amendment, Oaktree agreed to waive any make-whole costs associated with the $30,000,000 Draw in the event of early repayment of the debt under the Oaktree Loan if paid before March 31, 2025. In addition, Oaktree agreed to exclude the $30,000,000 Draw from the calculation of the Total Leverage Ratio as defined in the Oaktree Loan. No other material changes to the Oaktree Loan were provided in the Second Amendment.

Following entry into the Second Amendment and the funding of the Novartis milestone payment, the Company has drawn down a total principal loan amount of $107,500,000 under the Oaktree Loan and no additional principal loan amount remains available to the Company under the Oaktree Loan.

Apotex - Canadian Out-License

In February 2024, we entered into a license and supply agreement with Apotex Inc. (“Apotex”). Under the terms of the agreement, Apotex licensed exclusive rights and marketing authorizations of the following products in the Canadian market from Harrow: VERKAZIA (cyclosporine ophthalmic emulsion) 0.1% and Cationorm PLUS. Apotex was also granted a license for products Apotex will pursue approval for in Canada: VEVYE (cyclosporine ophthalmic solution) 0.1%, IHEEZO (chloroprocaine hydrochloride ophthalmic gel) 3%, and ZERVIATE (cetirizine ophthalmic solution) 0.24% (with VERKAZIA and Cationorm Plus, collectively, the “Apotex Products”). In exchange for these licenses, Harrow will earn amounts related to manufacturing, regulatory and commercial achievement milestones, in addition to royalties on net sales of the Apotex Products.

IHEEZO Reimbursement

In January 2024, we met with the Centers for Medicare & Medicaid Services (“CMS”) to request clarification related to its anesthesia billing policy which has historically not allowed for the separate billing of anesthesia services in the physician’s office. During the meeting we requested that CMS clarify that J-Code 2403, IHEEZO’s permanent J-Code, is appropriate to be billed for the anesthesia product itself (i.e., IHEEZO in our case) in the physician office setting. In March 2024, we received communication from a representative at CMS that the inclusion of J-Code 2403 in CMS’s April 2024 quarterly drug pricing file of the average sales prices (ASP) of some Medicare Part B-covered drugs and biologicals confirms that IHEEZO is separately payable in the physician office setting.

In February 2024, we made a request to CMS to consider increasing the Medically Unlikely Edits (“MUE”) for IHEEZO’s J-Code from 1 to 2. This request was made because the limitation of one MUE only allowed a single IHEEZO administration (equal to one single-use vial) to be used and billed, while many ophthalmologists perform bilateral ocular procedures, which would require two vials of IHEEZO to be used. On March 20, 2024, we received communication from the National Correct Coding Initiative (NCCI) program of CMS stating that CMS decided to increase the MUE for IHEEZO’s J-Code (J2403) from 1 to 2. The MUE edit was made effective on July 1, 2024.

VEVYE U.S. Launch

In January 2024, we launched VEVYE (cyclosporine ophthalmic solution) 0.1%, the first and only water-free cyclosporine dissolved in a semifluorinated alkane approved to treat both the signs and symptoms of dry eye disease in the U.S. We partnered with various entities including PhilRx, Apollo Care and PARx Solutions to enhance our market and patient access program for VEVYE.

Results of Operations

The following period-to-period comparisons of our financial results for the three and nine months ended September 30, 2024 and 2023 are not necessarily indicative of results for any future period.

Revenues

Our revenues include amounts recorded from sales of proprietary compounded formulations, sales of branded products to wholesalers through a third-party logistics facility, commissions from third parties and revenues received from royalty payments owed to us pursuant to out-license arrangements. The following presents our revenues:

Cost of Sales

Our cost of sales includes direct and indirect costs to manufacture formulations and products, including active pharmaceutical ingredients, personnel costs, packaging, storage, royalties, shipping and handling costs, manufacturing equipment and tenant improvements depreciation, the write-off of obsolete inventory, amortization of acquired product NDAs, and other related expenses.

Branded

The following presents our Branded cost of sales:

The increase in our Branded cost of sales was largely attributable to expenses associated with unit volumes sold.

ImprimisRx

The following presents our ImprimisRx cost of sales:

The increase in our ImprimisRx cost of sales was largely attributable to expenses associated with unit volumes sold and increased direct and indirect costs associated with production of our products.

Gross Profit and Margin

Branded

The increase in Branded gross margin between the three and nine months ended September 30, 2024 and 2023 was primarily attributable to an increase in sales reducing the impact of our fixed expenses, such as license amortization.

ImprimisRx

Selling, General and Administrative Expenses

Our selling, general and administrative expenses include personnel costs, including wages and stock-based compensation, corporate facility expenses, and investor relations, consulting, insurance, filing, legal and accounting fees and expenses as well as costs associated with our marketing activities and sales of our FDA approved, proprietary compounded formulations and other non-proprietary pharmacy products and formulations.

The increase in selling, general and administrative expenses between periods was primarily attributable to an increase in expenses including regulatory enhancements, costs to support the transition of recent product acquisitions, and an increase in expenses related to the addition of new employees in sales, marketing and other departments to support current and expected growth, including the commercial launch of VEVYE in December 2023. Stock-based compensation expense increased by $1,227,000 during the nine months ended September 30, 2024 compared to the prior year period.

Research and Development Expenses

Our research and development (“R&D”) expenses primarily include personnel costs, including wages and stock-based compensation, expenses related to the development of intellectual property, investigator-initiated research and evaluations, formulation development, and other costs related to the clinical development of our assets.

The increase in R&D expenses between periods was primarily attributable to activity related to our expanded branded product portfolio, technical transfer activities associated with the production of certain products related to our product acquisitions that occurred in 2023, product development efforts, product launches, and clinical and medical support.

Interest Expense, Net

Interest expense, net was $5,525,000 and $16,411,000 for the three and nine months ended September 30, 2024, respectively, compared to $5,749,000 and $16,200,000 for the same periods in 2023, respectively. The decrease during the three months ended September 30, 2024 compared to the same period in 2023 was primarily the result of increased interest income earned. The increase during the nine months ended September 30, 2024 compared to the same period in 2023 was primarily the result from the increase in the outstanding principal amount of our debt obligations.

Investment (Loss) Gain from Eton

During the nine months ended September 30, 2024, we recorded a loss of $3,171,000 related to the change in fair market value of Eton’s common stock at the time of its sale, including trading expenses and commissions of approximately $436,000, compared to a gain of $1,348,000 and gain of $2,676,000 during the three and nine months ended September 30, 2023, respectively.

Loss on Extinguishment of Debt

During the nine months ended September 30, 2023, we recorded a loss on extinguishment of debt of $5,465,000, related to the early payoff of a loan.

Other Income, Net

During the three and nine months ended September 30, 2024, we recorded other income of $4,000 and $76,000, respectively, related to a sublease of lab and office space in Nashville. During the three and nine months ended September 30, 2023, we recorded other expense, net of $195,000 and $344,000, respectively, related primarily to transition services and write-off of inventories associated with the divestment of our non-ophthalmology business.

Liquidity and Capital Resources

Liquidity

Our cash on hand at September 30, 2024 was $72,601,000, compared to $74,085,000 at December 31, 2023.

In October 2024, we made a one-time payment of $37,000,000 upon the achievement of a milestone associated with one of our asset purchase agreements which was funded, in part, from our availability under the delayed draw commitments of our Oaktree debt facility.

As of the date of this Quarterly Report, we believe that our cash and cash equivalents will be sufficient to sustain our planned level of operations and capital expenditures for at least the next 12 months. In addition, we may consider the sale of certain assets including, but not limited to, part of, or all of, our investments in Surface Ophthalmics, Inc. (“Surface”) and Melt Pharmaceuticals, Inc. (“Melt”) and any of our consolidated subsidiaries. However, we may pursue acquisitions of revenue generating products or drug candidates or other strategic transactions that involve large expenditures or we may experience growth more rapidly or on a larger scale than we expect, any of which could result in the depletion of capital resources more rapidly than anticipated and could require us to seek additional financing to support our operations.

We expect to use our current cash position and funds generated from our operations and any financing to pursue our business plan, which includes developing and commercializing drug candidates, compounded formulations and technologies, integrating and developing our operations, pursuing potential future strategic transactions as opportunities arise, including potential acquisitions of additional drug products, drug candidates, and/or assets or technologies, pharmacies, outsourcing facilities, drug company and manufacturers, and otherwise fund our operations. We may also use our resources to conduct clinical trials or other studies in support of our formulations or any drug candidate for which we pursue FDA approval, to pursue additional development programs or to explore other development opportunities.

Net Cash Flow

The following provides detailed information about our net cash flows:

Operating Activities

Net cash used in operating activities during the nine months ended September 30, 2024 was $(4,423,000) compared to $(4,856,000) during the same period in the prior year. The decrease in net cash used in operating activities between the periods was mainly attributed to changes in our working capital balances including accounts receivable, accounts payable, prepaid expenses and inventories.

Investing Activities

Net cash provided by (used in) investing activities during the nine months ended September 30, 2024 was $4,396,000 compared to $(152,350,000) during the same period in the prior year. Cash used in investing activities in 2023 was primarily related to the acquisition of branded products completed in 2023. Cash provided by investing activities in 2024 was primarily related to the sale of our investment in Eton.

Financing Activities

Net cash (used in) provided by financing activities during the nine months ended September 30, 2024 and 2023 was $(1,457,000) and $126,546,000, respectively. Cash used in financing activities during the nine months ended September 30, 2024 was primarily related to payment of payroll taxes upon vesting of RSUs in exchange for shares withheld from employees. Cash provided by financing activities during the nine months ended September 30, 2023 was primarily related to proceeds received from the sale of notes and common stock in our 2023 capital markets transactions and entering into loan arrangements, offset by repayment of the B. Riley senior secured note and payment of payroll taxes upon vesting and exercise of equity instruments in exchange for shares withheld from employees.

Sources of Capital

Our principal sources of cash have consisted of sales of our common stock, debt issuances, sales of our investments, and on an annual basis (e.g. for the year ended December 31, 2023) cash generated from operating activities. We may also sell some or all of our ownership interests in Surface, Melt or our other subsidiaries.

We may acquire new products, product candidates and/or businesses and, as a result, we may need significant additional capital to support our business plan and fund our proposed business operations. We may receive additional proceeds from the exercise of stock options that are currently outstanding. We may also seek additional financing from a variety of sources, including other equity or debt financings, funding from corporate partnerships or licensing arrangements, sales of assets or any other financing transaction. If we issue equity or convertible debt securities to raise additional funds, our existing stockholders may experience substantial dilution, and the newly issued equity or debt securities may have more favorable terms or rights, preferences and privileges senior to those of our existing stockholders. If we raise additional funds through collaboration or licensing arrangements or sales of assets, we may be required to relinquish potentially valuable rights to our product candidates or proprietary technologies or formulations, or grant licenses on terms that are not favorable to us. If we raise funds by incurring additional debt, we may be required to pay significant interest expenses and our leverage relative to our earnings or to our equity capitalization may increase. Obtaining commercial loans, assuming they would be available, would increase our liabilities and future cash commitments and may impose restrictions on our activities, such as the financial and operating covenants. Further, we may incur substantial costs in pursuing future capital and/or financing transactions, including investment banking fees, legal fees, accounting fees, printing and distribution expenses and other costs. We may also be required to recognize non-cash expenses in connection with certain securities we may issue, such as convertible notes and warrants, which would adversely impact our financial results.

We may be unable to obtain financing when necessary as a result of, among other things, our performance, general economic conditions, conditions in the pharmaceuticals and pharmacy industries, or our operating history, including our past bankruptcy proceedings. In addition, the fact that we have a limited history of profitability could further impact the availability or cost to us of future financings. As a result, sufficient funds may not be available when needed from any source or, if available, such funds may not be available on terms that are acceptable to us. If we are unable to raise funds to satisfy our capital needs when needed, then we may need to forego pursuit of potentially valuable development or acquisition opportunities, we may not be able to continue to operate our business pursuant to our business plan, which would require us to modify our operations to reduce spending to a sustainable level by, among other things, delaying, scaling back or eliminating some or all of our ongoing or planned investments in corporate infrastructure, business development, sales and marketing and other activities, or we may be forced to discontinue our operations entirely.

Recently Issued and Adopted Accounting Pronouncements

See Note 2 to our unaudited condensed consolidated financial statements included in this Quarterly Report.

Evaluation of Disclosure Controls and Procedures

We maintain disclosure controls and procedures that are designed to ensure that information required to be disclosed in our reports filed or submitted pursuant to the Securities Exchange Act of 1934, as amended (the “Exchange Act”), is recorded, processed, summarized and reported within the time periods specified in the rules and forms of the SEC, and that such information is accumulated and communicated to our management, including our principal executive officer and principal financial officer, as appropriate, to allow for timely decisions regarding required disclosure.

Under the supervision and with the participation of our principal executive officer and principal financial officer, our management conducted an evaluation of our disclosure controls and procedures, as such term is defined under Rule 13a-15(e) promulgated under the Exchange Act, as they existed on September 30, 2024. Based on this evaluation, our principal executive officer and principal financial officer have concluded that our disclosure controls and procedures were effective to achieve their stated purpose as of September 30, 2024, the end of the period covered by this Quarterly Report.

Changes in Internal Control over Financial Reporting

There has been no change in our internal control over financial reporting (as defined in Rule 13a-15(f) under the Exchange Act) during the quarter ended September 30, 2024, that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.

PART II

OTHER INFORMATION

In addition to the other information contained in this Quarterly Report you should consider the risk factors below which have been updated based on recent events as well as the other risk factors and information in our Annual Report on Form 10-K for the year ended December 31, 2023, including our audited financial statements and the related notes and “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” If any such risks actually occur, our business, financial condition, results of operations and future growth prospects would likely be materially and adversely affected. In these circumstances, the market price of our common stock would likely decline and you may lose all or part of your investment. Additional risks and uncertainties not presently known to us or that we currently deem immaterial also may impair our business operations.

Our business and operations could suffer in the event of cybersecurity or other system failures.

Despite the implementation of security measures, our internal computer systems and those of any third parties with which we partner are vulnerable to damage from computer viruses, unauthorized access, natural disasters, terrorism, war and telecommunication and electrical failures. While we have not experienced any cybersecurity or system failure, accident or breach to date that has been determined to have had a material impact, if a significant event were to occur, it could result in a material disruption of our operations, substantial costs to rectify or correct the failure, if possible, and potentially violation of HIPAA and other privacy laws applicable to our operations. For example, the California Consumer Privacy Act (the “CCPA”) became effective on January 1, 2020 and gave California residents expanded rights to access and require deletion of their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that may increase data breach litigation. Although the CCPA includes exemptions for certain clinical trials data, and HIPAA-protected health information, the law may increase our compliance costs and potential liability with respect to other personal information we collect about California residents. The CCPA has prompted a number of proposals for new federal and state privacy legislation. Other countries also have, or are developing, laws governing the collection, use and transmission of personal information, such as the General Data Protection Regulation (“GDPR”) in the European Union (the “EU”) that became effective in May 2018 and the Personal Information Protection and Electronic Documents Act that became effective in Canada in April 2000. We anticipate that over time we may expand our business outside of the United States. With such expansion, we would be subject to increased governmental regulation in the EU countries in which we might operate, including the GDPR. These laws and similar laws adopted in the future could increase our potential liability, increase our compliance costs and adversely affect our business. If any disruption or security breach resulted in a loss of or damage to our data or applications or inappropriate disclosure of confidential or protected information, we could incur liability, further development of our proprietary formulations could be delayed, and our pharmacy operations could be disrupted, subject to restriction or forced to terminate their operations, any of which could severely harm our business and prospects.

A breakdown of our information technology systems, or a cyberattack or information security breach could significantly compromise the confidentiality, integrity and availability of our information technology systems, network-connected control systems and/or our data, interrupt the operation of our business and/or affect our reputation.

To achieve our business objectives, we rely on sophisticated information technology systems, including hardware, software, technology infrastructure, online sites and networks for both internal and external operations, mobile applications, cloud services and network-connected control systems, some of which are managed, hosted, provided or serviced by third parties. Internal or external events that compromise the confidentiality, integrity and availability of our systems and data may significantly interrupt the operation of our business, result in significant costs and/or adversely affect our reputation.

Our information technology systems are highly integrated into our business, including our customer service infrastructure, R&D efforts, clinical and commercial manufacturing processes and product sales and distribution processes. Further, as the large part of our employees work remotely for some portion of their jobs, our reliance on our third-party information technology systems has increased substantially and is expected to continue to increase. Remote and hybrid working arrangements can increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. The complexity and interconnected nature of software, hardware and our systems make them vulnerable to breakdown or other service interruptions, and to software errors or defects, misconfiguration and other security vulnerabilities. Upgrades or changes to our systems or the software that we use have resulted and we expect, in the future, will result in the introduction of new cybersecurity vulnerabilities and risks. Our systems are also subject to frequent perimeter network reconnaissance and scanning, phishing and other cyberattacks. As the cyber-threat landscape evolves, these attacks are growing in frequency, sophistication, and intensity, and are becoming increasingly difficult to detect and increasingly sophisticated in using techniques and tools—including artificial intelligence—that circumvent security controls, evade detection and remove forensic evidence. Such attacks could include the use of harmful and virulent malware, including ransomware or other denials of service, which can be deployed through various means, including the software supply chain, e-mail, malicious websites and/or the use of social engineering/phishing.

We have experienced attacks against our network, although none that have had a material adverse impact to our business. Recently, in November 2024, we became aware of a cybersecurity incident that involved unauthorized access of an employee’s email account. Through this unauthorized access the threat actor was able to fraudulently divert Company funds to its bank account. We detected the incident in a time that management believes minimized the financial, operational or reputational risk to the Company, and at no point was our ability to generate revenues disrupted. However, we, along with our external cybersecurity experts, are continuing to work diligently to fully investigate and assess the impact of the incident and have notified, and are cooperating with, federal law enforcement. As the investigation of the incident is ongoing, the full scope, nature and impact of the incident are not yet fully known.

There can be no assurance that our efforts to guard against the wide and growing variety of potential attack techniques will be successful. Attacks such as those experienced by government entities (including those that approve and/or regulate our products) and other multi-national companies, including some of our peers, could leave us unable to utilize key business systems or access or protect important data, and could have a material adverse effect on our ability to operate our business, including developing, gaining regulatory approval for, manufacturing, selling and/or distributing our products. For example, in 2017, a pharmaceutical company experienced a cyberattack involving virulent malware that significantly disrupted its operations, including its research and sales operations and the production of some of its medicines and vaccines. As a result of the cyberattack, its orders and sales for certain products were negatively affected. In late 2020, SolarWinds Corporation, a leading provider of software for monitoring and managing information technology infrastructure, disclosed that it had suffered a cybersecurity incident whereby attackers had inserted malicious code into legitimate software updates for its products that were installed by myriad private and government customers, enabling the attackers to access a backdoor to such systems. In 2022, Okta, Inc., a provider of software that helps companies manage user authentication, disclosed that several hundred of its corporate customers were vulnerable to a security breach that allowed attackers to access Okta’s internal network. Although this breach did not have a significant effect on our business, there can be no assurance that a similar future breach would not result in a material adverse effect on our business or results of operations.

Our systems contain and use a high volume of sensitive data, including intellectual property, trade secrets and other proprietary business information, financial information, regulatory information, strategic plans, sales trends and forecasts, litigation materials and/or personal identifiable information belonging to us, our staff, our patients, customers and/or other parties. In some cases, we utilize third-party service providers to collect, process, store, manage or transmit such data, which have increased our risk. Intentional or inadvertent data privacy or security breaches (including cyberattacks) resulting from attacks or lapses by employees, service providers (including providers of information technology-specific services), business partners, nation states (including groups associated with or supported by foreign intelligence agencies), organized crime organizations, “hacktivists” or others, create risks that our sensitive data may be exposed to unauthorized persons, our competitors or the public. System vulnerabilities and/or cybersecurity breaches experienced by our third-party service providers constitute a substantial share of the information security risks to our business. There can be no assurance that a cybersecurity incident would not result in a material adverse effect on our business or results of operations. Further, the timeliness of our awareness of a cybersecurity incident affects our ability to respond to and work to mitigate the severity of such events.

Cyberattackers are also increasingly exploiting vulnerabilities in commercially available software from shared or open-source code. We rely on third party commercial software that have had and may have such vulnerabilities, but as use of open-source code is frequently not disclosed, our ability to fully assess this risk to our systems is limited. There can be no assurances that a vulnerability in the software and services that we use would not result in a material adverse effect on our business or results of operations.

Domestic and global government regulators, our business partners, suppliers with whom we do business, companies that provide us or our partners with business services and companies we have acquired or may acquire face similar risks. Security breaches of their systems or service outages have adversely affected systems and could, in the future, affect our systems and security, leave us without access to important systems, products, raw materials, components, services or information, or expose our confidential data or sensitive personal information. An extended service outage affecting these or other vendors, particularly where such vendor is the single source from which we obtain the services, could have a material adverse effect on our business or results of operations. For example, in February 2024, UnitedHealth Group announced that a suspected nation-state associated cyber security threat actor had gained access to some of the Change Healthcare (“Change”) information technology systems. Change is the largest clearinghouse for medical claims in the U.S. While Harrow was not directly impacted by this cybersecurity incident, it was reported that as a reaction to the cybersecurity incident, Change temporarily disconnected over 100 related payment systems and Change was unable to process medical claims through its primary platforms. This resulted in the delays to the revenue and cash collection cycle for several ASCs and physician offices, putting a strain on their cash resources. While temporary, the cash constraints for these ASCs and physician offices, we believe, impacted sales of some of our products, such as IHEEZO, during this disrupted period of time. In addition, we distribute our products in the United States primarily through three pharmaceutical wholesalers, and a security breach that impairs the distribution operations of our wholesalers could significantly impair our ability to deliver our products to healthcare providers and patients. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be effective in protecting our information technology systems and sensitive data.

We will continue to experience varying degrees of cyberattacks and other incidents in the future. Even though we continue to invest in the monitoring, protection and resilience of our critical and/or sensitive data and systems, there can be no assurances that our efforts will detect, prevent or fully recover systems or data from all breakdowns, service interruptions, attacks and/or breaches of our systems that could adversely affect our business and operations and/or result in the loss or exposure of critical, proprietary, private, confidential or otherwise sensitive data, which could result in material financial, legal business or reputational harm to us or negatively affect our stock price. While we maintain cyber-liability insurance, our insurance is not sufficient to cover us against all losses that could potentially result from a service interruption, breach of our systems or loss of our critical or sensitive data.

We are also subject to various laws and regulations globally regarding privacy and data protection, including laws and regulations relating to the collection, storage, handling, use, disclosure, transfer and security of personal data. The legislative and regulatory environment regarding privacy and data protection is continuously evolving and developing and the subject of significant attention globally. For example, we are subject to the CCPA, which became effective in January 2020, which can result in substantial penalties for noncompliance. The CCPA was amended in late 2020, to create the California Privacy Rights Act to create opt in requirements for the use of sensitive personal data and the formation of a new dedicated agency for the enforcement of the law, the California Privacy Protection Agency. Similar consumer privacy laws went into effect in Virginia, Colorado, Utah, Connecticut and Florida in 2023. Consumer privacy laws were also passed in 11 other states, with the earliest effective dates later this year, and proposed in three additional states. Failure to comply with these current and future laws could result in significant penalties and reputational harm and could have a material adverse effect on our business and results of operations.