LianBio: Form 10-Q for the period ended Jun 30, 2023

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our unaudited consolidated financial statements and the related notes to those statements included elsewhere in this Quarterly Report on Form 10-Q and the audited financial statements and related notes thereto as of and for the year ended December 31, 2022 and the related management’s discussion and analysis of financial condition and results of operations included in our Annual Report on Form 10-K, filed with the Securities and Exchange Commission (the “SEC”) on March 28, 2023. In addition to historical financial information, the following discussion and analysis contains forward-looking statements that involve risks, uncertainties and assumptions. You should read the “Risk Factors” and “Cautionary Note Regarding Forward-Looking Statements” sections of this report and the section entitled “Risk Factors” in our Annual Report on Form 10-K and this Quarterly Report on Form 10-Q for a discussion of important factors that could cause our actual results to differ materially from the results described in or implied by the forward-looking statements contained in the following discussion and analysis. Some of the numbers included herein have been rounded for the convenience of presentation.

Overview

We are a clinical stage biopharmaceutical company dedicated to bringing innovative medicines to patients with unmet medical needs in Asia. Our initial focus is to in-license assets for development and commercialization in Greater China and other Asian markets. We have assembled a pipeline of eight therapeutic candidates across cardiovascular, oncology, ophthalmology and inflammation indications, each with its own distinct value proposition and the potential to drive new standards of care. With operations in China, Asia Pacific, and the United States, we have built a cross-border platform to provide our licensing partners access to our regulatory, development, and commercial expertise in China and other Asian markets. We have created a diverse, balanced portfolio of highly differentiated assets that represent our broad program scope and significant potential market opportunity across various stages of development, providing multiple avenues for value creation. We intend to continue to evaluate innovative, complementary product candidates with the potential to become new standards of care in Asia to deepen our pipeline.

In November 2021, we completed an initial public offering (“IPO”) of our ordinary shares through the sale and issuance of 20,312,500 American Depositary Shares (“ADSs”), at a public offering price of $16.00 per ADS. Following the closing of the IPO, on December 1, 2021, the underwriters partially exercised their option to purchase additional shares and purchased an additional 593,616 ADSs at the initial public offering price of $16.00 per ADS. We received gross proceeds of $334.5 million in connection with the IPO and subsequent exercise of the underwriters’ option and aggregate net proceeds of $304.8 million after deducting underwriting discounts, commissions and other offering expenses.

The following diagram depicts our corporate structure as of June 30, 2023. As of June 30, 2023, the shares of each of our subsidiaries are 100% owned by the respective entity displayed immediately above that subsidiary. Certain warrant rights are outstanding and may be exercised in the future for equity interests in our Cayman parent entity, LianBio, and our subsidiary, Lian Cardiovascular, as described in “Note 10: Equity” in the notes to our consolidated financial statements included in our Annual Report on Form 10-K for the fiscal year ended December 31, 2022, filed with the SEC on March 28, 2023. Currently, our corporate structure contains no variable interest entities.

Within the organization, investor cash inflows have all been received by our parent Cayman entity, LianBio. Cash to fund our Chinese operations is transferred from our Cayman parent entity down through our Hong Kong entities and then into our Chinese entities through capital contributions. Cash to fund our operations in the United States is transferred from our Cayman parent entity down to our United States entity through a capital contribution.

Recent Business Highlights and Clinical Development Updates

Mavacamten

In April 2023, we announced the National Medical Products Administration (“NMPA”) accepted with priority review the NDA for mavacamten for the treatment of patients with obstructive hypertrophic cardiomyopathy (“oHCM”).

In April 2023, we announced positive topline results from our Phase 3 EXPLORER-CN trial evaluating mavacamten in oHCM patients. EXPLORER-CN met its primary endpoint, demonstrating statistically significant and clinically meaningful improvement in Valsalva left ventricular outflow tract gradient from baseline to week 30 compared to placebo (p<0.001).

In May 2023, mavacamten was approved for the treatment of adults with symptomatic New York Heart Association Class II-III oHCM in the Macau Special Administrative Region of China.

In June 2023, mavacamten was approved for the treatment of adults with symptomatic oHCM in Singapore.

In July 2023, we announced data from the Phase 3 EXPLORER-CN trial of mavacamten in Chinese symptomatic oHCM patients were accepted for a presentation at the European Society of Cardiology (“ESC”) Congress 2023.

TP-03

In June 2023, we announced completion of enrollment in the Phase 3 LIBRA clinical trial of TP-03 in Chinese Demodex blepharitis patients. We expect the LIBRA trial to support TP-03 registration in China.

In July 2023, our partner Tarsus Pharmaceuticals announced the U.S. Food and Drug Administration’s approval of TP-03 for the treatment of adults with Demodex blepharitis.

Infigratinib

In June 2023, we announced topline results from our Phase 2a proof of concept trial evaluating infigratinib in patients with third-line or later gastric cancer or gastroesophageal junction adenocarcinoma with fibroblast growth factor receptor-2 gene amplification. The trial demonstrated a confirmed objective response rate of 25.0% (n=20). The observed mediation duration of response was 3.8 months. Based on these data, the NMPA granted Breakthrough Therapy Designation to infigratinib for the treatment of gastric cancer.

BBP-398

In July 2023, we announced a clinical supply agreement with AstraZeneca in China to evaluate the safety and efficacy of BBP-398, an investigational SHP2 inhibitor, in combination with AstraZeneca’s osimertinib, an epidermal growth factor receptor (“EGFR”) inhibitor, in a Phase 1 clinical study for the treatment of patients with non-small cell lung cancer (“NSCLC”) with EGFR mutations.

In August 2023, we announced that the first patient was treated in the Phase 1 trial of BBP-398 in combination with osimertinib in Chinese NSCLC patients with EGFR mutations.

Corporate Developments

In April 2023, we announced that we promoted Pascal Qian to Chief Commercial Officer. He will also continue to serve as our China General Manager.

Factors Affecting Our Results of Operations

Impact of the COVID-19 pandemic on our operations

Beginning in December 2019, the outbreak of the COVID-19 pandemic created business interruptions for companies globally, including us. For example, in the biotechnology sector, companies, including our company, have experienced delays in their ability to enroll patients at clinical trial sites because of the pandemic, potentially leading to delays in the regulatory approval process. Other outbreaks may occur, or there could be further resurgences of the COVID-19 pandemic (such as outbreaks in certain locations in China, including locations in which we are conducting clinical trials, which led to extensive lockdowns), which have caused and could further cause business disruptions in the future.

We have been carefully monitoring the COVID-19 pandemic and its impact on our business. We have taken important steps to ensure the workplace safety of our employees when working within our administrative offices, or when traveling to our clinical trial sites. We may take further actions as may be required by federal, state or local authorities.

To date, we have been able to continue our key business activities and advance our clinical programs. However, the COVID-19 pandemic has impacted our clinical trial enrollment and it is possible that our clinical development timelines and business plans could be adversely affected. We maintain regular communication with our vendors and clinical sites to appropriately plan for, and mitigate, the impact of the COVID-19 pandemic on our operations.

Key Components of Results of Operations

Research and development expenses

We believe our ability to successfully develop product candidates will be a significant factor affecting our long-term competitiveness, as well as our future growth and development. Developing high quality product candidates requires a significant investment of resources over a prolonged period of time, and a core part of our strategy is to continue making sustained investment in this area.

We expect our research and development expense to increase significantly in connection with our ongoing activities, particularly as we advance the clinical development of our product candidates and initiate additional clinical trials of, and seek regulatory approval for, these and other future product candidates. These expenses include:

• payments made under third party licensing and asset acquisition agreements;
• employee-related expense, including salaries, related benefits, equity-based compensation and travel expenses for employees engaged in research and development functions;
• expense incurred in connection with the clinical development of our product candidates, including expenses incurred under agreements with contract research organizations (“CROs”);
• costs related to compliance with regulatory requirements; and
• facilities, depreciation and amortization, insurance and other direct and allocated expense incurred as a result of research and development activities.

The following table sets forth the components of our research and development expenses for the periods indicated:

We monitor research and development expenses associated with our clinical assets at the program level to some degree. We do not allocate employee-related expenses and other costs to specific research and development programs as these costs are deployed across multiple programs under research and development and are separately classified as unallocated research and development expenses.

The following table summarizes our research and development expenses by program for the periods indicated:

General and administrative expenses

Our general and administrative expenses consist primarily of salaries and other related costs for personnel in executive, finance and administrative functions. General and administrative expenses also include professional fees for legal, consulting, auditing, tax services and insurance costs.

We expect that our general and administrative expenses will increase in the future to support continued development and commercialization of our product candidates. These increases will likely include increased costs related to hiring additional personnel and fees to outside consultants, attorneys and accountants, among other expenses. Additionally, we have incurred and will continue to incur increased expenses associated with being a public company, including costs of additional personnel, accounting, audit, legal, regulatory and tax-related services associated with maintaining compliance with exchange listing and SEC requirements, director and office insurance costs, and investor and public relations costs.

Interest income, net

Interest income, net consists of interest income received on our cash balances and marketable securities and from the amortization/accretion on the premiums/discounts on marketable securities.

Other income (expense), net

Other income (expense), net consists of unrealized gains and losses on foreign currencies held in our China subsidiary, Shanghai LianBio Development Co., Ltd., unrealized foreign exchange activity from the remeasurement of our intercompany payables, bank fees incurred on our cash balances and depositary fees related to our ADSs.

Income taxes

Provision for income taxes consists of U.S. federal and state income taxes and income taxes in certain foreign jurisdictions in which we conduct business. We expect income tax expense to increase over time as the Company continues to grow net income.

We recorded income tax expense (benefit) of $0.2 million and $0.6 million for the three and six months ended June 30, 2023 and $0.0 million and $0.0 million for the three and six months ended June 30, 2022, respectively.

Results of Operations

Comparison of the three months ended June 30, 2023 and 2022

The following table sets forth a summary of our consolidated results of operations for the periods indicated.

Research and development expenses

Research and development expenses decreased by $19.1 million from $28.6 million for the three months ended June 30, 2022 to $9.5 million for the three months ended June 30, 2023. For the three months ended June 30, 2023, research and development cost was primarily attributable to (i) $2.9 million in personnel-related expenses, including share-based compensation expense, and (ii) $5.6 million attributable to development activities to support our clinical trials. The remaining expense was attributable to professional fees.

For the three months ended June 30, 2022, research and development cost was primarily attributable to (i) $15.0 million related to a development milestone payment payable pursuant to our license agreement with Tarsus (the “Tarsus License Agreement”), (ii) $5.0 million related to a development milestone payment payable pursuant with our license agreement with Myokardia (the “Myokardia License Agreement”), and (iii) $3.3 million attributable to development activities to support our clinical trials. The remaining expense was attributable to professional fees.

General and administrative expenses

General and administrative expenses increased by $1.0 million from $14.6 million for the three months ended June 30, 2022 to $15.6 million for the three months ended June 30, 2023. The increase was primarily attributable to a $1.6 million increase in personnel-related expenses, including share-based compensation expense, for increased employee headcount. This increase was partially offset by a $0.2 decrease in legal service costs, consulting costs and accounting services and a $0.3 million decrease in insurance and other operating costs incurred.

Interest income

Interest income increased by $2.2 million from $0.6 million for the three months ended June 30, 2022 to $2.8 million for the three months ended June 30, 2023. The increase was primarily attributable to our investments in marketable securities and interest earned on cash holdings in foreign countries.

Other income, net

Other income, net increased by $0.7 million from $0.2 million for the three months ended June 30, 2022 to $0.9 million for the three months ended June 30, 2023. The increase is primarily attributable to foreign exchange gains in our foreign entities.

Income taxes

Our income tax expense was $0.2 million, resulting in an effective income tax rate of (0.9)%, for the three months ended June 30, 2023. Our income tax expense was $5.0 thousand, resulting in an effective income tax rate of 0.0%, for the three months ended June 30, 2022. The variation in the effective income tax rate was primarily due to taxable income in foreign jurisdictions in 2023.

Comparison of the six months ended June 30, 2023 and 2022

The following table sets forth a summary of our consolidated results of operations for the periods indicated.

Research and development expenses

Research and development expenses decreased by $20.6 million from $40.9 million for the six months ended June 30, 2022 to $20.3 million for the six months ended June 30, 2023. For the six months ended June 30, 2023, research and development cost was primarily attributable to (i) $2.5 million related to an upfront payment related to the Tarsus Pharmaceuticals, Inc. (“Tarsus”) clinical supply agreement (the “Tarsus Supply Agreement”), (ii) $5.7 million in personnel-related expenses, including share-based compensation expense, and (iii) $10.3 million attributable to development activities to support our clinical trials. The remaining expense was attributable to professional fees.

For the six months ended June 30, 2022, research and development cost was primarily attributable to (i) $15.0 million related to a development milestone payment payable pursuant to the Tarsus License Agreement, (ii) $5.0 million related to a development milestone payment payable pursuant with the MyoKardia License Agreement, (iii) $5.0 million related to a development milestone payment payable pursuant with the Lyra License Agreement, (iv) $9.0 million attributable to development activities to support our clinical trials and (v) $5.6 million attributable to higher personnel-related expenses, including share-based compensation expense, as a result of increased employee headcount. The remaining expense was attributable to professional fees.

General and administrative expenses

General and administrative expenses increased by $0.1 million from $30.6 million for the six months ended June 30, 2022 and $30.7 million for the six months ended June 30, 2023. The increase was primarily attributable to a $3.1 million increase in personnel-related expenses, including share-based compensation expense, for increased employee headcount. This increase was partially offset by a $2.0 million decrease in legal service costs, consulting costs and accounting services. The remaining decrease was attributable to a decrease in professional fees.

Interest income

Interest income increased by $4.3 million from $0.8 million for the six months ended June 30, 2022 to $5.2 million for the six months ended June 30, 2023. The increase was primarily attributable to our investments in marketable securities and interest earned on cash holdings in foreign countries.

Other income, net

Other income, net increased by $0.2 million from $0.6 million for the six months ended June 30, 2022 to $0.8 million for the six months ended June 30, 2023. The increase is primarily attributable to foreign exchange gains in our foreign entities.

Income taxes

Our income tax expense was $0.6 million, resulting in an effective income tax rate of (1.4)%, for the six months ended June 30, 2023. Our income tax expense was $11.0 thousand, resulting in an effective income tax rate of 0.0%, for the six months ended June 30, 2022. The variation in the effective income tax rate was primarily due to taxable income in foreign jurisdictions in 2023.

Liquidity and Capital Resources

Sources of liquidity

Since our incorporation, our operations have been substantially financed with proceeds from sales of preferred shares as part of the Series Seed financing, the Series A financing, the issuance of the 2020 Convertible Notes and our IPO, which was completed in November 2021. As of June 30, 2023, we had cash and cash equivalents and marketable securities of $267.3 million.

We are a holding company with no operations of our own and, as such, we may rely on dividends and other distributions on equity paid by our Chinese subsidiaries to fund any cash and financing requirements we may have, including the funds necessary to pay dividends and other cash distributions to our shareholders or holders of our ADSs or to service any debt we may incur. Deterioration in the financial condition, earnings or cash flow of our subsidiaries for any reason, as well as any changes in Chinese laws or regulations, could limit or impair their ability to pay such distributions. For additional information, see “Part I—Item 1A—Risk Factors—Risks Related to Doing Business in China and Our International Operations—We may rely on dividends and other distributions on equity paid by our Chinese subsidiaries to fund any cash and financing requirements we may have, and any limitation on the ability of our Chinese subsidiaries to make payments to us could have a material and adverse effect on our ability to conduct our business” in our Annual Report on Form 10-K for the year ended December 31, 2022.

Funding requirements

Our primary use of cash is to fund our operating expenditures, consisting of research and development expense (including activities within our clinical and regulatory initiatives and upfront and milestone payments) and general and administrative expense. Our use of cash is impacted by the timing and extent of the required payments for each of these activities.

To date, we have not generated any material revenue. We do not expect to generate revenue from the sale of our products unless and until we (i) complete development of any of our product candidates; (ii) obtain applicable regulatory approvals; and (iii) successfully commercialize or enter into collaborative agreements for our product candidates. We do not know with certainty when, or if, any of these items will ultimately occur. We expect to incur continuing significant losses for the foreseeable future and for our losses to increase as we ramp up our clinical development programs and begin activities related to commercial launch readiness. We may encounter unforeseen expenses, difficulties, complications, delays and other currently unknown factors that could adversely affect our business. Moreover, since the completion of our IPO, we have incurred and will continue to incur additional costs associated with operating as a publicly traded company.

We will require additional capital to develop our product candidates and fund our operations into the foreseeable future. We anticipate that we will eventually need to raise substantial additional capital, the requirements for which will depend on many factors, including:

• the number and scope of clinical programs we decide to pursue;
• the cost, timing and outcome of preparing for and undergoing regulatory review of our product candidates;
• the cost and timing associated with commercializing our product candidates, if they receive regulatory approval;
• the amount of revenue, if any, received from commercial sales of our product candidates, should any of our product candidates receive regulatory approval;
• the achievement of milestones or occurrence of other developments that trigger payments under any collaboration agreements we might have at such time;
• the extent to which we acquire or in-license other product candidates and technologies;
• the costs of preparing, filing and prosecuting patent applications, maintaining and enforcing our intellectual property rights and defending intellectual property-related claims;
• our ability to establish and maintain collaborations on favorable terms, if at all;
• our efforts to enhance operational systems and our ability to attract, hire and retain qualified personnel, including personnel to support the development of our product candidates and, ultimately, the sale of our products, following regulatory approval;
• the impact of the COVID-19 pandemic and the Russian invasion of Ukraine on our clinical development or operations; and
• the costs associated with being a public company.

A change in the outcome of any of these or other variables with respect to the development and regulatory approval of any of our product candidates could significantly change the costs and timing associated with the development of that product candidate. Furthermore, our operating plans may change in the future, and we will continue to require additional capital to meet operational needs and capital requirements associated with such operating plans. If we raise additional funds by issuing equity securities, our shareholders may experience dilution. Any future debt financing into which we enter may impose upon us additional covenants that restrict our operations, including limitations on our ability to incur liens or additional debt, pay dividends, repurchase our ordinary shares, make certain investments or engage in certain merger, consolidation or asset sale transactions. Any debt financing or additional equity that we raise may contain terms that are not favorable to us or our shareholders.

Adequate funding may not be available to us on acceptable terms or at all. Our potential inability to raise capital when needed could have a negative impact on our financial condition and our ability to pursue our additional licensing opportunities.

Cash flows

The following table sets forth the primary sources and uses of cash and cash equivalents for each of the periods presented:

Net cash used in operating activities

During the six months ended June 30, 2023, operating activities used approximately $37.0 million of cash, primarily due to our net loss of $45.7 million, and non-cash consideration of $2.4 million and $1.3 million related to the amortization of discounts on investments and unrealized foreign currency transaction gains, respectively, partially offset by non-cash consideration of $8.8 million related to share-based compensation expense and $2.9 million related to changes in operating assets and liabilities.

During the six months ended June 30, 2022, operating activities used approximately $52.5 million, primarily due to our net loss of $70.1 million, partially offset by non-cash consideration of $9.2 million related to share-based compensation expense and other changes related to operating assets and liabilities.

Net cash used in investing activities

During the six months ended June 30, 2023, investing activities provided approximately $62.5 million, consisting of approximately $150.4 million from the sales and redemption of marketable securities, partially offset by $87.8 million from the purchases of marketable securities.

During the six months ended June 30, 2022, investing activities used approximately $41.7 million, consisting of approximately $126.1 million for purchases of marketable securities, and approximately $0.7 million for purchases of property and equipment, partially offset by the sales and redemption of marketable securities of approximately $85.1 million.

Net cash provided by financing activities

During the six months ended June 30, 2023, we did not generate any net proceeds from financing activities.

During the six months ended June 30, 2022, financing activities provided approximately $1.7 million, primarily resulting from the proceeds from the exercise of share options.

Critical Accounting Policies and Significant Judgments and Estimates

Our management’s discussion and analysis of our financial condition and results of operations is based on our financial statements, which we have prepared in accordance with generally accepted accounting principles in the United States. The preparation of these financial statements requires us to make estimates and assumptions that affect the reported amounts of assets and liabilities and the disclosure of contingent assets and liabilities at the date of the financial statements, as well as the reported revenues and expenses during the reporting periods. Actual results may differ from these estimates under different assumptions or conditions.

During the six months ended June 30, 2023, there were no material changes to our critical accounting policies as reported in our Annual Report on Form 10-K for the year ended December 31, 2022.

Impact of New Accounting Standards

The adoption of new accounting standards and the impact of recent accounting pronouncements not yet effective on our consolidated financial statements, if any, is discussed in Note 2 to the interim unaudited consolidated financial statements included in this Quarterly Report on Form 10-Q.

During the period ended June 30, 2023, there were no material changes in our market risk or how our market risk is managed, compared to those disclosed under the heading “Quantitative and Qualitative Disclosures about Market Risk” in our Annual Report on Form 10-K for the year ended December 31, 2022.

Evaluation of Disclosure Controls and Procedures

Our management, with the participation of our principal executive and principal financial officer, has evaluated the effectiveness of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act), as of the end of the period covered by this Quarterly Report on Form 10-Q. The term “disclosure controls and procedures,” as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act, means controls and other procedures of a company that are designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to the company’s management, including its principal executive and principal financial officers, or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosure. Our management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives and management necessarily applies its judgment in evaluating the cost-benefit relationship of possible controls and procedures.

Based on that evaluation of our disclosure controls and procedures as of June 30, 2023, our principal executive officer and principal financial officer concluded that our disclosure controls and procedures as of such date are effective at the reasonable assurance level.

Changes in Internal Control over Financial Reporting

There were no changes in our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) during the period covered by this Quarterly Report on Form 10-Q that materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Information regarding risk factors appears in Part I, Item 1A, Risk Factors, in the Company’s Annual Report on Form 10-K for the year ended December 31, 2022. The Company has reviewed the risk factors, and, except as presented below, there have been no material changes in the Company’s risk factors since those reported in its Annual Report on Form 10-K for the year ended December 31, 2022 and its Quarterly Report on Form 10-Q for the quarter ended March 31, 2023.

Compliance with the Data Security Law of the People’s Republic of China (the “Data Security Law”), Cybersecurity Review Measures, Personal Information Protection Law of the People’s Republic of China (the “PIPL”), the regulations and guidelines relating to the multi-level protection scheme (the “MLPS”) and any other future laws and regulations may entail significant expenses and could materially affect our business. Our failure to comply with such laws and regulations could lead to government enforcement actions and significant penalties against us, materially and adversely impacting our operating results.

China has implemented extensive data protection, privacy and information security rules and is considering a number of additional proposals relating to these subject areas. Based on our understanding of these laws, regulations and policies, some of which were only recently enacted, and the government regulators’ interpretation of those legal requirements as applied to biopharmaceutical companies like us, we believe we are compliant with all of our material legal obligations. Nevertheless, we face significant uncertainties and risks which, as explained below, may materially and adversely affect our operations.

General risks surrounding the types of data we process and types of processing activities in which we engage

We do not maintain, nor do we intend to maintain in the future, personally identifiable health information of patients in China. We do, however, collect and maintain de-identified or anonymized health data for clinical trials in compliance with local regulations. This data could be deemed by government regulators to be “personal information,” “important data,” or “core data.” Under the Cyber Security Law of the People’s Republic of China (the “Cyber Security Law”) and the Data Security Law, data categorized as core data or important data, the latter of which will be determined by governmental authorities in the form of catalogs which have not been published, is to be processed and handled with a higher level of protection, but what data constitutes core data or important data is currently not clearly defined except for certain industry sections. Therefore, in order to comply with the statutory requirements, we will need to determine whether we possess core data or important data, monitor the important data catalogs that are expected to be published by local governments and industry regulators, perform risk assessments and comply with reporting obligations to applicable regulators. We may also be required to disclose to regulators business-sensitive or network security-sensitive details regarding our processing of core data or important data.

With China’s growing emphasis on its sovereignty over data derived from China, the outbound transmission of de-identified or anonymized health data for clinical trials may be subject to the new national security legal regime, including the Cyber Security Law, Data Security Law, the PIPL, the HGR Regulations and various implementing regulations and standards. Due to operational needs, we may from time to time transfer and store personal data and information outside of China in the future. Therefore, we will need to comply with the increasingly strict regulations over cross-border data transfers and monitor any new rules or regulations published by local governments and industry regulators.

Cybersecurity

The Cyber Security Law, which became effective in 2017, requires companies to take certain organizational, technical and administrative measures and other necessary measures to ensure the security of their networks and data stored on their networks. Specifically, the Cyber Security Law provides that companies adopt an MLPS, under which network operators are required to perform obligations of security protection to ensure that their networks are free from interference, disruption or unauthorized access, and prevent network data on their networks from being disclosed, stolen or tampered. Under the MLPS, entities’ operating information systems must have a thorough assessment of the risks and the conditions of their information and network systems to determine the level to which the entity’s information and network systems belong, from the lowest Level 1 to the highest Level 5 pursuant to a series of national standards on the grading and implementation of the classified protection of cyber security. The grading result will determine the set of security protection obligations that entities must comply with. Entities classified as Level 2 or above should report the grade to the relevant government authority for examination and approval.

Under the Cyber Security Law and Data Security Law, we are required to establish and maintain a comprehensive data and network security management system that will enable us to monitor and respond appropriately to data security and network security risks. We will need to classify and take appropriate measures to address risks created by our data processing activities and use of networks. We are obligated to notify affected individuals and appropriate Chinese regulators of and respond to any data security and network security incidents.

Establishing and maintaining such systems and complying with such requirements takes substantial time, effort, and cost, and we may not be able to establish and maintain such systems or comply with such requirements as fully as needed for compliance with our legal obligations. Despite our investment, such systems and compliance efforts may not adequately protect us or enable us to appropriately respond to or mitigate all data compliance risks or data security and network security risks or incidents we face.

Cybersecurity review

Following the Draft Data Security Management Regulations, the Cybersecurity Review Measures, which came into effect on February 15, 2022, confirmed that critical information infrastructure operators procuring network products and services and online platform operators carrying out data processing activities, which affect or may affect national security, are required to conduct a cybersecurity review pursuant to the provisions therein. In addition, online platform operators possessing personal information of more than one million users seeking to be listed on foreign stock markets must apply for a cybersecurity review.

Pursuant to the Draft Data Security Management Regulations, data processors seeking to list on foreign stock markets shall assess their data security themselves or through data security service organizations annually, and submit the assessment reports to relevant competent authorities.

We have not received any notice from any Chinese regulatory authority identifying us as a “critical information infrastructure operator” or “online platform operator” or requiring us to go through cybersecurity review procedures by the CAC pursuant to the Cybersecurity Review Measures. Based on our understanding of the Cybersecurity Review Measures and the Draft Data Security Management Regulations, if enacted as currently proposed, we do not expect ourselves to become subject to cybersecurity review by the CAC for issuing securities to foreign investors because: (i) the clinical and preclinical data we handle in our business operations, either by its nature or in scale, do not normally trigger significant concerns over Mainland China’s national security; and (ii) we have not processed, and do not anticipate to process in the foreseeable future, personal information of more than one million users or individuals. However, there remains uncertainty as to how the Cybersecurity Review Measures and the Draft Data Security Management Regulations, if enacted as currently proposed, will be interpreted or implemented and whether Chinese regulatory authorities may adopt new laws, regulations, rules, or detailed implementation and interpretation in relation, or in addition, to the Cybersecurity Review Measures and the proposed Draft Data Security Management Regulations. While we intend to closely monitor the evolving laws and regulations in this area and take all reasonable measures to mitigate compliance risks, we cannot guarantee that our business and operations will not be adversely affected by the potential impact of the Cybersecurity Review Measures, the Draft Data Security Management Regulations, if enacted, or other laws and regulations related to privacy, data protection and information security.

It is also unclear at the present time how widespread the cybersecurity review requirement and the enforcement action will be and what effect they will have on the life sciences sector generally and the Company in particular. Mainland China’s regulators may impose penalties for non-compliance ranging from fines to suspension of operations, and this could lead to us delisting from the U.S. stock market. Currently, we have not been involved in any investigations on cybersecurity review initiated by the CAC or related governmental regulatory authorities, and we have not received any inquiry, notice, warning, or sanction in such respect.

Cross-border data transfer requirements (security assessment; certification; standard contract)

China continues to strengthen its regulation of cross-border transfers out of Mainland China of data, including important data and personal information.

The requirement for some data processors to store personal information or important data in China, unless certain legally recognized protective measures are undertaken, was first introduced in 2017 under the Cyber Security Law, but is now solidified through the publication of the PIPL and the Security Assessment Measures. The PIPL requires that personal information processors processing certain quantities of personal information in accordance with relevant laws and regulations and need to transfer such information out of Mainland China to pass a security assessment organized by Chinese cyberspace regulators, and all other personal information processors that are not required to pass the security assessment and need to transfer out of Mainland China personal information to either: (i) undergo certification by specialized certification agencies in accordance with relevant regulations, (ii) conclude a standard contract designated by China cyberspace regulators with the overseas recipient of the personal information, or (iii) satisfy other conditions contemplated by laws, administrative regulations or Chinese cyberspace regulators. In addition to the above, personal information processors that need to transfer out of Mainland China personal information shall conduct a privacy impact assessment.

Notably, the PIPL provides for significant fines for serious violations of up to RMB 50 million, or 5% of annual revenues from the prior year and violators may also be ordered to suspend any related activity by competent authorities. We do not maintain, nor do we intend to maintain in the future, personally identifiable health information of patients in China. We do, however, collect and maintain de-identified or pseudonymized health data for clinical trials in compliance with local regulations. This data could be deemed as personal data or important data. We may transfer and store personal data and information that whistleblowers provide through our whistleblower hotline to, in, and using centralized databases and systems located in the United States, Mainland China, and Hong Kong. In addition, we have engaged a third-party data processor to process the personal data and information that such whistleblowers provide, on our behalf. Such personal data and information will be stored in one or more databases located on servers hosted and operated by the third party, in the United States.

To implement the security assessment mechanisms for cross-border transfers out of China of data under the Cyber Security Law, the Data Security Law, and the PIPL, the CAC promulgated the Security Assessment Measures, which took effect on September 1, 2022, and published the Security Assessment Guide on August 31, 2022. Under the Security Assessment Measures, a mandatory security assessment is required for data transfers out of Mainland China under any of the following circumstances: (i) transfer of important data by data processors; (ii) transfer of personal information by critical information infrastructure operators and data processors that process personal information of more than one million individuals; (iii) transfer of personal information by data processors that have transferred either personal information of over 100,000 individuals or sensitive personal information of over 10,000 individuals abroad since January 1 of the preceding year; and (iv) other situations as determined by the CAC. The Security Assessment Measures have retroactive effect for relevant cross-border data transfers out of Mainland China conducted prior to September 1, 2022, and data processors are required to undergo mandatory security assessment for such prior relevant cross-border data transfers by February 28, 2023. We do not believe, based on our understanding of the Security Assessment Measures that our transfers of data out of Mainland China currently or in the past require us to undergo a mandatory security assessment under the Security Assessment Measures, but we may in the foreseeable future conduct cross-border data transfers of data that require us to undergo a mandatory security assessment under the Security Assessment Measures for such transfers.

To implement the standard contract mechanism for cross-border transfers out of China of personal information under the PIPL, on February 24, 2023, the CAC published the PRC Standard Contract, which will come into effect on June 1, 2023. Once this comes into effect, personal information processors may conclude a PRC Standard Contract with overseas recipients of personal information to comply with PIPL requirements for cross-border transfers out of Mainland China of personal information that do not need to undergo a security assessment.

To implement the personal information protection certification mechanism for cross-border transfers out of China of personal information under the PIPL, on November 4, 2022, the CAC and SAMR jointly issued the Notification on the Implementation of Personal Information Protection Certification. In parallel, on December 16, 2022, the National Information Security Standardization Technical Committee released an updated version of the Certification Specification which provides the general principles and detailed requirements for personal information processors engaging in the cross-border transfer out of Mainland China of personal information to meet in order to obtain a personal information protection certification from qualified certification institutions for cross-border transfers out of China of personal information governed by the PIPL.

Transferring data to foreign law enforcement agencies or judicial authorities

The Data Security Law and PIPL prohibit entities in Mainland China from transferring data (including personal information) stored in Mainland China to foreign law enforcement agencies or judicial authorities without prior approval by the Chinese government. We may need to pass a government security review or obtain government approval in order to share data (including personal information) stored in Mainland China with judicial and law enforcement authorities outside of Mainland China. Therefore, if judicial and law enforcement authorities outside Mainland China require us to provide data stored in Mainland China, and we are not able to pass any required government security review or obtain any required government approval to do so, we may not be able to meet the foreign authorities’ requirements. The potential conflicts in legal obligations could have adverse impacts on our operations in and outside of Mainland China. Recently, the CAC has taken action against several Chinese internet companies listed on U.S. securities exchanges for alleged national security risks and improper collection and use of the personal information of Chinese data subjects. According to the official announcement, the action was initiated based on the National Security Law of the People’s Republic of China (the “National Security Law”), the Cyber Security Law and the Cybersecurity Review Measures, which are aimed at “preventing national data security risks, maintaining national security and safeguarding public interests.”

Industry and local regulations

In addition, certain industry-specific laws and regulations affect the collection and transfer of personal data in Mainland China. For example, the HGR Regulation prohibits both onshore and offshore entities established or actually controlled by foreign entities and individuals from collecting or biobanking any China-Sourced HGR in China, as well as providing such China-Sourced HGR outside of China. Chinese parties are required to seek an advance approval for the collection and biobanking of all China-Sourced HGR. Approval for any export or cross-border transfer of China-Sourced HGR in the form of biospecimens is required, and transfer of derived data by Chinese parties to foreign parties or entities established or actually controlled by them also requires the Chinese parties to file, before the transfer, a copy of the data with the Human Genetic Resources Administration of China (the “HGRAC”) for record purposes and to obtain a notification filing number in order to transfer the data. The HGR Regulation also requires that foreign parties or entities established or actually controlled by them ensure the full participation of Chinese parties in international collaborations and share all records and data with the Chinese parties.

To further tighten the control of China-Sourced HGR, the SCNPC issued the Eleventh Amendment to the Criminal Law of the People’s Republic of China on December 26, 2020, which became effective on March 1, 2021, criminalizing the illegal collection of China-Sourced HGR and the illegal transfer of China-sourced biospecimens outside of Mainland China. An individual who is convicted of any of these violations may be subject to public surveillance, criminal detention, a fixed-term imprisonment of up to seven years and/or a criminal fine. In October 2020, the SCNPC adopted the Biosecurity Law, which became effective on April 15, 2021. The Biosecurity Law will establish an integrated system to regulate biosecurity-related activities in Mainland China, including, among others, the security regulation of HGR and biological resources. The Biosecurity Law for the first time expressly declared that Mainland China has sovereignty over its HGR, and further endorsed the HGR Regulation by recognizing the fundamental regulatory principles and systems established by it over the utilization of China-Sourced HGR by foreign parties or entities established or actually controlled by them in Mainland China. Though the Biosecurity Law does not provide any specific new regulatory requirements on HGR, as it is a law adopted by Mainland China’s highest legislative authority, it gives Mainland China’s primary regulator of HGR, the MOST, significantly more power and discretion to regulate HGR and it is expected that the overall regulatory landscape for China-Sourced HGR will evolve and become even more rigorous and sophisticated. In addition, the interpretation and application of data protection laws in Mainland China and elsewhere are often uncertain and in flux. In May 2023, the Ministry of Science and Technology, or MOST, published the Implementing Rules of the HGR Regulation (the “HGR Implementing Rules”) which came into effect in July 2023. The HGR Implementing Rules have, among other things, provided operational details and clarified questions that have emerged in the past few years, such as further clarified the scope of China-Sourced HGR, improved the procedure rules for applicable approval, filing and security review, and refined the provisions with respect to the prohibition on the collection, preservation and export of China-Sourced HGR by foreign organizations, individuals, and the entities established or actually controlled by foreign organizations or individuals. Under the HGR Implementing Rules, clinical studies conducted for the purpose of obtaining marketing authorization for drugs and medical devices in China, if not involving the export of human genetic materials, will be eligible for a notification filing (instead of the advance approval) if the human genetic materials are collected by sites, and processed by sites or an onshore third-party specified in the clinical trial protocol. The HGR Implementing Rules also enumerate situations where a security review is required for external provision of or open access to of human genetic data, such as external provision of or open access to human genetic data about important genetic pedigrees, human genetic data from specific regions, and exome sequencing and genome sequencing information of over 500 individuals.

So far, the HGRAC has disclosed a number of HGR violation cases. In one case, the sanctioned party was the Chinese subsidiary of a multinational pharmaceutical company that was found to have illegally transferred certain biospecimens to CROs for conducting certain unapproved research. In addition to a written warning and confiscation of relevant human genetic materials, the Chinese subsidiary of the multinational pharmaceutical company was requested by the HGRAC to take rectification measures and was also banned by the HGRAC from submitting any clinical trial applications until the HGRAC was satisfied with the rectification results, which rendered it unable to initiate new clinical trials in Mainland China until the ban was lifted. In another case, the CRO engaged by the Chinese subsidiary of a multinational pharmaceutical company was found to have forged an ethics committee approval in order to accelerate the HGRAC approval. Both the Chinese subsidiary of the multi-national pharmaceutical company and the CRO were debarred from initiating new applications for a period of 6 to 12 months, respectively.

Uncertainties about our compliance with the changing legal landscape despite our best efforts

Interpretation, application and enforcement of these laws, rules and regulations evolve from time to time and their scope may continually change, through new legislation, amendments to existing legislation or changes in enforcement. Compliance with the Cyber Security Law, the Data Security Law, the PIPL and other related laws and regulations could significantly increase the cost to us of providing our products, require significant changes to our operations or even prevent us from providing certain products in jurisdictions in which we currently operate or in which we may operate in the future. Despite our efforts to comply with applicable laws, regulations and other obligations relating to privacy, data protection and information security, it is possible that our practices, products or platform could fail to meet all of the requirements imposed on us by the Cyber Security Law, the Data Security Law, the PIPL and/or related laws and regulations. Any failure on our part to comply with such laws or regulations or any other obligations relating to privacy, data protection or information security, or any compromise of security that results in unauthorized access, use or release of personally identifiable information or other data, or the perception or allegation that any of the foregoing types of failure or compromise has occurred, could damage our reputation, discourage new and existing counterparties from contracting with us or result in investigations, fines, suspension or other penalties by Chinese government authorities and private claims or litigation, any of which could materially adversely affect our business, financial condition and results of operations. If the Chinese parties fail to comply with data protection, data privacy and cybersecurity laws, regulations and practice standards, and our research data is obtained by unauthorized persons, used or disclosed inappropriately or destroyed, we may lose our confidential information and be subject to litigation and government enforcement actions. It is possible that these laws and regulations may be interpreted and applied in a manner that is inconsistent with our or our collaborators’ practices, potentially resulting in suspension of relevant ongoing clinical trials or delays in the initiation of new trials, delays in sharing or an inability to share or receive clinical trial data with or from our collaborators, confiscation of China-Sourced HGR, administrative fines, disgorgement of illegal gains, or temporary or permanent debarment of our or our collaborators’ entities and responsible persons from further clinical trials and, consequently, a de-facto ban on the debarred entities from initiating new clinical trials in Mainland China. In addition, a data breach affecting personal information, including health information, or a failure to comply with applicable requirements could result in significant management resources, legal and financial exposure and reputational damage that could potentially have a material adverse effect on our business and results of operations. Even if our practices are not subject to legal challenge, the perception of privacy concerns, whether or not valid, may harm our reputation and brand and adversely affect our business, financial condition and results of operations. Moreover, the legal uncertainty created by the Data Security Law, the PIPL, the Cyber Security Law, the Cybersecurity Review Measures and the recent Chinese government actions could materially adversely affect our ability, on favorable terms, to raise capital in the U.S. market in the future.

The national security legal regime imposes stricter data localization requirements on personal information and human health-related data and requires us to undergo cybersecurity or other security review and assessments, obtain government approval or certification, implement technical and organizational measures for data privacy and protection, conduct privacy impact assessments, or put in place certain contractual protections before transferring personal information and human health-related data out of Mainland China. As a result, personal information, important data and health and medical data that we or our customers, vendors, clinical trial sites, pharmaceutical partners and other third parties collect, generate or process in Mainland China may be subject to such data localization requirements and heightened regulatory oversight and controls. We may need to maintain local data centers in Mainland China, enter into standard contracts with the overseas recipients of any personal information processed by us, conduct privacy impact assessments, undergo security assessments, or obtain the requisite approvals from the Chinese government for the transmission outside of Mainland China of such controlled information and data, which could significantly increase our operating costs or cause delays or disruptions in our business operations in and outside Mainland China. We expect that the evolving regulatory interpretation and enforcement of the national security legal regime will lead to increased operational and compliance costs and will require us to continually monitor and, where necessary, make changes to our operations, policies, and procedures. If our operations, or the operations of our CROs, licensees or partners, are found to be in violation of these requirements, we may suffer loss of use of data, suffer a delay in obtaining regulatory approval for our products, be unable to transfer data out of Mainland China, be unable to comply with our contractual requirements, suffer reputational harm, or be subject to penalties, including administrative, civil and criminal penalties, damages, fines, and the curtailment or restructuring of our operations. If any of these were to occur, it could materially adversely affect our ability to operate our business and our financial results.