14 The distribution of biologic and pharmaceutical products is subject to additional requirements and regulations, including extensive record-keeping, licensing, storage and security requirements intended to prevent the unauthorized sale of pharmaceutical products. Failure to maintain compliance with these healthcare laws could result in the imposition of significant civil, criminal and administrative penalties, damages, disgorgement, monetary fines, imprisonment, possible exclusion from participation in Medicare, Medicaid and other federal healthcare programs, contractual damages, reputational harm, diminished profits and future earnings and curtailment of our operations, any of which could adversely affect our ability to operate our business and our results of operations. Data Privacy and Security Data privacy and security laws in the U.S. are also increasingly complex and changing rapidly. Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. These state laws allow for statutory fines for noncompliance. In addition, the processing of personal data in connection with clinical trials in the EU must comply with the EU’s General Data Protection Regulation, or EU GDPR. The EU GDPR imposes stringent data protection requirements and provides for penalties for noncompliance that can include bans on processing personal data and fines of up to the greater of 20 million euros or four percent of worldwide annual revenues. The EU GDPR requires organizations to give detailed disclosures about how they collect, use and share personal data; under certain conditions, obtain explicit consent to process sensitive personal data, such as health or genetic information; contractually require vendors to meet data protection requirements; maintain adequate data security measures; notify regulators and affected individuals of certain data breaches; meet extensive privacy governance and documentation requirements; and afford individuals’ data protection rights, including their rights to access, correct and delete their personal data. European data protection laws generally restrict the transfer of personal data from Europe, including from the European Economic Area, the United Kingdom and Switzerland, to the U.S. and most other countries unless the parties to the transfer have implemented specific safeguards to protect the transferred personal data. Legal challenges have in the past and may in the future be successful in limiting the mechanisms available to transfer personal data across national borders. The failure to comply with any of these laws, regulatory, or other legal requirements may result in legal and regulatory actions. Depending on the circumstances, failure to meet applicable obligations can result in significant penalties, including administrative, civil, and criminal penalties, fines, imprisonment, disgorgement, injunctions, exclusion from participation in federal healthcare programs, integrity oversight and reporting obligations, requests for recall, seizure of products, total or partial suspension of production, denial or withdrawal of product approvals or refusal to allow a firm to enter into supply contracts, including government contracts. Any action against us for violation of these obligations, even if we successfully defend against it, could cause us to incur significant legal expenses and divert our management’s attention from the operation of our business. Prohibitions or restrictions on sales or withdrawal of future products marketed by us could materially affect our business in an adverse way. U.S. Health Care Reform Changes in regulations, statutes or the interpretation of existing regulations could impact our business in the future by requiring, for example: (1) changes to our manufacturing arrangements; (2) additions or modifications to product labeling; (3) the recall or discontinuation of our products; or (4) additional record-keeping requirements. If any such changes were to be imposed, they could adversely affect the operation of our business. Further, the United States, there have been and continue to be a number of healthcare-related legislative initiatives that have significantly affected the healthcare industry. For example, on August 16, 2022, the Inflation Reduction Act of 2022, or IRA, was signed into law, which among other things, extends enhanced subsidies for individuals purchasing health insurance coverage in ACA marketplaces through plan year 2025. The IRA also eliminates the “donut hole” under the Medicare Part D program beginning in 2025 by significantly lowering the beneficiary maximum out-of-pocket cost and creating a new manufacturer discount program. It is unclear how any additional challenges and healthcare form measures of the second Trump administration will impact the ACA and our business.