Risk Factors Update Summary

• Added uncertainty regarding insurance coverage adequacy and future claims payment.
• Accumulated deficit increased from $149 million to $197 million as of December 31, 2023.
• Increased potential fines under CCPA and other state privacy laws, up to $7,500 per violation.
• Cash and cash equivalents decreased from $79 million to $96 million as of December 31, 2023.
• Phase 2b clinical trial CAHmelia-204 initiated with 100 adult patients with classic CAH on supraphysiologic doses of glucocorticoids.
• Added risks related to data transfer restrictions and localization requirements, impacting operations.
• Net losses increased from $47.9 million to $96.2 million for the years ended December 31, 2023 and 2022.
• Phase 2b clinical trial CAHmelia-203 did not meet the primary efficacy endpoint, leading to its termination in March 2024.
• Expanded obligations under GDPR and UK GDPR, with stringent data transfer limitations.
• Private placement completed for net proceeds of $50.9 million in February 2023.
• Increased scrutiny on cross-border data transfers, subject to legal challenges and uncertainties.
• Upfront payment of $15.0 million received in April 2023 under the Kaken License Agreement.
• Changes in patent laws and court decisions may impact patent protection and enforceability.
• Opted out of the Unitary Patent Court, increasing uncertainty in European patent enforcement.