Commercial risk

Commercial risks in digital health

Digital health is a significant costs-reduction opportunity for the healthcare sector, particularly in terms of both

• (i) efficiency and accuracy of provision of service; and

• (ii) personalisation of patient treatment and reduction of burden upon the medical system through increased involvement of the patient in his or her own healthcare.

At the same time, the technology is at an emergent and fragmented stage, with unclear and uneven application of the prevailing regulatory regime, and with a very large number of innovations coming to market with little track-record or scrutiny. This creates multiple potential commercial operating risks for the entrepreneur, as well as threats to the entrepreneur’s investors’ interests.

This section sets out:

• where these commercial risks arise
• what these potential risks and (misrepresentation & misstatement, contractual disputes and other third party claims) and how digital health businesses can reduce them, and
• how to deal with these risks as an investor.

Where do the risks arise?

Digital health businesses face potential exposure to claims by their contract counterparties, including public national health services, private healthcare entities, third-party suppliers and, ultimately, the consumer.

In addition, the directors and officers of digital health businesses may face personal liability to their investors in respect of such and other issues.

Misrepresentation and misstatement

A misrepresentation of fact that causes a person to enter into a contract with the business and suffer loss as a result can give rise to liability for damages on the part of the business towards the injured party. This includes innocent misrepresentations, although these can also be dealt with by rescinding the contract (in other words, trying to put the parties back into the position they were in before the contract was entered into).

Directors and officers of the business can also face personal liability for damages, for example where they have personally sold shares in the company to investors and those investors have relied on a misrepresentation by those directors or officers in acquiring the shares.

By their nature, representations are generally pre-contractual and made when one party is trying to entice the other into a deal. Frequently, contracts will expressly set out the representations upon which a party has relied in entering into the agreement.

Where a misrepresentation is expressly set out in the contract, then the injured party has a choice about whether to bring a claim for damages caused by breach of contract, and/or damages for misrepresentation (the two have different bases of calculation).

There are a number of methods by which digital health businesses can limit their exposure to misrepresentation and misstatement claims:

Contractual methods (although note that these can never be used to limit or exclude liability for fraud):

• limitation/exclusion clauses liability caps, and
• non-reliance statements/entire agreement clauses.

Non-contractual methods:

• ask itself searching questions about what information a contract counterparty would be likely to consider relevant and material to its decision to enter into a contract (either on particular terms or at all)
• give full disclosure to the other side of such material issues, and
• establish and preserve a paper-trail showing that such disclosure has been given.

Contractual disputes

There are numerous routes by which a business can become exposed to claims for breach of contract in respect of its agreements with third parties, including any and all of the contract counterparties previously identified.

However, there are steps that digital health businesses can take in order to reduce the risks of a claim for breach of contract:

• make sure that the contract accurately reflects the parties’ intended bargain. Frequently, the process of papering a deal is conducted in isolation from the commercial negotiation, with insufficient dialogue between the negotiating team and the drafting team. This also increases the risk of commercial promises being made that are legally or logistically challenging to deliver.

• make sure that the contract is reviewed by lawyers specialised in the law of the contract, in order to ensure that the contract is enforceable and that it functions as expected.

• ensure that the contract is appropriate to the parties’ circumstances. In particular, do not treat any clauses as boilerplate, but rather review each clause in order to determine whether it is necessary and appropriate. Where one party is located in an enforcement-unfriendly jurisdiction, for example, careful thought should be given as to whether the courts of that jurisdiction (or another with recognition and enforcement arrangements with that jurisdiction) should be given jurisdiction over disputes arising out of the contract (or whether the parties would be better off designating arbitration as the choice of forum for the resolution of disputes).

• to the extent possible, the contract should exhaustively spell out any standards of performance and/or specification that it is intended should apply. A frank conversation should be had in respect of these in order to identify and manage potential differences of approach. This is particularly important where the contract counterparties are based in different jurisdictions with dissimilar legal principles (for instance, in relation to implied contractual obligations of good faith).

• ensure that risk is sufficiently identified, apportioned and limited/excluded in the contract. Specific known types of potential loss and damage should be identified in the agreement, and agreement reached as to which party will accept responsibility for such loss and damages.

• once the contract is signed, ensure that the parties are conducting their relationship in accordance with it. Audit the performance of the contract (particularly in relation to how contract management is performed) in order to identify and correct instances of non-adherence.

• all matters should be exhaustively documented, and an appropriate document retention policy implemented and adhered to, in order to ensure that relevant potential evidence is preserved.

• when a dispute does eventually arise, it should be handled carefully and in accordance with any dispute resolution mechanism set out in the contract. All communications should be through a sole authorised point of contact and carefully documented. Advice should be sought at an early stage (if necessary, behind the scenes) from a dispute resolution specialist in order to ensure that all correspondence is appropriately drafted and targeted.

Other third party claims

Product liability claims can be brought under a variety of different headings, but all essentially involve an allegation that a product has failed to meet relevant applicable minimum standards (because of negligence, breach of contract, and/or statutory liability for defective products).

Consumer claims (as well as potential criminal liability) can also arise off the back of regulatory breaches (for instance, in relation to the Data Protection Act 1998 and/or a breach of the Medical Device Directive - soon to be replaced by the Medical Device Regulation).

It is also important to note that, where the digital health business forms part of a larger supply chain, the business can be drawn into a product liability or other consumer dispute elsewhere in the chain as a result of other parties in that chain bringing contribution claims against the business. It is for this reason that it is important to ensure that risk is appropriately shared, apportioned and limited up and down the chain.

Thought should be given in each case as to the available contractual and non-contractual options to mitigate the risks of such claims:

• these include the various options set out above in relation to misrepresentation and misstatement claims.
• in addition, in general, package inserts and consumer-facing information should contain clear and unambiguous statements as to the purpose, method of use and limitations of the product, in order to reduce the prospects of a successful claim in relation to an improperly-used product.
• regular post-market surveillance should be conducted in order to spot trends in potential product abuse or out-of-scope use, so that appropriate changes (to the product, its accompanying literature, and/or its regulatory approval) can be put into effect.
• there should be rigorous auditing of the product’s and business’s compliance with the regulatory regime, including in relation to data protection legislation (and including, in this respect, ensuring the design and implementation of robust cyber-security and business recovery and continuity plans).
• consideration should also be given to the availability of insurance in order to offset some of the liability.
• again, the business should implement and ensure compliance with a comprehensive document retention policy, not least for the purposes of preserving potential evidence.

Dealing with risks as an investor

The principal means of mitigating such risks from an investor’s perspective is proper due diligence, coupled with a thorough understanding of the technology’s genesis, purpose and method of operation, as well as assessment of the technology’s regulatory compliance and post-market surveillance.

Also consider the corporate culture and, in particular, the skills present on the board and amongst the existing shareholders -potential warning signs can, for example, include a cutting-edge technology company discouraging investments from established life sciences companies and experts and/or having a non-executive board team comprising individuals who are high-profile but not necessarily known for their scientific acumen.

Other relevant questions to explore include:

• how does the business routinely contract around and out of its commercial risks?
• how are those risks limited or apportioned in the contracts?
• what is carved out of liability, and
• what steps have been taken to share liability up and down the distribution chain

It is also important to bear in mind that the consumer is usually at the end of the supply chain, that consumers can be very litigious, and that even if a consumer claim is bogus it is going to cost the business time and legal fees.

You should therefore be asking:

• how exposed is the business to such product liability and other consumer claims?
• are there known issues or weaknesses in the technology?
• if so how are those being dealt with and presented to the market, and what is being done to limit the commercial risk that they represent? what does the contract/EULA wording say?
• what insurance is available?

Potential investors need to be live to the risks of misrepresentation and misstatement, and the need to get as full and unvarnished a sight into the inner workings of the company and its technology as is commercially possible.

Whilst it is possible to draft around potential issues at the investment stage, it is far better to get the full picture at the outset and not to make the investment at all, than to invest significantly on the strength of extensive contractual warranties and representations that ultimately transpire to be worthless.