17.

18.

(defined as any data other than personal data), access and sharing of NPD with government and corporations alike and a
registration regime and for “data businesses”, being business that collect, process or store data, both personal and non-
personal. As part of our operations, we are also required to comply with the IT Act and the rules thereof, which provides
for civil and criminal liability including compensation to persons affected, penalties and imprisonment for various cyber
related offenses, including unauthorized disclosure of confidential information and failure to protect sensitive personal
data. India has already implemented certain privacy laws, including the Information Technology (Reasonable Security
Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the recently introduced Information
Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, which impose limitations and
restrictions on the collection, use, disclosure and transfer of personal information and restrictions on the collection, use,
disclosure and transfer of personal information.

If we were to be found to be in violation of the privacy or security rules under the IT Act or any such other laws protecting
the confidentiality of patient health information, we could be subject to sanctions or criminal penalties, or otherwise be the
subject to litigation (including a class action) for breach of privacy or failing to ensure the security of confidential consumer
information. In addition, new laws, regulations or policies relating to personal data privacy may be enacted in the future.
We may be required to modify our business in the future in order to continue complying with such laws. If we fail to do
so, we may be exposed to sanctions, penalties, litigation or losses. The occurrence of any of these could increase our
liabilities, harm our reputation and have a material adverse effect on our business, results of operations and financial
condition. While there have been no instances where information relating to confidentiality of patient health information
has been compromised during the last three financial years and the six months ended September 30, 2021, we cannot assure
you that such instances may not occur in the future.

We are subject to risks associated with expansion into new markets.
Our expansion into emerging markets within India subjects us to various challenges, including those relating to identifying
relevant retail space, hiring adequate staffing and manpower, managing our operations and penetrating our brand in such
regions. Such risks may be higher than expected, and we may face significant competition in such emerging markets.
By expanding into new markets, we could be subject to additional risks and uncertainties associated with:

e establishing and conducting operations;

¢ compliance with a wide range of local laws, regulations and practices:

« changes in laws, regulations and practices and their interpretation;

e changes in local preferences and service requirements;

© — stringent as well as differing local labour and other regulations;

e — differing state customs, tariffs and taxes;

* exposure to expropriation or other state government actions;

¢ — the growth in size or scope of our business, expansion of our footprint in existing regions in which we operate and
entry into new markets; and

© political, economic and social instability.

If any of these risks materialise, it could have a material adverse effect on our business, cash flows, results of operations
and prospects. In the past, we have previously commenced operations in Kerala but ceased operations shortly thereafter
in the financial year 2010 as a result of the unfavourable prevailing regulatory climate, such as a prohibition on operating
a chain of pharmaceutical stores, such as ours, in Kerala. We cannot assure you that any future expansions by us into new
markets will be successful, or that we will be able to expand at the same rates as we have, historically.

We may face product liability, product recall or personal injury issues which could damage our reputation and have
a significant adverse effect on our business, operating results, cash flows and/or financial condition.

Pharmacy retail businesses could be adversely impacted by the supply of defective or expired products, including the
infiltration of counterfeit products into the supply chain, product tampering, product recalls or product mishandling issues.
In addition to prescriptions issued by medical practitioners, pharmacists may also be requested by customers to offer
counselling on medication, dosage, delivery systems, common side effects and other such information. Pharmacists may
also have a duty to warn customers regarding any potential negative effects of a prescription drug if the warning could
reduce or negate these effects. However, if the concerned pharmacist fails to provide such counselling requested by
customers or warnings of how such drugs may cause adverse side effects to the customer, it may render us liable to incur

36
