PetMed Express (PETS) 10-K2024 FY Annual report

In April 2023, we acquired PetCareRx, Inc. (“PetCareRx”), an online supplier of pet medications, foods, and supplies based in New York. This acquisition added a catalog of food and supplies and approximately 286,000 new and renewal customers to our company, allowing us to rapidly expand beyond our core offering of pet prescriptions. We now provide a more extensive selection of premium food, supplements, treats, and other pet supplies as a result of this acquisition.

In February 2023, we announced a strategic partnership with Pumpkin Insurance Services, Inc. (“Pumpkin”), a leading provider of premium pet insurance plans. Through this collaboration, we offer our customers access to high-quality health and wellness pet insurance benefits as part of our holistic wellness ecosystem. This partnership enables our customers to purchase co-branded insurance plans, developed in conjunction with Pumpkin and their underwriters, and offered by our subsidiary, PetMeds Insurance Services, LLC. These innovative insurance products became available for purchase in October 2023, providing pet owners with peace of mind as they navigate all stages of their pets' lives.

PetMeds is committed to a long-term vision of becoming a leading digital-first pet wellness company. The Company is incorporating new leadership and new strategic opportunities to make progress against initiatives that support this vision, while balancing the near-term challenges and business headwinds.

In addition to the foregoing, the FDA regulates animal feed, including pet food, under the Federal Food, Drug, and Cosmetic Act (the “FFDCA”) and its implementing regulations. Although pet foods are not required to obtain premarket approval from the FDA, the FFDCA requires that all animal foods are safe for consumption, produced under sanitary conditions, contain no harmful substances, and are truthfully labeled. Most states also require that pet foods distributed in the state be registered or licensed with the appropriate state regulatory agency. In addition, most facilities that manufacture, process, pack, or hold foods, including pet foods, must register with the FDA and renew their registration every two years, and are subject to periodic FDA inspection. This includes most foreign, as well as domestic facilities. Registration must occur before the facility begins its pet food manufacturing, processing, packing, or holding operations.

Further, we currently accept payments using a variety of different payment methods which may subject us to additional regulations and compliance requirements, and may also increase our exposure to fraud, criminal activity, and other risks. In the future, as technology develops and we begin to offer new payment options to consumers, including by integrating emerging mobile and other payment methods, we may be subject to additional regulations, compliance requirements, or fraud. If we fail to comply with the rules or requirements of any provider of a payment method we accept, if the volume of fraud in our transactions limits or terminates our rights to use payment methods we currently accept, or if a data breach occurs relating to our payment systems, we may, among other things, be subject to fines or higher transaction fees and may lose, or face restrictions placed upon, our ability to accept credit card payments from consumers or facilitate other types of online payments. If any of these events were to occur, our business, financial condition, and results of operations could be materially and adversely affected.

As a result of our services being web based, we collect, process, transmit and store large amounts of data about our customers, employees, suppliers and others, including credit card information and personally identifiable information, as well as other confidential and proprietary information. We also employ third-party service providers for a variety of reasons, including storing, processing and transmitting proprietary, personal and confidential information on our behalf. While we rely on tokenization solutions licensed from third parties in an effort to securely transmit confidential and sensitive information, including credit card numbers, advances in computer capabilities, new technological discoveries or other developments may result in the whole or partial failure of these solutions to protect confidential and sensitive information from being breached or compromised. Similarly, our security measures, and those of our third-party service providers, may not detect or prevent all attempts to hack our systems or those of our third-party service providers. Distributed Denial-of-Service ("DDoS") attacks, viruses, malicious software, break-ins, phishing attacks, ransomware, social engineering, security breaches or other cybersecurity incidents and similar disruptions that may jeopardize the security of information stored in or transmitted by our websites, networks and systems or that we or our third-party service providers otherwise maintain, including payment card systems, may subject us to fines or higher transaction fees or limit or terminate our access to certain payment methods. We and our service providers may not anticipate or prevent all types of attacks until after they have already been launched, and techniques used to obtain unauthorized access to or sabotage systems change frequently and may not be known until launched against us or our third-party service providers. In

Breaches of our security measures or those of our third-party service providers or any cybersecurity incident could result in unauthorized access to our websites, networks and systems; unauthorized access to and misappropriation of consumer and/or employee information, including personally identifiable information, or other confidential or proprietary information of ourselves or third parties; viruses, worms, spyware or other malware being served from our websites, networks or systems; deletion or modification of content or the display of unauthorized content on our websites; interruption, disruption or malfunction of operations; costs relating to cybersecurity incident remediation, deployment of additional personnel and protection technologies, response to governmental investigations and media inquiries and coverage; engagement of third party experts and consultants; litigation, regulatory action and other potential liabilities. If any of these cybersecurity incidents occur, or there is a public perception that we, or our third-party service providers, have suffered such a breach, or we are unable to determine materiality within a reasonable timeframe under the new Cybersecurity rules, our reputation and brands could also be damaged and we could be required to expend significant capital and other resources to alleviate problems caused by such cybersecurity incidents. As a consequence, our business could be materially and adversely affected and we could also be exposed to litigation and regulatory action and possible liability. In addition, any party who is able to illicitly obtain a customer’s password could access the customer’s transaction data or personal information. Any compromise or breach of our security measures, or those of our third-party service providers, or our failure to protect our customer's confidential information and data, could violate applicable privacy, data security and other laws, and cause significant legal and financial exposure, adverse publicity and a loss of confidence in our security measures, which could have a material adverse effect on our business, financial condition, and results of operations.

We collect, maintain, use, and share personal information provided to us through our various marketing activities, including email and social media marketing and postal mailings, as well as other consumer, employee, and business-to-business interactions, in order to provide a better experience for our customers, employees, and vendors. Our current and future marketing and advertising practices depend on our ability to collect, maintain, use, and share this personal information with certain service providers and other third-party vendors, and we are subject to various federal and state laws and regulations that govern such marketing and advertising practices. In addition, we also collect, store, and transmit employees’ health information for certain reasons, such as administering employee benefits; accommodating disabilities and injuries; complying with public health requirements; and maintaining employee safety in the workplace.

Laws and regulations relating to privacy, data protection, cybersecurity, marketing and advertising, and consumer protection are evolving and subject to potentially differing interpretations. While we strive to comply with all such regulations and believe that we are good stewards of our customers’ data, this area is rapidly evolving, and it is possible that these requirements may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another or may conflict with other rules or our practices. If so, we may be subject to proceedings or actions against us by governmental entities or others, and we may suffer damage to our reputation as a result of such proceedings or actions. We may also be contractually required to indemnify and hold harmless third parties from the costs or consequences of non-compliance with any laws, regulations or other legal obligations relating to privacy, data protection, cybersecurity or consumer protection or any inadvertent or unauthorized use or disclosure of data that we store or handle as part of operating our business.

Federal and state governmental authorities continue to evaluate the privacy implications inherent in the use of third-party “cookies” and other methods of online tracking for behavioral advertising and other purposes. The U.S. government and state governments have enacted, have considered or are considering enacting, legislation or regulations that could significantly restrict the ability of companies and individuals to engage in these activities, such as by regulating the level of consumer notice and consent required before a company can employ cookies or other electronic tracking tools or the use of data gathered with such tools. Additionally, some providers of consumer devices and web browsers have implemented, or announced plans to implement, means to make it easier for Internet users to prevent the placement of cookies or to block other tracking technologies, which could result in the use of third-party cookies and other methods of online tracking becoming significantly less effective. The regulation of the use of these cookies and other current online tracking and advertising practices or a loss in our ability to make effective use of services that employ such technologies could increase our costs of operations and limit our ability to acquire new customers on cost-effective terms and consequently, materially and adversely affect our business, financial condition, and results of operations.

In addition, various federal and state legislative and regulatory bodies, or self-regulatory organizations, may expand current laws or regulations, enact new laws or regulations or issue revised rules or guidance regarding privacy, data protection, cybersecurity, consumer protection, and advertising. For example, in June 2018, the State of California enacted the California Consumer Privacy Act of 2018 (the “CCPA”), which became effective on January 1, 2020. The CCPA requires companies that process information of California residents to make new disclosures to consumers about their data collection, use and sharing practices, and allows consumers to opt out of selling their data to third parties and provides a new cause of action for data breaches. Further, on November 3, 2020, the California Privacy Rights Act (the “CPRA”) was voted into law by California residents. The CPRA significantly amends the CCPA, and imposes additional data protection obligations on companies doing business in California, including additional consumer rights processes and opt outs for certain uses of sensitive data. It also creates a new California data protection agency specifically tasked to enforce the law, which could result in increased regulatory scrutiny of businesses conducting activities in California in the areas of data protection and security. The substantive requirements for businesses subject to the CPRA went into effect on January 1, 2023, and will be enforced effective from July 1, 2023. Other states in which we operate have also enacted laws similar to CPRA and similar laws have been proposed in other states and at the federal level, and if passed, such laws may have potentially conflicting requirements that would make compliance challenging. Additionally, the Federal Trade Commission (the “FTC”) and many state attorneys general are interpreting federal and state consumer protection laws to impose standards for the online collection, use, dissemination and security of data. Consumer protection laws require us to publish statements that describe how we handle personal data and choices individuals may have about the way we handle their personal data. If such information that we publish is considered untrue, we may be subject to government claims of unfair or deceptive trade practices, which could lead to significant liabilities and consequences. Further, according to the FTC, violating consumers’ privacy rights or failing to take appropriate steps to keep consumers’ personal data secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. Each of these privacy, security, and data protection laws and regulations, and any other such changes or new laws or regulations, could impose significant limitations, require changes to our business, impose fines and other penalties or restrict our use or storage of personal information, which may increase our compliance expenses and make our business more costly or less efficient to conduct. Any such changes could compromise our ability to develop an adequate marketing strategy and pursue our growth strategy effectively, which, in turn, could adversely affect our business, financial condition, and results of operations.

The pet telehealth market is, in general, immature and uncertain. It is uncertain whether the telemedicine market and our approach to pet telehealth with Vetster will achieve and sustain high levels of demand, consumer acceptance and market adoption. The COVID-19 pandemic increased acceptance and utilization of telemedicine services, but it is uncertain whether such increase in demand will continue.

Demand for pet telemedicine and telehealth services is affected by a number of factors, many of which are beyond our control. Some of these potential factors include:

Our success will depend to a substantial extent on the willingness of our customers to use, and to increase the frequency and extent of their utilization of, our solution being offered in conjunction with Vetster, as well as on our ability to demonstrate the value of pet telehealth and telemedicine to veterinarians and pet owners. Negative publicity concerning the pet telehealth and telemedicine market could limit market acceptance of our solutions and services.

For the periods ending March 31, 2023 and 2024, our management identified material weaknesses in our internal control over financial reporting. A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of our annual or interim consolidated financial statements will not be prevented or detected on a timely basis. The material weaknesses identified in our internal control over financial reporting as of March 31, 2024, as well as our remediation plans, are described in Part II, Item 9A, “Controls and Procedures.” While we believe these efforts will be sufficient to remediate the material weaknesses, we cannot provide assurance that we will be able to complete our evaluation, testing or any required remediation in a timely fashion, or at all. The effectiveness of our internal control over financial reporting is subject to various inherent limitations, including cost limitations, judgments used in decision making, assumptions about the likelihood of future events, the possibility of human error and the risk of fraud. Because of the inherent limitations in a cost-effective control system, misstatements in our financial statements due to error or fraud may occur and require restatement, such as those errors that resulted in the restatement of our previously issued audited consolidated financial statements described in Amendment No.1 on Form 10-K/A to our Annual Report on Form 10-K for the year ended March 31, 2023 (the “2023 Form 10-K/A”), and the restatement of our previously issued unaudited condensed consolidated financial statements described in Amendment No.1 on Form 10-Q/A to our Quarterly Report on Form 10-Q for the quarter ended June 30, 2023 (the “2024 Q1 Form 10-Q/A”) and Amendment No.1 on Form 10-Q/A to our Quarterly Report on Form 10-Q for the quarter ended September 30, 2023 (the “2024 Q2 Form 10-Q/A”, and together with the 2024 Q1 Form 10-Q/A and 2023 Form 10-K/A, the “Amended Reports”) as well as fiscal 2023 amounts restated in our Quarterly Report on Form 10-Q for the three and nine months ended December 31, 2023.

The material weaknesses in our internal control over financial reporting will not be considered remediated until the controls operate for a sufficient period and management has concluded through testing that these controls operate effectively. If we are unable to remediate the material weaknesses or identify additional material weakness in the future, we may be unable to accurately report our financial results, which could cause our financial results to be materially misstated and require restatement. In such case, we may be unable to maintain compliance with securities law

We have identified material weaknesses in our internal control over financial reporting, including in connection with the restatements described in the Amended Reports. As a result of such material weaknesses and the restatement, we could face regulatory action by the SEC or other regulatory authorities, potential litigation, or other disputes, including claims invoking federal and state securities laws, contractual claims or other claims arising from the restatement and the material weaknesses in our internal control over financial reporting and the preparation of our financial statements. Any such litigation or dispute, whether successful or not, could adversely affect our business, financial condition, and results of operations.

Form S-3 permits eligible issuers to conduct registered offerings using a short form registration statement that allows the issuer to incorporate by reference its past and future filings and reports made under the Exchange Act. In addition, Form S-3 enables eligible issuers to conduct primary offerings “off the shelf” under Rule 415 of the Securities Act. The shelf registration process, combined with the ability to forward incorporate information, allows issuers to avoid delays and interruptions in the offering process and to access the capital markets in a more expeditious and efficient manner than raising capital in a standard registered offering pursuant to a Registration Statement on Form S-1. The ability to register securities for resale may also be limited as a result of the loss of Form S-3 eligibility.

As a result of our failure to timely file our Quarterly Report on Form 10-Q for the quarter ended December 31, 2023, we are currently ineligible to file new short form registration statements on Form S-3 until March 2025. Our inability to use Form S-3 may impair our ability to raise necessary capital to fund our operations and execute our strategy. If we seek to access the capital markets through a registered offering during the period of time that we are unable to use Form S-3, we may be required to publicly disclose the proposed offering and the material terms thereof before the offering commences, we may experience delays in the offering process due to SEC review of a Form S-1 registration statement and we may incur increased offering and transaction costs and other considerations. Disclosing a public offering prior to the formal commencement of an offering may result in downward pressure on our share price. If we are unable to raise capital through a registered offering, we would be required to conduct our equity financing transactions on a private placement basis, which may be subject to pricing, size and other limitations imposed under the Nasdaq rules, or seek other sources of capital. The foregoing limitations on our financing approaches could have a material adverse effect on our results of operations, liquidity, and financial position.

New legislation or regulations, the application of laws and regulations from jurisdictions, or the application of existing laws and regulations to the Internet and commercial online services could similarly result in significant additional taxes on our business. For instance, the Supreme Court’s decision and the enactment and enforcement of laws resulting therefrom could also impact where we are required to file state income taxes. As a result, our effective income tax rate as well as the cost and growth of our business could be materially and adversely affected, which could in turn have a material adverse effect on our financial condition and results of operations. In addition, because the Company’s products and services are available over the Internet, states may claim that the Company is required to do business as a foreign corporation in one or more of those jurisdictions. Failure to qualify as a foreign corporation in a jurisdiction where the Company is required to do so could subject it to taxes and penalties, and such jurisdictions may charge the Company with violations of local laws.

The outbreak and global spread of the COVID-19 pandemic, including the spread of recent variants, and related containment efforts created, and may continue to contribute to, significant economic disruption in the United States and around the world. A resurgence of the COVID-19 pandemic, variations of the COVID-19 virus, or other pandemics could adversely affect our business operations. It is impossible to predict the effect and ultimate impact of the possible resurgence of the COVID-19 pandemic, a variation of the COVID-19 virus, or other pandemic. In response to the COVID-19 pandemic, we implemented working from home where possible and enhanced disinfection and social distancing within our workplace. Future COVID-19 surges or variants, as well as other pandemics, may result in us again encouraging employees to work from home, which could adversely impact costs, operations, and morale, as well as result in consumer privacy, IT security, and fraud concerns.