NASDAQ: AIFF

Figure 1: The Firefly Flywheel — each clinical assessment simultaneously generates revenue and expands our proprietary database, compounding the intelligence of every future report.

The Problem We Are Solving

Clinicians treating neurological and psychiatric conditions have access to a range of assessment tools, including standardized cognitive and behavioral rating instruments such as the Montreal Cognitive Assessment (MoCA), the Mini-Mental State Examination (MMSE), the Generalized Anxiety Disorder scale (GAD-7), and the Patient Health Questionnaire (PHQ-9). These tools provide valuable, reproducible data points and play an important role in clinical evaluation. However, they assess behavior, self-reported symptoms, and observable cognitive performance; they do not directly measure the underlying functional activity of the brain. As a result, clinicians may have a clear picture of how a patient is presenting clinically, but limited visibility into what is occurring at the neural level: which regions of the brain are deviating from expected activity for a patient of that age, and in which direction. The Evoke System is designed to provide exactly this additional layer of insight; to add a direct electrophysiological signal that complements other testing modalities and gives clinicians a more complete biological picture to inform treatment planning.

We believe four structural problems define the current state of brain health diagnostics, and that Firefly is uniquely positioned to address each of them:

1. Adding electrophysiological insight to existing assessments. While standardized rating scales such as the MoCA, MMSE, GAD-7, and PHQ-9 provide reproducible and clinically valuable data, they measure cognitive performance and self-reported symptoms rather than the direct electrical activity of the brain. Electrophysiological assessment captures what these tools cannot: which neural circuits are active, how quickly they respond, and how a given patient's brain activity compares to a reference group. The Evoke System adds this direct biological signal to the clinical picture, helping clinicians understand not just how a patient is presenting, but what is measurably occurring in their brain.

2. Population-level context at the point of care. A clinician evaluating a patient's brain activity in isolation may not have a population-level frame of reference for what they are seeing. Our analytics platform addresses this by comparing each patient's electrophysiological data against a reference group; giving clinicians a standardized benchmark that reflects what healthy brain activity typically looks like for a patient of that age and gender. As our database continues to grow, we expect to expand the granularity of these reference populations over time, with the goal of enabling comparisons across increasingly specific clinical subgroups. The foundation for that future capability is being built with every assessment performed on our network today.

3. Late detection of cognitive and neurological disease. Many of the most debilitating neurological conditions; including Mild Cognitive Impairment (MCI), early-stage Alzheimer's disease, and prodromal psychiatric disorders; progress substantially before they are clinically detectable through behavioral observation alone. Electrophysiological biomarkers captured by EEG and ERP can surface neurological change earlier, giving clinicians a window to intervene before disease progression accelerates.

4. Imprecise treatment selection. Even when a diagnosis is established, selecting the right treatment plan often remains a process of elimination. Our growing database is enabling the identification of electrophysiological subtypes within diagnostic categories; meaning that a patient's specific EEG/ERP signature may predict which therapy is most likely to produce a meaningful response, potentially reducing the time and cost of trial-and-error prescribing.

The Firefly System

The Firefly System is a closed-loop system designed to continuously improve with use. It combines three interdependent layers: standardized hardware acquisition through the Evoke System, cloud-based electrophysiological analytics, and a growing proprietary data repository. Each layer reinforces the others, and the system as a whole, we believe, becomes more beneficial with every assessment performed across our network.

The Evoke System

The Evoke System is our FDA-510(k) cleared EEG and ERP acquisition hardware and associated software, deployed in clinical settings across the United States under the commercial brand name Evoke System. The system is purpose-built for standardized electrophysiological assessment in clinical environments; not limited to research laboratories; and is designed to be operable by clinical staff without specialized neurophysiology training.

The Evoke System captures brain activity using a 19-channel EEG electrode array configured according to the International 10-20 system, the clinical standard for electrode placement. In addition to the cortical EEG signal, the system incorporates a Heart Rate Variability (HRV) sensor, enabling simultaneous measurement of autonomic nervous system function alongside neural activity. This multimodal data capture; cortical EEG across 19 channels plus HRV; provides a richer physiological signal than single-modality approaches, and we believe distinguishes our hardware from more limited EEG-only assessment tools.

Figure 2: Evoke System hardware configuration — 19 EEG electrode channels (10-20 system) plus integrated HRV sensor for multimodal brain and autonomic nervous system measurement.

The Evoke System captures two principal categories of electrophysiological data. Resting-state EEG records spontaneous neural oscillatory activity in the absence of deliberate stimulation, providing a baseline measure of brain network function. Event-Related Potentials (ERPs) are captured during cognitive task paradigms, measuring the brain's time-locked electrical responses to specific stimuli across standardized cognitive task types. Together, resting EEG and ERPs enable assessment of up to 20 distinct cognitive functional measures per session; including early sensory processing, attention, working memory, response inhibition, and executive function.

The standardized nature of the Evoke System's acquisition protocol is a critical design requirement, not merely a technical characteristic. Our analytics engine compares each patient's data against a reference database. As our database continues to grow, every assessment will add further clinical value. The Evoke System's standardized protocol enables this comparability, ensuring that each record entering our database can meaningfully inform the interpretation of future assessments.

Analytics Engine — Assessment and Reporting

Electrophysiological data captured by the Evoke System is transmitted to our cloud-based analytics platform for processing. Our proprietary analytics engine analyzes raw EEG and ERP signals across captured dimensions and compares each patient’s electrophysiological profile to a reference dataset. As our dataset expands, we intend to further stratify and refine reference comparisons, which may include demographic segmentation, condition-specific cohorts, and longitudinal outcome data, subject to data availability and applicable regulatory considerations.

The output of this analysis is a structured clinical report delivered to the clinician. This report contextualizes the patient's electrophysiological data relative to a reference database, surfacing deviations in signal characteristics that may be relevant to the clinician’s assessment. Reports are delivered through our cloud-based portal and are designed to integrate into clinical workflows.

As more assessments are added, the database becomes richer and more diverse; broadening the body of data against which future assessments may be contextualized and supporting our longer-term goal of developing more granular reference populations for specific clinical subgroups.

The Firefly Database

Our proprietary database, which includes more than 191,000 standardized EEG and ERP assessment records, represents a significant long-term strategic asset of our business. We continue to analyze and expand this dataset to enhance our understanding of electrophysiological patterns associated with cognitive function. Over time, we believe that further analysis of this data may support the development of more refined reference populations, including condition-specific cohorts, and may contribute to the identification of potential electrophysiological biomarkers.

Figure 3: Proprietary database growth — records added quarterly through commercial clinical deployment, research collaborations, and clinical trials

The database spans over 12 distinct neurological and psychiatric disorders and includes records from more than 100,000 patients. We believe there may be value in collecting longitudinal data that enables analysis of how electrophysiological signatures change with disease progression and in response to treatment. The database also includes records from healthy individuals across the age range of 12 to 85.

Figure 4: The 12+ neuropsychiatric disorder categories represented in Firefly's proprietary EEG/ERP database.

Each assessment performed at any site using the Evoke System enters our data pipeline and, subject to appropriate rules and regulations, may be incorporated into our reference database. Commercial deployment and database growth are not separate activities, they are complementary, simultaneously generating subscription revenue and expanding the data asset that makes our platform more valuable over time.

Our Commercial Model

We sell access to the Firefly Platform through a tiered subscription model. Clinics pay a monthly subscription fee that provides access to the Evoke System, a defined volume of assessments per month, and access to our analytics and reporting platform. Assessments performed in excess of the monthly allotment are billed at a per-scan overage rate, ensuring that our revenue scales proportionally with clinical utilization.

Multiple subscription tiers are available to accommodate the diverse utilization profiles of our clinical customers; from individual practitioners performing a modest number of monthly assessments to larger multi-provider clinics or health systems with significantly higher throughput. This structure allows us to serve a broad range of clinical settings while ensuring pricing is calibrated to the value delivered. As a clinic's utilization grows, the subscription structure encourages migration to higher tiers, providing natural revenue expansion within our existing customer base.

Clinical Applications

Supporting Clinical Decision-Making

The Evoke System's primary clinical application is providing an objective electrophysiological layer to complement the assessment tools clinicians already use. Standardized instruments such as the MoCA, MMSE, PHQ-9, and GAD-7 are well-established components of neuropsychiatric evaluation, capturing how a patient performs on cognitive tasks and how they report experiencing mood, anxiety, and daily functioning. The Evoke System adds a direct measurement of the brain's electrical activity; capturing the speed, amplitude, and pattern of neural responses during rest and cognitive tasks, contextualized against a reference group. By returning structured reports that map a patient's electrophysiological profile against our reference group, we give clinicians an additional dimension of biological evidence to inform diagnostic and treatment planning decisions.

The database includes over 12 disorder categories, including depression, anxiety, ADHD, PTSD, MCI, dementia, Parkinson's disease, bipolar disorder, schizophrenia, schizoaffective disorder, ASD, and traumatic brain injury.

Early Detection of Cognitive Decline

We believe a clinically significant application of our platform is the early identification of cognitive impairment. Our database includes electrophysiological records spanning the spectrum from clinically normal cognition through Mild Cognitive Impairment (MCI) to confirmed dementia and early Alzheimer's disease. Research utilizing our platform and database; including a peer-reviewed study examining the differential electrophysiological signatures of MCI versus depression; which has demonstrated that EEG and ERP biomarkers can differentiate between stages of cognitive impairment with meaningful clinical utility.

The ability to distinguish between conditions with overlapping clinical presentations; such as cognitive decline due to early neurodegeneration versus cognitive symptoms secondary to depression; we believe is a valuable application of our technology. Clinicians already use standardized cognitive assessments such as the MoCA and MMSE to evaluate cognitive performance, and mood instruments such as the PHQ-9 and GAD-7 to assess depressive and anxiety symptoms. These tools are clinically important, but they assess how a patient performs and feels; not what is measurably occurring in the patient's brain. Our platform adds a direct electrophysiological dimension to this clinical picture: identifying the specific frequency bands, neural regions, and response latencies that deviate from norms, and contextualizing those deviations against the electrophysiological signatures of previously assessed patients across both diagnostic categories. This combination of behavioral assessment and direct neural measurement is designed to give clinicians a richer, more complete basis for clinical judgment.

Early detection of MCI and related conditions is particularly impactful because the range of available interventions; lifestyle, pharmacological, and enrollment in clinical trials studying disease-modifying therapies; we believe is broadest in the earliest stages of disease. We believe the Evoke System may enable clinicians to identify electrophysiological changes consistent with early cognitive decline through a non-invasive, cost-effective assessment that can be administered in a standard clinical setting, without the expense or logistical complexity of PET imaging or other advanced neuroimaging modalities.

Treatment Selection and Longitudinal Monitoring

As our database scales, we may focus on treatment selection support. Research utilizing our electrophysiological data has begun to identify signatures associated with differential responses to specific therapeutic interventions. For example, EEG-based endophenotyping in ADHD has demonstrated that patients with excess theta activity in specific frequency bands tend to respond differently to stimulant medications than patients with excess beta activity; an electrophysiological signal that may guide initial treatment selection before a trial-and-error prescribing process begins.

This capability may continue to evolve as our database expands. We are actively investing in research to develop and validate electrophysiological biomarkers of treatment response across additional conditions in our clinical footprint, and we believe as our database scales, it may provide a statistical foundation for this research that is not replicable from smaller, less standardized datasets.

The Evoke System also supports longitudinal monitoring. Repeated assessments of the same patient over time that allow clinicians to track how electrophysiological profiles change in response to treatment. This capability transforms the electrophysiological assessment from a one-time diagnostic event into an ongoing clinical monitoring tool, increasing the frequency with which clinicians engage with our platform and correspondingly increasing both revenue and database contribution per patient.

Research & Development

Scientific validation is central to our commercial strategy. We believe that clinician adoption of electrophysiological assessment as a standard component of neuropsychiatric care depends not only on the clinical utility of our platform, but on the depth and quality of the scientific evidence supporting it. Accordingly, we invest in research collaborations, clinical studies, and academic partnerships designed to generate peer-reviewed evidence for the applications of our technology.

Combined across Firefly Neuroscience and the former Evoke Neuroscience, our technology and dataset have been the subject of more than 20 peer-reviewed publications in indexed scientific journals. These publications span a range of conditions and applications, including early-stage Parkinson's disease detection, ADHD endophenotyping and treatment response prediction, major depressive disorder and cognitive biomarkers, traumatic brain injury assessment, drug pharmacodynamics in neuropharmacology trials, and genetic conditions affecting cognitive development.

Select highlights from our published research include:

•

Early Parkinson's Detection: A machine learning approach utilizing ERP-derived features from our database identified a neuromarker discriminating early-stage Parkinson's disease patients from healthy controls with an AUC of 0.79, sensitivity of 0.74, and specificity of 0.73; demonstrating the capacity of our electrophysiological dataset to support early detection of neurodegenerative disease (PLOS ONE, 2022).

•

MDD Treatment Monitoring: A pilot study published in the Journal of Affective Disorders Reports (2024) demonstrated that EEG-based assessments using our platform could objectively measure cognitive changes in outpatients with major depressive disorder during treatment with vortioxetine; with baseline brain activation latencies normalizing toward healthy control levels following treatment, independent of antidepressant effect.

•

Neuropharmacology Biomarkers: Collaborative research with Novartis evaluated the pharmacodynamic effects of MIJ821 (onfasprodil) using our EEG analytics as an objective CNS biomarker in a Phase I first-in-human study, published in Clinical and Translational Science (2023).

•

ADHD Endophenotyping: Published research demonstrated that electrophysiological activity flow patterns analyzed through our platform can differentiate ADHD subtypes with implications for treatment selection, including differential prediction of stimulant medication response (Psychological Medicine, 2017).

•

Concussion and TBI: Multiple publications, including work conducted in collaboration with university athletic programs and the Concussion Assessment, Research and Education (CARE) consortium, have demonstrated the utility of ERP-based assessments for objective evaluation of sport-related concussion and tracking of post-concussion recovery. Reches, A., Kutcher, J., Elbin, R.J., Or-Ly, H., Sadeh, B., Greer, J., McAllister, D.J., Geva, A.B., & Kontos, A.P. (2017)

•

Differential Diagnosis — MCI vs. Dementia: Published research utilizing the Evoke platform has examined the differential electrophysiological signatures of MCI, early-stage Alzheimer's disease, and dementia — demonstrating the potential of EEG/ERP biomarkers to support differential diagnosis in conditions that are clinically challenging to distinguish. Ganapathi et al. (2023). Journal of Alzheimer's Disease, 91(1), 293–305.

We also conduct academic research collaborations, including a collaboration with the Institute of Human Genetics at Heidelberg University Hospital on EEG biomarker research in genetic neurodevelopmental conditions, and with the Pacific Neuroscience Institute Brain Center on a clinical study examining the electrophysiological signatures of Alzheimer's disease. We view these collaborations as complementary to our commercial network, generating peer-reviewed scientific evidence that supports clinician adoption of our platform while simultaneously contributing high-quality, protocol-driven records to our database.

Pharmaceutical and Research Partnerships

In addition to our clinical subscription business, we engage with pharmaceutical companies and academic research institutions that seek access to our electrophysiological database and/or analytical capabilities in support of neuroscience drug development. These engagements typically involve the use of our EEG and ERP analytics as biomarker endpoints in clinical trials, providing pharmaceutical sponsors with an objective electrophysiological measure of drug effect on the central nervous system.

The use of EEG and ERP as pharmacodynamic biomarkers in CNS drug development is a well-established scientific approach, and the availability of a large, standardized normative and disorder-specific reference dataset we believe significantly enhances the interpretability of electrophysiological biomarker data in drug trials. We believe our database scale and the quality of our analytics engine position us as a preferred partner for pharmaceutical sponsors seeking to incorporate electrophysiological biomarkers into neuropsychiatric drug development programs.

Regulatory Matters

The Evoke System has received FDA clearance under the 510(k) pathway as a Class II medical device for the acquisition, display, and storage of EEG and ERP data, and for associated analytical and reporting functions. This clearance permits commercial marketing and sale of the Evoke System for its cleared indications in the United States and is a prerequisite for our clinical subscription deployment model.

Our analytics platform generates reports for clinician review and is designed to operate as a decision-support tool. We intend to engage proactively with the FDA as our analytical capabilities evolve to ensure our regulatory posture remains appropriate to the clinical applications of our platform.

Competition

The market for brain health diagnostics and clinical decision-support tools includes traditional EEG hardware manufacturers, digital health companies offering neurology-focused software, and academic medical centers with research-grade electrophysiological assessment capabilities. We believe, however, that the most significant long-term competitive determinant in this market will be the depth and quality of the proprietary electrophysiological dataset underlying AI-driven analytics; and on this dimension we believe we hold a substantial and growing advantage.

Structural neuroimaging modalities; including computed tomography (CT), magnetic resonance imaging (MRI), and functional MRI (fMRI); are well-established and clinically important tools for evaluating brain structure and, in the case of fMRI, patterns of metabolic activity. CT imaging involves exposure to ionizing radiation and provides excellent resolution of structural abnormalities, but limited visibility into functional neural dynamics. MRI offers superior soft-tissue contrast and structural detail without radiation, and fMRI can approximate regional brain activity through blood-oxygen-level-dependent (BOLD) signals. These are valuable tools, and we view them as complementary to, rather than competitive with, electrophysiological assessment. EEG and ERP capture the brain's direct electrical activity at millisecond-level temporal resolution; a dimension of brain function that structural and hemodynamic imaging modalities are not designed to measure. MRI reveals the brain’s structure, while EEG measures its real-time electrical activity and the speed at which it processes information. We believe different test modalities answer different clinical questions and are most powerful when considered together.

From a practical standpoint, the Evoke System also occupies a distinct access tier relative to neuroimaging equipment. MRI and CT scanners require significant capital investment, specialized facility infrastructure, and dedicated radiology or imaging staff, making them primarily available in hospital and large outpatient settings. The Evoke System is designed to operate in standard clinical environments; psychiatric practices, neurology offices, and behavioral health clinics; at a cost per assessment that is generally lower than most structural imaging studies. This accessibility profile means the Evoke System may be able to reach patient populations and clinical settings where advanced neuroimaging is not routinely available, rather than competing directly for the same clinical indication.

We believe our data advantage, combined with our FDA-cleared hardware platform deployed across more than 85 clinical sites, our intellectual property portfolio, and our growing body of more than 20 peer-reviewed publications, leads us to believe we occupy an increasingly valuable position in the brain health diagnostics market.

Human Capital

Our team spans neuroscience, biomedical engineering, signal processing, artificial intelligence, clinical operations, and healthcare commercialization. We believe our ability to attract and retain talent with deep expertise across these complementary disciplines is essential to the continued development and commercialization of the Firefly Platform.

Intellectual Property

Firefly’s commercial success depends in part on its ability to obtain and maintain intellectual property protection for Firefly’s products and any future products, to prevent others from infringing, misappropriating, or otherwise violating its intellectual property rights, to defend and enforce its intellectual property rights, and to operate without infringing, misappropriating, or otherwise violating valid and enforceable intellectual property rights of others. Firefly actively seeks to protect intellectual property that it believes is important to its business, which includes patents covering the components of its software and the methods used for optimizing the assessments its products perform. Firefly also seeks patent protection for other processes and inventions that are commercially or strategically important to developing and maximizing the value of its enterprise. Firefly takes steps to build and maintain the integrity of its brand, for example, with trademarks and service marks, and Firefly seeks to protect the confidentiality of trade secrets that may be important to the development of its business. Firefly relies on a strategy that combines the use of patents, trademarks, trade secrets, know-how, and license agreements, as well as other intellectual property laws, employment, confidentiality and invention assignment agreements, and contractual protections, to establish and protect its intellectual property rights.

Patents

As of December 31, 2025, we owned 23 issued U.S. patents, which have expiration dates ranging from November 2028 to November 2037.

The anticipated expiration dates are without taking into account all possible patent term adjustments, extensions, or abandonments, and assuming payment of all appropriate maintenance, renewal, annuity, and other governmental fees. We continue to evaluate our intellectual property portfolio as patents reach end of life to determine the optimal course for continuing to protect our technology. We cannot ensure that patents will issue from any of our pending applications or that, if patents are issued, they will be of sufficient scope or strength to provide meaningful protection for our technology.

We recognize that the ability to obtain patent protection and the degree of such protection depends on a number of factors. The patent positions of medical device companies like ours are generally uncertain and involve complex legal, scientific, and factual questions. The protection afforded by a patent varies on a product-by-product basis, from jurisdiction-to-jurisdiction, and depends upon many factors, including the type of patent, the scope of its coverage, the availability of patent term adjustments and extensions, the availability of legal remedies, and the validity and enforceability of the patent.

In addition, the coverage claimed in a patent application can be significantly narrowed before the patent is issued, and patent claims can be reinterpreted or further altered even after patent issuance. We cannot predict whether the patent applications we are currently pursuing will issue as patents or whether the claims of any issued patents will provide sufficient protection from competitors. A competitor could develop systems, devices, or methods of manufacture or treatment that are not covered by our patents. Accordingly, our ability to stop third parties from commercializing any of our patented inventions, either directly or indirectly, will depend in part on our success in obtaining, maintaining, defending, and enforcing patent claims that adequately cover our inventions.

Our commercial success will also depend, in part, on not infringing, misappropriating, or otherwise violating the intellectual property rights of third parties. Third parties own numerous patents in the U.S. and in jurisdictions outside the U.S. with claims directed to inventions in the fields in which we operate or plan to operate. It is uncertain whether the issuance of any third-party patent would require us to alter our development or commercial strategies, seek licenses, cease certain activities, or participate in US Patent and Trademark Office ("USPTO") proceedings. Moreover, such licenses may not be available on commercially reasonable terms or at all. Our breach of any license agreements or failure to obtain a license necessary to our business may have a material adverse impact on us.

Trademarks

Our trademark portfolio is designed to protect the brands of our current and any future products. As of December 31, 2025, we own one trademark registration for “BNA” in the United States and other countries, including Israel, Switzerland, European Union, Canada, and India. The trademark is also registered with World Intellectual Property Organization.

Trade Secrets

We also rely on trade secrets relating to our product and technology, including our data processing algorithms, and we maintain the confidentiality of such proprietary information to protect aspects of our business that are not amenable to, or that we do not consider appropriate for, patent protection. We seek to protect our trade secrets and know-how by entering into confidentiality and invention assignment agreements with employees, contractors, consultants, suppliers, customers, and other third parties, who have access to such information. These agreements generally provide that all confidential information concerning our business or financial affairs developed or made known to the individual during the course of the individual’s relationship with us are to be kept confidential and not disclosed to third parties except in specific circumstances.

For more information regarding the risks related to our intellectual property, please see “Risk Factors-Risks Related to Our Intellectual Property.”

Manufacturing

Our Evoke system is manufactured by a third party contract manufacturer based in the United States.

Employees

As of the date of this report, we have 17 full-time employees.

None of Firefly’s employees are represented by a labor union or covered by collective bargaining agreements, and Firefly considers its relationship with its employees to be good.

Government Regulation

Our products are considered medical devices, and, accordingly, are subject to rigorous regulation by government agencies in the United States and other countries in which we intend to sell our products. These regulations vary from country to country but cover, among other things, the following activities with respect to medical devices:

design, development and manufacturing;

testing, labeling, content and language of instructions for use and storage;

product storage and safety;

marketing, sales and distribution;

pre-market clearance and approval;

record keeping procedures;

advertising and promotion;

recalls and field safety corrective actions;

post-market surveillance;

post-market approval studies; and

product import and export.

FDA Regulation

In the U.S., numerous laws and regulations govern the processes by which medical devices are developed, manufactured, brought to market and marketed. These include the Federal Food, Drug, and Cosmetic Act (“FD&C Act”) and its implementing regulations issued by FDA, among others. Unless an exemption applies, each medical device commercially distributed in the United States requires FDA clearance of a 510(k) premarket notification (“510(k) clearance”), granting of a de novo request, or approval of an application for premarket approval (“PMA”). In general, under the FD&C Act, medical devices are classified in one of three classes on the basis of the controls necessary to reasonably assure their safety and effectiveness. A medical device’s classification determines the level of FDA review and approval to which the device is subject before it can be marketed to consumers:

Class I devices, the lowest-risk FDA device classification, include devices with the lowest risk to the patient and are those for which safety and effectiveness can be assured by adherence to FDA’s medical device general controls, including labeling, establishment registration, device product listing, adverse event reporting, and, for some products, adherence to good manufacturing practices through FDA’s Quality System Regulations.

Class II devices, moderate-risk devices, also require compliance with general controls and in some cases, special controls as deemed necessary by FDA to ensure the safety and effectiveness of the device. These special controls may include performance standards, particular labeling requirements, or post-market surveillance obligations. While most Class I devices are exempt from the 510(k) premarket notification requirement, typically a Class II device also requires pre-market review and 510(k) clearance as well as adherence to the Quality System Regulations/good manufacturing practices for devices.

Class III devices, high-risk devices that are often implantable or life-sustaining, also require compliance with the medical device general controls and Quality System Regulations, and generally must be approved by FDA before entering the market through a PMA application. Approved PMAs can include post-approval conditions and post-market surveillance requirements, analogous to some of the special controls that may be imposed on Class II devices.

Our BNA Platform and Evoke System are Class II medical devices, which were cleared by FDA for commercialization in the U.S. pursuant to the 510(k) notification process. The marketing and distribution of Firefly’s products are subject to continuing regulation and enforcement by FDA and other government authorities, which includes product listing requirements, medical device reporting regulations. If FDA finds that we have failed to comply with any legal or regulatory requirements, it or other government agencies may institute a wide variety of enforcement actions against us, ranging from Warning Letters to more severe sanctions, including but not limited to financial penalties, withdrawal of 510(k) clearances already granted, and criminal prosecution.

The 510(k) Process

Under the 510(k) process, the applicant must submit to FDA a premarket notification demonstrating that the device is “substantially equivalent” to either a device that was legally marketed prior to May 28, 1976, the date upon which the Medical Device Amendments of 1976 were enacted, and for which a PMA is not required, a device that has been reclassified from Class III to Class II or Class I, or another commercially available device that was cleared through the 510(k) process. To be “substantially equivalent,” the proposed device must have the same intended use as the predicate device, and either have the same technological characteristics as the predicate device or have different technological characteristics and not raise different questions of safety or effectiveness than the predicate device. Clinical data is sometimes required to support substantial equivalence.

After a 510(k) premarket notification is submitted, FDA determines whether to accept it for substantive review. If it lacks necessary information for substantive review, FDA will refuse to accept the 510(k) notification. If it is accepted for filing, FDA begins a substantive review. By statute, FDA is required to complete its review of a 510(k) notification within 90 days of receiving the 510(k) notification. As a practical matter, clearance often takes longer, and clearance is never assured. FDA may require further information, including clinical data, to make a determination regarding substantial equivalence, which may significantly prolong the review process. If FDA agrees that the device is substantially equivalent to a predicate device currently on the market, it will grant 510(k) clearance to commercially market the device.

Post-Market Regulation

After a device is cleared or approved for marketing, numerous and extensive regulatory requirements may continue to apply. These include but are not limited to:

annual and updated establishment registration and device listing with FDA;

restrictions on sale, distribution, or use of a device;

labeling, advertising, promotion, and marketing regulations, which require that promotion is truthful, not misleading, and provide adequate risk disclosures and directions for use and that all claims are substantiated, and also prohibit the promotion of products for unapproved or “off-label” uses (i.e., indications that are inconsistent with or beyond the scope of the applicable FDA approval or clearance) and impose other restrictions on labeling;

clearance or approval of product modifications to legally marketed devices that could significantly affect safety or effectiveness or that would constitute a major change in intended use;

correction, removal, and recall reporting regulations, and FDA’s recall authority;

complying with the federal law and regulations requiring Unique Device Identifiers on devices; and

post-market surveillance activities and regulations, which apply when deemed by FDA to be necessary to protect the public health or to provide additional safety and effectiveness data for the device.

FDA has broad regulatory compliance and enforcement powers. If FDA determines that we failed to comply with applicable regulatory requirements, it can take a variety of compliance or enforcement actions, which may result in any of the following sanctions:

warning letters, untitled letters, fines, injunctions, consent decrees, and civil penalties;

recalls, withdrawals, or administrative detention, or seizure of our products;

operating restrictions or partial suspension or total shutdown of production;

refusing or delaying requests for 510(k) marketing clearance or PMA approvals of new products or modified products;

withdrawing 510(k) clearances or PMA approvals that have already been granted;

refusal to grant export or import approvals for our products; or

criminal prosecution.

International Regulation

Many countries throughout the world have established regulatory frameworks for marketing and commercialization of medical devices. As a designer and marketer of medical devices, we are obligated to comply with the respective frameworks of these countries to obtain and maintain access to these global markets. The frameworks often define requirements for marketing authorizations which vary by country. Failure to obtain appropriate marketing authorization and to meet all local requirements, including specific quality and safety standards in any country in which we currently market our products, could cause commercial disruption and/or subject us to sanctions and fines. Delays in receipt of, or a failure to receive, such marketing authorizations, or the loss of any previously received authorizations, could have a material adverse effect on our business, financial condition and results of operations.

There is currently no premarket government review of medical devices in the European Economic Area (“EEA”). However, all medical devices placed on the market in the EEA must meet the relevant essential requirements laid down in Annex I of Directive 93/42/EEC concerning medical devices, or the Medical Devices Directive. The most fundamental essential requirement is that a medical device must be designed and manufactured in such a way that it will not compromise the clinical condition or safety of patients, or the safety and health of users and others. In addition, the device must achieve the performances intended by the manufacturer and be designed, manufactured, and packaged in a suitable manner. The European Commission has adopted various standards applicable to medical devices. These include standards governing common requirements, such as sterilization and safety of medical electrical equipment, and product standards for certain types of medical devices. There are also harmonized standards relating to design and manufacture. While not mandatory, compliance with these standards is viewed as the easiest way to satisfy the essential requirements as a practical matter. Compliance with a standard developed to implement an essential requirement also creates a rebuttable presumption that the device satisfies that essential requirement.

On April 5, 2017, the European Parliament passed the Medical Devices Regulation (Regulation 2017/745), which repeals and replaces the EU Medical Device Directive and became effective on May 26, 2021. The Medical Devices Regulation, among other things, is intended to establish a uniform, transparent, predictable, and sustainable regulatory framework across the EEA for medical devices and ensure a high level of safety and health while supporting innovation. The new regulations, among other things:

strengthen the rules on placing devices on the market and reinforce surveillance once they are available;

improve the traceability of medical devices throughout the supply chain to the end-user or patient through a unique identification number;

set up a central database to provide patients, healthcare professionals, and the public with comprehensive information on products available in the E.U.; and

strengthen rules for the assessment of certain high-risk devices, such as implants, which may have to undergo an additional check by experts before they are placed on the market.

We received our European CE mark, indicating that we affirm our product’s conformity with European health, safety and environmental protection standards, in 2021.

Healthcare Regulatory Laws

Within the United States, our products are subject to extensive regulation by a wide range of federal and state agencies that govern business practices in the medical device industry. These laws include federal and state anti-kickback, fraud and abuse, false claims and physician payment transparency laws and regulations.

The federal Anti-Kickback Statute prohibits, among other things, knowingly and willfully offering, paying, soliciting or receiving any remuneration (including any kickback, bribe or rebate), directly or indirectly, overtly or covertly, to induce or in return for purchasing, leasing, ordering or arranging for or recommending the purchase, lease or order of any good, facility, item or service reimbursable, in whole or part by Medicare, Medicaid or other federal healthcare programs. The term “remuneration” has been broadly interpreted to include anything of value, including cash, improper discounts, and free or reduced price items and services. Among other things, the Anti-Kickback Statute has been interpreted to apply to arrangements between medical device manufacturers on the one hand and prescribers and purchasers on the other. Although there are a number of statutory exceptions and regulatory safe harbors protecting some common activities from prosecution, the exceptions and safe harbors are drawn narrowly. Practices that involve remuneration that may be alleged to be intended to induce prescribing, purchases or recommendations may be subject to scrutiny if they do not qualify for an exception or safe harbor.

Failure to meet all of the requirements of a particular applicable statutory exception or regulatory safe harbor does not make the conduct per se illegal under the Anti-Kickback Statute. Instead, the legality of the arrangement will be evaluated on a case-by-case basis based on a cumulative review of all of its facts and circumstances. Several courts have interpreted the statute’s intent requirement to mean that if any one purpose of an arrangement involving remuneration is to induce referrals of federal healthcare covered business, the Anti-Kickback Statute has been violated. In addition, a person or entity does not need to have actual knowledge of the statute or specific intent to violate, in order to have committed a violation. Further, a claim including items or services resulting from a violation of the federal Anti-Kickback Statute also constitutes a false or fraudulent claim for purposes of the federal civil False Claims Act. Many states have adopted laws similar to the Anti-Kickback Statute. Some of these state prohibitions apply to referral of patients for healthcare items or services reimbursed by any payor, not only the Medicare and Medicaid programs. Commercial payors may also bring a private cause of action for treble damages against a manufacturer for a pattern of causing false claims to be filed under the federal Racketeer Influenced and Corrupt Organizations Act, or RICO.

The federal civil False Claims Act prohibits, among other things, any person or entity from knowingly presenting, or causing to be presented, a false or fraudulent claim for payment to or approval by the federal government or knowingly making, using or causing to be made or used a false record or statement material to a false or fraudulent claim to the federal government. A claim includes “any request or demand” for money or property presented to the U.S. government. The qui tam provisions of the False Claims Act allow a private individual to bring actions on behalf of the federal government alleging that the defendant has submitted a false claim to the federal government, and to share in any monetary recovery. In recent years, the number of suits brought against healthcare providers by private individuals has increased dramatically. The government has obtained multi-million and multi-billion dollar settlements under the False Claims Act in addition to individual criminal convictions under applicable criminal statutes. In addition, the federal civil monetary penalties statute imposes penalties against any person or entity that, among other things, is determined to have presented or caused to be presented a claim to a federal health program that the person knows or should know is for an item or service that was not provided as claimed or is false or fraudulent. Given the significant size of actual and potential settlements, it is expected that the government will continue to devote substantial resources to investigating healthcare providers’ and manufacturers’ compliance with applicable fraud and abuse laws. Various states have also enacted false claim laws analogous to the federal civil False Claims Act, although many of these state laws apply where a claim is submitted to any third-party payor and not merely a federal healthcare program.

The federal Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health Act, or HIPAA, among other things, created two new federal crimes: healthcare fraud and false statements relating to healthcare matters. The HIPAA healthcare fraud statute prohibits, among other things, knowingly and willfully executing, or attempting to execute, a scheme to defraud any healthcare benefit program, including private payors. A violation of this statute is a felony and may result in fines, imprisonment and/or exclusion from government sponsored programs. The HIPAA false statements statute prohibits, among other things, knowingly and willfully falsifying, concealing or covering up a material fact or making any materially false, fictitious or fraudulent statement or representation in connection with the delivery of or payment for healthcare benefits, items or services. A violation of this statute is a felony and may result in fines and/or imprisonment. Similar to the Anti-Kickback Statute, a person or entity does not need to have actual knowledge of these statutes or specific intent to violate them in order to have committed a violation.

Additionally, there has been a recent trend of increased federal and state regulation of payments made to physicians and other healthcare providers. The ACA, imposed, among other things, new annual reporting requirements for covered manufacturers for certain payments and “transfers of value” provided to physicians and certain other healthcare providers and teaching hospitals, as well as ownership and investment interests held by physicians and their immediate family members. In addition, certain states require implementation of compliance programs and compliance with the device industry’s voluntary compliance guidelines and the relevant compliance guidance promulgated by the federal government, impose restrictions on marketing practices, and/or tracking and reporting of gifts, compensation and other remuneration or items of value provided to physicians and other healthcare professionals and entities.

Health Information Privacy and Security Laws

There are numerous U.S. federal and state laws and regulations related to the privacy and security of Personally Identifiable Information (“PII”), including health information. Among others, the federal Health Insurance Portability and Accountability Act of 1996, as amended by HITECH, and their implementing regulations, which we collectively refer to as HIPAA, establish privacy and security standards that limit the use and disclosure of Protected Health Information (“PHI”) and require covered entities and business associates to implement administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of individually identifiable health information in electronic form, among other requirements.

Violations of HIPAA may result in civil and criminal penalties. We must also comply with HIPAA’s breach notification rule which requires notification to affected individuals and HHS, and in certain cases to media outlets, in the case of a breach of unsecured PHI. The regulations also require business associates of covered entities to notify the covered entity of breaches by the business associate.

State attorneys general also have the right to prosecute HIPAA violations committed against residents of their states, and HIPAA standards have been used as the basis for the duty of care in state civil suits, such as those for negligence or recklessness in misusing personal information. In addition, HIPAA mandates that HHS conduct periodic compliance audits of HIPAA covered entities and their business associates for compliance.

Many states also have laws that protect the privacy and security of sensitive and personal information, including health information. These laws may be similar to or even more protective than HIPAA and other federal privacy laws. For example, the laws of the State of California, are more restrictive than HIPAA. Where state laws are more protective than HIPAA, we must comply with the state laws we are subject to, in addition to HIPAA. California passed the California Consumer Privacy Act or CCPA on June 28, 2018, which went into effect January 1, 2020. On November 3, 2020, the California Privacy Rights Act of 2020 (“CPRA”), which amends the CCPA and adds new privacy protections that became effective on January 1, 2023, was enacted through a ballot initiative. While information we maintain that is covered by HIPAA may be exempt from the CCPA, other records and information we maintain on our patients may be subject to the CCPA. In certain cases, it may be necessary to modify our planned operations and procedures to comply with these more stringent state laws. Not only may some of these state laws impose fines and penalties upon violators, but also some, unlike HIPAA, may afford private rights of action to individuals who believe their personal information has been misused. In addition, state and federal privacy laws subject to frequent change.

In addition to HIPAA and state health information privacy laws, we may be subject to other state and federal privacy laws, including laws that prohibit unfair privacy and security practices and deceptive statements about privacy and security, laws that place specific requirements on certain types of activities, such as data security and texting, and laws requiring holders of personal information to maintain safeguards and to take certain actions in response to a data breach.

Foreign data protection, privacy, and other laws and regulations are often more restrictive than those in the U.S. The E.U., for example, traditionally has imposed stricter obligations under its laws and regulations relating to privacy, data protection and consumer protection than the U.S. In May 2018, the GDPR, governing data practices and privacy in the E.U., became effective and replaced the data protection laws of the individual member states. GDPR requires companies to meet stringent requirements regarding the handling of personal data of individuals in the E.U. These more stringent requirements include expanded disclosures to inform members about how we may use their personal data, increased controls on profiling members, and increased rights for members to access, control and delete their personal data. In addition, there are mandatory data breach notification requirements. The law also includes significant penalties for non-compliance, which may result in monetary penalties of up to 20 million Euros or 4% of a company’s worldwide turnover, whichever is higher. GDPR and other similar regulations require companies to give specific types of notice and informed consent is required for the placement of a cookie or similar technologies on a user’s device for online tracking for behavioral advertising and other purposes and for direct electronic marketing, and the GDPR also imposes additional conditions in order to satisfy such consent, such as a prohibition on pre-checked consents. It remains unclear how the U.K. data protection laws or regulations will develop in the medium to longer term and how data transfer to the U.K. from the E.U. will be regulated. Outside of the E.U., there are many other countries with data protection laws, and new countries are adopting data protection legislation with increasing frequency.

Many of these laws may require consent from individuals for the use of data for various purposes, including marketing, which may reduce our ability to market our products.

There is no harmonized approach to these laws and regulations globally. Consequently, we increase our risk of non-compliance with applicable foreign data protection laws and regulations when we expand internationally. We may need to change and limit the way we use personal information in operating our business and may have difficulty maintaining a single operating model that is compliant. Compliance with such laws and regulations will result in additional costs and may necessitate changes to our business practices and divergent operating models, limit the effectiveness of our marketing activities, adversely affect our business, results of operations, and financial condition, and subject us to additional liabilities.

Corporate History and Structure

Firefly’s corporate history began in April 2006 with the formation of Elminda Ltd, a company organized under the laws of the State of Israel, for the purpose of developing a system to provide clinicians with an objective assessment of brain electrophysiology to support better outcomes for people with mental illnesses and cognitive disorders.

Firefly spent over ten years building a significant database of standardized longitudinal EEG brain scans using clinically defined paradigms that captured patients brain activity while resting and while activated (evoke response potential). Firefly collected this data in over 100 sites, over 20 countries, and over 40 studies. Significant time and resources went into analyzing and interpreting the data as well as preparing for an FDA 510k application process.

On May 2, 2014, management of Firefly Neuroscience Ltd. incorporated a new wholly owned subsidiary company named “Elminda Inc.” in the State of Delaware for the purpose of initiating the company’s United States marketing and distribution activity.

In July 2014, Firefly received Class II medical device 510(k) clearance from the U.S. Food and Drug Administration (the “FDA”) for the BNA Analysis System, the predicate device to the BNA Platform, with indication for use in individuals 14 to 24 years of age.

In September 2014, the company received the Conformity European approval for the BNA Platform allowing use in European Economic Area.

In December 2020, Firefly received Class II medical device 510(k) clearance from the FDA for the BNA Platform, with indication for use in individuals 12 to 85 years of age.

On April 13, 2022, the name of Elminda Inc. was changed to “Elminda 2022 Inc.”

On April 21, 2022, management of Firefly Neuroscience Ltd. incorporated a new wholly owned subsidiary company named “Elminda Inc.” for the purpose of re-domiciling the company to enhance access to capital markets.

On July 5, 2022, Elminda Ltd. became a subsidiary of Elminda Inc. via a share exchange agreement wherein Elminda Inc. issued shares to shareholders of Elminda Ltd. against shares of Elminda Ltd.

On September 15, 2022 and October 24, 2022 management changed the name from Elminda Inc. and Elminda Ltd, respectively, to “Firefly Neuroscience, Inc.” and “Firefly Neuroscience Ltd.”, respectively.

On August 12, 2024, pursuant to the Merger Agreement, FFN merged with and into Firefly Neuroscience, Inc., with Firefly Neuroscience, Inc. surviving the merger as a wholly owned subsidiary of WaveDancer, Inc. On the Merger Closing Date (i) pursuant to the Amended and Restated Certificate of Incorporation of WaveDancer, we changed our name to Firefly Neuroscience, Inc. and (ii) pursuant to an amendment to its Certificate of Incorporation, Firefly changed its name to Firefly Neuroscience 2023, Inc. and (iii) Firefly and FFN filed the Certificate of Merger with the State of Delaware.

On April 30, 2025, Firefly completed the acquisition of Evoke Neuroscience Inc. (“Evoke”), which resulted in the acquisition of the Evoke business and a significant expansion of business operations and headcount. This acquisition included the Evoke System which was Evoke's primary commercial product.

The Charter and the Bylaws contain certain provisions relating to limitations of liability and indemnification of directors and certain officers, provide advance notice procedures for stockholder proposals at stockholder meetings, and other matters. See “Description of Capital Stock– Anti-Takeover Provisions” in Exhibit 4.1 to this Annual Report on Form 10-K and Item 10. “Directors, Executive Officers and Corporate Governance – Limitation on Liability and Indemnification of Directors and Certain Officers”.

Our fiscal year ends on December 31. Neither we nor any of our predecessors have been in bankruptcy, receivership or any similar proceeding.