NASDAQ: BDSX

•
We enrolled more than 1,500 patients in the CLARIFY study, which will collect patient outcomes and other clinical information on 4,000 patients who have received Nodify Lung® Nodule Risk Assessment testing in the clinical setting and have at least 1-2 years of follow-up.

•
We improved our operational efficiencies increasing gross margin percentage to 81% as compared to 78% in 2024;

•
We maintained our cost-disciplined approach limiting growth in full year Operating Expense, excluding Direct costs and expenses to 10% over 2024, including non-cash share-based compensation expenses, while growing revenue by 24%; and

•
We were awarded the prestigious 2025 Denver Post | Energage Top Workplaces, the second consecutive year receiving an employee-survey based recognition award – a reflection of our strong team culture and employee engagement.

Our Strategy

At Biodesix, we have built a team with deep experience in diagnostics including commercialization, reimbursement, regulatory, medical affairs, research and development, technology, and operations to provide needed products and services to address critical clinical questions and help improve patient care. We believe that establishing a new standard of care utilizing personalized diagnostics requires an extensive understanding of clinical needs, scientific expertise to develop tests using the optimal technology for each clinical question, development of clinical evidence to demonstrate benefits of the testing, a scalable operational infrastructure, and an established commercial channel to drive market adoption and payer coverage.

We employ multiple technologies, including genomics, proteomics, and radiomics, combined with artificial intelligence (AI), to discover, develop, and commercialize innovative diagnostic tests for physicians, biopharmaceutical, life science, and diagnostics companies to help improve patient care.

1.
Lung Diagnostic Tests - Drive increased awareness, adoption, and reimbursement coverage of our diagnostic tests by:

•
continuously educating healthcare providers key opinion leaders, hospital systems, advocacy groups, patients, payers, academic research organizations, and technology assessment and guideline organizations on the clinical data and benefits of our tests;

•
continuing to invest in the expansion and professional development of our lung-focused clinical sales force and commercial support teams;

•
extending our commercial reach in clinics specializing in the management of lung nodules and the diagnosis of lung disease and their primary care referral networks;

•
investing in clinical studies and publish additional clinical data to continue to increase market adoption and reimbursement coverage for our tests;

3

•
publishing health economics and outcomes research demonstrating the impact of our tests on the US healthcare system and decreasing overall costs; and

•
engaging key opinion leaders and partners to identify existing or emerging clinical needs in lung disease and to develop tests to address those questions to be provided to the market through our existing commercial channel.

2.
Development Services — Expand revenue-generating contracts with research institutions, biopharmaceutical clients, and life sciences customers by:

•
leveraging our team’s expertise and multi-omic offering to sell a comprehensive line of research, discovery, development, clinical trial testing, regulatory, reimbursement, commercialization, and logistics support services across cancer types and diseases;

•
adding new biopharmaceutical, life science, tools, and diagnostic customers and leveraging existing projects and relationships to expand engagement with our current customers;

•
engaging with our customers, key opinion leaders, leading academic centers, and scientific experts to stay ahead of the rapidly evolving diagnostic and therapeutic landscape and to identify unmet clinical needs; and

•
entering strategic partnerships with biopharmaceutical companies, academic research organizations, technology providers, and other diagnostic companies.

Our Tests and Services

Biodesix Lung Diagnostic Tests

Our tests support clinical decisions to expedite personalized care and improve outcomes for patients with lung disease. We believe our diagnostic tests help healthcare providers meaningfully improve lung disease diagnosis, treatment, and monitoring as well as lower the overall healthcare cost by reducing the use of ineffective and unnecessary treatments and procedures. We currently offer two tests that assess the risk of cancer in lung nodules and three tests that provide treatment guidance after a lung cancer diagnosis.

Lung cancer is the deadliest cancer in the United States with most patients diagnosed late stage, with advanced disease. With the introduction of numerous treatment options, healthcare providers need an ever-increasing amount of information to select the best treatment plan for each individual patient. We believe that the lung cancer continuum of care has a variety of clinical unmet needs ranging from initial diagnosis of lung cancer after discovery of a lung nodule to treatment guidance for early and advanced stage disease, and monitoring for disease progression. We estimate that in the United States, the lung cancer continuum of care represents over 10 million annual testing opportunities and represents greater than $27 billion market opportunity annually.

•
Diagnosis: We estimate there are approximately 5 to 6 million lung nodules in the United States annually. Approximately 1.6 million new nodules are identified incidentally, and potentially 4 million lung nodules from the adoption of screening could be identified annually in the United States. Following initial discovery of a nodule, patients are typically evaluated by a primary care provider or a pulmonologist for the risk of lung cancer before determining if a patient should be considered for an invasive procedure to obtain a tissue sample to confirm diagnosis or computed tomography (CT) surveillance. This risk assessment includes a review of clinical factors such as the patient’s smoking history and age, and radiological features such as the size, texture, and location of the nodule, obtained from a CT scan. We estimate that approximately 80% of patients are identified as “low to moderate risk (5%-65%)” during these initial risk assessments. The current Lung Nodule guideline recommendations are unclear, often resulting in either over-treatment of patients with benign nodules or under-treatment in patients with cancerous nodules. An estimated 17% of patients initially scheduled for watchful waiting, or follow-up CT scans are later diagnosed with malignant nodules. Data has shown that a delay may lead to diagnosis at a more advanced stage and poorer outcomes for patients. Conversely, we estimate that 62% of biopsies and 35% of surgeries performed on lung nodules find benign disease, representing a significant overtreatment that incurs both risk and cost to the patient and their providers. We believe that there is a strong patient and clinical need for blood-based diagnostic testing to help improve the initial risk assessment of pulmonary nodules, helping direct patients to the relevant treatment pathway, ultimately improving patient outcomes and saving costs to the system across the lung care pathway.

•
Treatment Guidance – Early Stage: We estimate that there are over 700 thousand testing opportunities annually in the United States in early-stage lung cancer to assess a patient’s risk of recurrence following curative-intent surgery, and to detect potential target mutations for therapeutics. Depending on a patient’s risk of recurrence, they may also receive chemotherapy, radiotherapy or chemoradiation post-surgery. The assessment of risk of recurrence is primarily based on the stage of cancer at diagnosis, with stage I patients typically receiving no additional treatment beyond surgery. However, 20 to 40% of patients with stage I disease do still recur within five years following surgery, representing a sub-group of patients who may have benefited from more intensive treatment protocol. We believe there is a clear clinical need for blood-based diagnostic testing prior to surgery to identify stage I patients who may benefit from a more intensive treatment protocol and we also believe there is the need for identifying stage II and IIIA patients who may benefit from a less intensive treatment protocol. There

4

have also been recent advances in the use of targeted therapies in early-stage lung disease. These therapies typically target specific genomic mutations or alterations found in some tumors. We believe there is therefore an emerging need for testing designed specifically for mutation detection in early-stage disease.

•
Treatment Guidance – Advanced Stage: We estimate that there are over 3 million diagnostic testing opportunities annually in the United States to guide advanced stage lung cancer treatment decisions. With nearly 60 FDA-approved systemic treatment regimens listed in national treatment guidelines for non-small cell lung cancer (NSCLC), there is an elevated need for personalized biomarkers to help physicians identify the right patient for the right treatment. Multiple tissue-based diagnostic tests have been approved to identify patients eligible for targeted therapies and immunotherapy; however, about 50% of patients do not have sufficient tissue collected following diagnosis to facilitate testing. To compound the issue, different molecular tests take varying amounts of time (days versus weeks) to report results back to the ordering physician. Physicians are often left with a dilemma to either make treatment decisions prior to receiving critical diagnostic test results, or delay treatment initiation while waiting for the test results. Therefore, we believe there is an imminent need for a blood-based testing solution that measures tumor mutations and the patient’s immune profile, to provide physicians with more comprehensive and timely information to initiate personalized treatment as quickly as possible.

•
Monitoring: We estimate that there are over 800 thousand testing opportunities in the United States for blood-based tumor genomic and immune profiling to monitor for disease recurrence and progression in NSCLC patients. Unfortunately, advanced stage lung cancer is often terminal, so repeat tissue biopsy to assess the evolution of resistance mutations or to detect disease progression is not feasible from either a cost or risk perspective to the patient, which we believe demonstrates an important need for blood-based testing to help routinely monitor these patients. As a patient progresses through therapies, changes in their immune system occur and blood-based immune profiling could help physicians identify these changes prior to subsequent therapy selection.

Diagnosis – Nodule Management

Our blood-based tests for patients with a pulmonary nodule, Nodify Lung Nodule Risk Assessment, assists healthcare providers in classifying a patient’s risk of lung cancer by integrating their protein biomarker results with radiographic imaging (CT scans) and other clinical characteristics. Nodify Lung testing consists of the Nodify CDT® and Nodify XL2® proteomic tests, which can be ordered separately or together from a single blood draw to help classify risk of cancer to aid healthcare providers in stratifying patients into distinct nodule management pathways with the goal of earlier diagnosis of cancer and avoidance of unnecessary invasive procedures when nodules are benign.

Nodify CDT Test

The Nodify CDT test is a blood-based proteomic test that helps identify patients who have a suspicious lung nodule that is likely malignant or at a higher risk of being cancerous. Results allow physicians to identify patients who may be better candidates for timely invasive diagnostic procedures such as bronchoscopy, transthoracic needle biopsy, or surgical resection, with the goal of diagnosing cancer earlier. The Nodify CDT test enhances lung nodule risk assessment to facilitate compliance with clinical treatment guidelines. The Nodify CDT test is validated for use in patients who are 40 years or older, have no history of cancer except non-melanomatous skin cancer, have nodules between 4 and 30mm, and pre-test risk of lung cancer of less than 65%.

The test measures the levels of seven circulating autoantibodies (P53, NY-ESO-1, CAGE, GBU4-5, SOX2, HuD, and MAGE A4) associated with lung cancer, combined with an algorithm to report out three potential results: High Level, Moderate Level, or No Significant Levels of Antibodies Detected (NSLAD). The seven autoantibodies have been shown to be elevated for all types of lung cancer, and from the earliest stage of the disease.

Unlike the tumor antigens themselves, the autoantibody levels can be measured accurately through a blood sample, based upon the signal amplification generated by the immune response to cancer. This mechanism of action likely reflects very early events in a tumor’s evolution; as the immune system initiates a response to the cancer, it can also trigger an expansion of self-reactive antibodies that can be measured in circulation.

The Nodify CDT test has an established average turnaround time of one business day from receipt of the blood sample, providing physicians with timely results to guide diagnostic planning. The clinical data for the test has been published in a number of peer-reviewed publications and presentations, including a clinical validation study published in late 2024 that confirmed the previously published performance of the test.

Nodify XL2 Test

The Nodify XL2 test is a blood-based proteomic test that helps identify patients who have a suspicious lung nodule that is likely benign or at a reduced risk of being cancerous. Results allow physicians to identify patients who may be better candidates for routine CT surveillance to monitor for growth or shrinkage of the nodule over time instead of an invasive diagnostic procedure. The Nodify XL2 test is used for patients who are 40 years or older, have no history of lung cancer or other recent cancer diagnoses, have nodules between 8 and 30mm, and have a pre-test risk of lung cancer of less than or equal to 50%. A body of clinical data has been published in

5

peer-reviewed journals and presentations and recent data from the ORACLE clinical utility study was published demonstrating a 74% reduction in unnecessary invasive procedures with the use of the test.

The Nodify XL2 test integrates peptides with clinical and radiological characteristics that are combined by an algorithm to report out three potential results: Likely Benign, Reduced Risk, or Indeterminate. Specifically, the Nodify XL2 test measures the relative abundance of two peptides (LG3BP and C163A) in circulation in the patient’s blood. The native proteins from which the peptides are derived have been associated with an inflammatory response to lung cancer. The clinical factors are patient age and smoking status, and radiological factors are nodule size, location, and edge characteristics.

If both tests are ordered for the patient and the Nodify CDT test returns a result of High or Moderate Level indicating an increased risk of malignancy, then the Nodify XL2 test is cancelled. If the Nodify CDT test returns a result of NSLAD, then the Nodify XL2 test is performed and both test results are typically available within four to five business days.

Lung Cancer Treatment & Monitoring

Profiling the tumor through blood-based genomic testing can help identify mutations in genes that may be driving growth of the tumor and may be targets for therapeutics. However, tumors also have intrinsic mechanisms that prevent the patient’s immune system from identifying and eliminating the cancer cells. Profiling the immune system can show if the patient’s immune system may have been subverted and therefore, is less likely to be responsive to immunotherapies. Our blood-based IQLung® testing strategy consists of the VeriStrat® immune profiling test, and the GeneStrat® ddPCR and GeneStrat NGS® tumor profiling tests, which can be ordered together or separately for patients with NSCLC. Together, the tests have an established average turnaround time of three business days, providing physicians with timely results to facilitate treatment decisions.

VeriStrat Test

The VeriStrat test is a blood-based proteomic test that provides a personalized view of each patient’s immune response to their cancer. Results help inform physicians whether their patient has a more aggressive cancer and can help with treatment planning. The VeriStrat test profiles the patient’s immune system by measuring eight protein features measured by MALDI-ToF mass spectrometry and interpreted by a proprietary machine learning-based algorithm to produce either a VeriStrat Good or VeriStrat Poor test result.

The presence of a VeriStrat Poor result indicates the presence of chronic inflammation and a chronic acute phase immune response. A chronic acute phase immune response can trigger the immune system to provide growth factors to the tumor to increase blood flow and tumor growth. The test has been studied in over 85 peer-reviewed and published clinical studies across many different types of therapies such as chemotherapy, targeted therapies, immune therapies, and combinations. The results consistently show the test to be predictive of outcomes, independent of other prognostic factors including PD-L1 expression and performance status. Patients who test as VeriStrat Poor, on average, have an overall survival that is less than half of those who test as VeriStrat Good, independent of treatment type, demonstrating that the test is strongly prognostic. Conversely, patients with a VeriStrat Good test result typically respond better to standard of care treatments than those patients that test as VeriStrat Poor. By using the VeriStrat test for immune profiling, physicians can help identify the patient's immune response to lung cancer to help guide treatment decisions.

GeneStrat ddPCR Test

The GeneStrat test is a blood-based tumor profiling test that detects the guideline recommended, actionable mutations in lung cancer: EGFR, KRAS, BRAF, EML4-ALK, ROS-1, and RET. Physicians can order one or any combination of the gene tests, whichever they deem medically necessary for the individual patient. The presence of a mutation in one of the genes could indicate the patient is a candidate for the associated guideline-recommended targeted therapy. The GeneStrat test performance and potential clinical utility have been published in multiple peer reviewed studies.

GeneStrat NGS Test

The GeneStrat NGS test is a blood-based 52-gene tumor profiling test panel that detects the guideline recommended, actionable mutations in lung cancer including five gene classes (SNV, INDELS, CNA, fusions, and exon-skipping). Specific variants of relevance to NSCLC include EGFR, KRAS, BRAF, EML4-ALK, ROS-1, RET, MET, NTRK. The GeneStrat NGS test is used for late-stage, metastatic NSCLC and physicians can order one or any combination of the IQLung® tests, whichever they deem medically necessary for the individual patient. The presence of a mutation in one of the genes could indicate the patient is a candidate for the associated guideline-recommended targeted therapy. The GeneStrat NGS test performance and potential clinical utility have been published in multiple published studies.

We believe that rapid, blood-based tumor profiling with the GeneStrat ddPCR and GeneStrat NGS tests can be complementary to both targeted tissue-based testing and tissue-based broad genomic sequencing. Testing with GeneStrat ddPCR and GeneStrat NGS tests at diagnosis can help quickly identify patients who are eligible for targeted therapies. Additionally, blood-based testing upfront can help save valuable tissue for diagnostic evaluation, and broad genomic profiling for rare mutations to enroll in clinical trials.

6

Commercialization and Competitive Advantages

For our Biodesix Lung Diagnostic Tests, commercial efforts are focused on the promotion of our tests to healthcare professionals actively involved in the diagnosis and treatment of lung disease. Primarily focusing on the pulmonology specialists and their primary care referral network, the Biodesix commercial team, consisting of specialty sales representatives, medical affairs, marketing and customer care representatives, works to educate and inform the entire patient care group consisting of pulmonologists, advanced pulmonary providers, the primary care referral network, nurses, office staff, laboratory personnel, and healthcare administrators on the appropriate use and value provided by our testing. The goal is to drive test adoption through articulating the scientific and clinical evidence behind our tests, how they impact the clinical care pathway options, and how the tests can ultimately help to improve patient outcomes through earlier detection and treatment.

Patients that are discovered to have pulmonary nodules are concentrated in the pulmonology specialty and in their primary care physician referral networks. We also engage with large hospital systems in a “top-down” approach, with the goal of incorporating our tests into system-wide pathways and protocols.

We believe our continued growth drivers stem from our competitive advantages, including:

•
Our demonstrated success commercializing diagnostic tests in lung disease with unprecedented turnaround times. With five diagnostic tests launched and multiple improvements and several tests currently in development, our commercial portfolio of blood-based solutions currently addresses clinical unmet needs within diagnosis, treatment and monitoring of lung cancer. Our diagnostic tests provide rapid and actionable diagnostic information to help inform physicians on the next steps in a patient’s care plan to help diagnose lung cancer faster and expediting time to treatment.

•
Our broad test offering and continued development and publication of clinical data drives market adoption. We leverage a multi-omic approach to offer various technologies and testing that meet the variety of clinical testing needs for providers treating patients with lung disease. We continue to publish clinical data and health economics and outcomes research to support the ongoing adoption of our tests by physicians, healthcare systems, and payers.

•
Our commercial infrastructure, spanning both the lung-focused sales channel and the primary care referral network, which includes our extensive knowledge and experience in sales, marketing, reimbursement and operations, provides us with the ability to efficiently launch and scale tests and drive revenue. We have built one of the only commercial teams in diagnostics focused on lung disease. By offering a broad menu of tests for current clinical use, and continuing to develop additional tests for lung, we can efficiently leverage the existing team and infrastructure to address more clinical needs for the same call point.

Biodesix Development Services

We enable the world’s leading biopharmaceutical, life sciences, and academic research institutions with scientific, technological, and operational capabilities that fuel the development of diagnostic tests, tools, and therapeutics. We provide development services to enable therapeutic clinical trials, the validation of life sciences tools and diagnostics, and the discovery, development, and commercialization of diagnostics. Biodesix Development Services has been utilized by over 65 industry clients and academic research partners.

We continuously revisit our technology strategy and roadmap to integrate new technologies into our evolving offering, which ultimately support the addition of new service and product revenue offerings. We believe that no single technology can interrogate the complexity of the human disease state to help solve all clinical questions. For that reason, we employ a multi-omic and collaborative approach to solving diagnostic challenges.

We offer end-to-end diagnostic solutions, including translational research, initial biomarker discovery, assay design, development, and validation, testing of clinical trial samples, regulatory, reimbursement, commercialization, and logistical support services (e.g., specimen collection and collection kits). We offer our existing on-market tests, a suite of other research tests and the capability to custom design novel tests for use by our customers.

While our biopharmaceutical discovery, diagnostic development and testing revenue continues to grow, it is important to note that we benefit greatly from these partnerships in many ways beyond revenue. We are continuously expanding our knowledge and biological understanding of multiple diseases and the rapidly evolving treatment landscape, for example, by actively partnering in consortia including with the Friends of Cancer Research.

Pipeline

Our pipeline strategy leverages existing infrastructure, both personnel and technology, which is built to support our Lung Diagnostic Tests and Development Services workstreams, creating a cost-effective development funnel that works around our core business. We utilize insights from our clinical teams and industry and academic partnerships to identify novel opportunities for new test development and expanded use of our current on-market tests. We have a combination of internal projects, generally focused on improvements to our

7

existing diagnostic tests, and external collaborations with academic partners that are typically focused on new test development and exploring additional clinical utility for our existing portfolio.

To continue leveraging our existing commercial channel, we are developing additional tests to help address clinical unmet needs for patients with lung disease. Through pipeline development and research partnerships, we may develop tests that have clinical utility outside of lung disease, in which case we will assess potential partners for commercialization with the goal of maintaining the Biodesix commercial team’s focus on lung disease.

Risk of Recurrence (ROR) & Molecular Residual Disease (MRD) Combination Test – Pan Cancer

Using ddPCR for longitudinal blood-based monitoring of cell-free DNA mutations is a cost-effective testing method while patients are being treated with targeted therapies. Additional utility for ddPCR and our proteomics approach exists for molecular residual disease testing given the sensitivity and specificity of these technologies. In March 2024, we announced a Master Collaborative Research Agreement with Memorial Sloan Kettering Cancer Center (MSKCC), under which the teams are collaborating on a development plan for diagnostic tests aimed at improving the treatment of cancer, including MRD.

VeriStrat Test – Immunotherapy use Pan Cancer

We have conducted broad studies in multiple cancers in collaboration with MSKCC and observed that pre-treatment MSI-H patients eligible for treatment with pembrolizumab have a strong prognostic effect with the previously developed VeriStrat test. Patients that are eligible for treatment with pembrolizumab that are MSI-H may derive beneficial information from the rapid VeriStrat blood test. The VeriStrat test may aid in treatment decisions across a number of cancers that have the MSI-H biomarker. Cancers tested included colorectal and endometrial cancer. Data was presented at the annual Association for Molecular Pathology (AMP) conference in November 2025.

VeriStrat Test – Prostate Cancer

We have observed a strong prognostic effect with the VeriStrat test in metastatic castration-resistant and castrate-sensitive prostate cancer patients eligible for treatment with Abiraterone and Enzalutamide. Data was presented at the annual American Society for Mass Spectrometry (ASMS) and AMP conferences in June and November 2025, respectively. We believe the VeriStrat test may aid in further treatment decisions in this patient population.

ESR1 Monitoring – Breast Cancer

In October 2025, we announced the signing of an expanded partnership agreement under which Biodesix will conduct the development, clinical validation, and regulatory submissions of in vitro diagnostic (IVD) assays to enable highly sensitive detection of multiple genomic markers focused on oncology applications, utilizing Bio-Rad’s Droplet Digital™ PCR (ddPCR™) technology on Bio-Rad’s QX600 platform. The first assay to be validated under the agreement include Bio-Rad’s ddPLEX ESR1 Mutation Detection Assay. ESR1 testing is becoming critical in HR+/HER2- advanced breast cancer due to the clinically demonstrated survival benefits from a new generation of therapy called oral selective estrogen receptor degraders (SERDs). The ddPLEX ESR1 Mutation assay will enable highly sensitive detection and quantification of multiple ESR1 mutations from ctDNA samples. Once validated, the ESR1 assay will be offered as a test service at Biodesix accredited CLIA-CAP laboratory for biopharmaceutical customers to support the development of targeted therapeutics, as well as for clinical customers to support cancer treatment monitoring.

8

Clinical Trials

We are dedicated to continuously publishing and presenting new data on the clinical validation and utility of our diagnostic tests. The following are our ongoing clinical studies for our diagnostic testing solutions.

ALTITUDE Clinical Utility Study (NCT04171492)

The ALTITUDE clinical utility study is designed to evaluate the performance of Nodify Lung testing (Nodify XL2 and Nodify CDT tests) in a randomized controlled study (RCT). The study is titled “A Multicenter, Randomized Controlled Trial, Prospectively Evaluating the Clinical Utility of the Nodify XL2 Proteomic Test in Incidentally Discovered Low to Moderate Risk Lung Nodules”. The study objectives are to evaluate how the addition of the Nodify Lung test result impacts the clinical decision making for patients with new, incidentally identified solid lung nodules assessed as low to moderate risk of lung cancer. The trial has an adaptive study design with a blinded standard of care arm and 2:1 randomization for open-label results for the Nodify XL2 test. On July 21, 2025, we ended patient accrual based on the recommendation of the Data Safety Monitoring Board. Final analysis will be completed following two-year follow-up.

CLARIFY Clinical Utility Study (NCT06728319)

CLARIFY is a large, retrospective study assessing the performance of the Nodify CDT and Nodify XL2 tests in a real-world patient population. The study is titled “A Multicenter, Retrospective, Chart Review Study Evaluating The Impact and Utility of the Blood-Based Proteomic Integrated Classifier and Auto-Antibody Tests in the Real World.” The study's primary objective is to assess the performance of the Nodify CDT and Nodify XL2 tests both individually and serially. The study will evaluate up to 4,000 patients who have at least one to two years of follow-up from high-volume community and academic practices that have integrated the testing into their management of lung nodules. Further evaluation of the performance of the tests in a large, real-world population will provide deeper insights into day-to-day clinical practice and diverse and understudied patient sub-populations. It received central IRB approval in August 2024 and began enrollment in September 2024. Through December 31, 2025, the CLARIFY study has accrued over 1,500 patients.

INSIGHT Observational Study (NCT03289780)

The INSIGHT observational study is designed to evaluate the real-world clinical utility and performance of VeriStrat, GeneStrat ddPCR, and GeneStrat NGS tests. The title is “Observational Study Assessing the Clinical Effectiveness of VeriStrat and Validating Immunotherapy Tests in Subjects with Non-Small Cell Lung Cancer (INSIGHT)”. On June 27, 2023, we completed enrollment of 5,000 patients with non-small cell lung cancer. Final analysis with three-year follow-up is estimated to be completed by the end of 2026.

Reimbursement

The primary source of reimbursement for our tests in the United States is from third-party payers, including government payers, such as Medicare, and commercial payers, such as insurance companies. Reimbursement for laboratory tests in the United States is determined by various payers, including private third-party payers, managed care organizations, and state and federal health care programs, such as Medicare and Medicaid. In Medicare, coverage of an item or service depends on whether it is “reasonable and necessary” under Section 1862(a)(1)(A) of the Social Security Act (SSA). For single-source laboratory tests, this determination is typically made by the Medicare Administrative Contractor (MAC) with jurisdiction over the laboratory where the test is performed. Our Louisville, Colorado laboratory is currently under the jurisdiction of Novitas Solutions, Inc. Our De Soto, Kansas laboratory is under the jurisdiction of Wisconsin Physicians Service Insurance Corporation (WPS), which participates in the MolDX program (administered by another MAC, Palmetto GBA) to set coverage policy for molecular diagnostic tests.

Medicare pays for clinical diagnostic laboratory tests (CDLTs), on the Clinical Laboratory Fee Schedule (CLFS). Section 216(a) of the Protecting Access to Medicare Act of 2014 (PAMA) added Section 1834A to the SSA, which established the current CLFS rate setting processes and coding provisions for CDLTs, and created a new subcategory of CDLTs called Advanced Diagnostic Laboratory Tests (ADLTs), with separate reporting and payment requirements.

Under Section 1834A and its implementing regulations, clinical laboratories that receive the majority of their Medicare revenues from payments made under the CLFS and the Physician Fee Schedule report on a triennial basis (or annually for ADLTs), private payer rates and volumes for their tests with specific billing codes based on final payments made during a set data collection period. The payment rate for a test for the ensuing three-year period (or one year for ADLTs) is set at the weighted median of the rates reported under the specific billing code for that test. Newly established codes for CDLTs are priced until the next private payer rate reporting cycle either based on the payment rate of a comparable code on the CLFS, as determined by CMS ("crosswalking") or at the median of rates submitted by the individual MACs based on statutory and regulatory factors ("gapfilling"). New ADLTs are initially priced at “actual list charge” for a nine-month period, after which they are priced based on private payer rates, with a recoupment provision if actual list charge is more than 130% of the weighted median of private payer rates reported.

The various payers in the United States also determine their own billing rules. In December 2020, Medicare revised its billing rules for clinical laboratory tests to require cancer-related protein-based Multianalyte Assays with Algorithmic Analyses to be billed directly to Medicare by the performing laboratory in most cases when performed on a specimen collected from a hospital outpatient. Molecular

9

pathology tests and most ADLTs are also generally required to be billed directly to Medicare by the laboratory under these circumstances.

CMS has designated three of the Biodesix tests as Advanced Diagnostic Laboratory Tests (ADLT). The designation was effective for the Nodify CDT test as of June 30, 2023, for the Nodify XL2 test as of May 17, 2019, and for the VeriStrat test as of December 21, 2018. Obtaining ADLT status is a recognition that the tests meet the stringent criteria established under the Protecting Access to Medicare Act of 2014. ADLT status is reserved for innovative tests with Medicare coverage that are offered and furnished by a single laboratory and provide new clinical diagnostic information that cannot be obtained from any other test or combination of tests. We believe that our lung cancer tests can both improve patient outcomes and help guide cost-effective treatment choices for patients with and at-risk of lung cancer. Achieving broad coverage and adequate reimbursement for each of our tests is a key component of our financial success and will continue to be important over time.

Compliance with applicable laws and regulations, as well as internal compliance policies and procedures, adds complexity to the billing process. CMS is responsible for overseeing the establishment of new Healthcare Common Procedure Coding System (HCPCS) codes for billing the Medicare program and other payers. CMS continuously evaluates and implements changes to the Medicare billing, coding, and reimbursement processes. To receive reimbursement from third-party payers, we bill our tests using a variety of HCPCS codes or Current Procedural Terminology (CPT) codes, as defined by the American Medical Association. For some of the tests we conduct, there may not be a specific CPT or HCPCS code, in which case the test may be billed under a miscellaneous code for an unlisted molecular pathology procedure or unlisted multiple analyte test with algorithmic analysis (MAAA) procedure. Because these miscellaneous codes do not describe a specific service, the third-party payer claim may be examined to determine the service provided, whether the service was appropriate and medically necessary and whether payment should be rendered. This process can result in a delay in processing the claim, a lower reimbursement amount, and/or denial of the claim.

Competition

We primarily face competition from diagnostic companies that provide cancer-focused diagnostic tests to hospitals, researchers, clinicians, and biopharmaceutical companies.

Diagnosis—Nodule Management

We are not aware of any other company that offers commercial blood-based tests to help physicians reclassify risk of malignancy in patients with suspicious lung nodules. We are aware of efforts by Veracyte, Inc. to develop and validate a test that may be competitive to the Nodify XL2 and/or Nodify CDT tests in the future.

Treatment Guidance and Monitoring—Non-Small Cell Lung Cancer

We are unaware of any other diagnostic test available, commercially or in development, that will compete with our VeriStrat immune profiling test. There is substantial interest and activity in tumor profiling through liquid biopsy. Our genomic test offerings, the GeneStrat ddPCR and GeneStrat NGS tests, face competition from academic hospital laboratories, and companies such as Guardant Health and Foundation Medicine. We believe that there are several companies and academic research institutions in the process of developing tests for monitoring patients or following treatment for recurrence or progression of lung cancer.

Biodesix Development Services

We are aware of a number of companies who compete with our Development Services for biopharmaceutical, life science and research partners, including in diagnostic research, clinical trial testing, and the discovery, development, and commercialization of tests. From the perspective of tumor profiling, we believe Guardant Health, Foundation Medicine, Tempus AI, and NeoGenomics are our most significant competitors. Conversely, in the immune profiling market, we believe Adaptive Biotechnologies and Personalis are our most significant competitors.

Clinical Laboratory Operations

Throughout 2025, all aspects of the testing process, from receipt of the test requisition form through delivery of test results, were performed for the VeriStrat, GeneStrat ddPCR, and GeneStrat NGS tests in our Louisville, Colorado facility. The proprietary testing methods use semi-automated workflows that facilitate successful delivery averaging 90% of our tests within three days, and we believe our existing workflows will continue to successfully deliver our tests within this timeframe. Our Louisville facility is a high-complexity Clinical Laboratory Improvement Amendments (CLIA) certified clinical laboratory. The laboratory is College of American Pathology (CAP) accredited, New York State Department of Health (NYSDOH)—permitted holding necessary Laboratory Director certifications and test approvals, ISO 13485:2016 Quality Management Systems—Requirements for Regulatory Purposes for Medical Devices certified, along with all other states that require licensing: California, Maryland, Pennsylvania, and Rhode Island.

Receipt of requisitions and testing for the Nodify CDT and Nodify XL2 tests are performed in our De Soto, Kansas clinical laboratory. Delivery of the test results is centralized to our Louisville, Colorado corporate headquarters. The proprietary testing methods use semi-automated workflows that facilitate successful delivery averaging 90% of our tests within five business days, and we believe our existing workflows will continue to successfully deliver our tests within this timeframe. Our De Soto, Kansas facility is a high-complexity CLIA

10

certified clinical laboratory. This clinical laboratory is also CAP-accredited, NYSDOH—permitted holding necessary Laboratory Director certifications and test approvals, Quality Management Systems—Requirements for Regulatory Purposes for Medical Devices certified and licensed by California, Maryland, Pennsylvania, and Rhode Island.

Personnel in both laboratory facilities are responsible for quality assurance oversight, licensing, and regulatory compliance and maintenance to ensure data integrity and consistent, validated processes.

Supply Chain

We rely on third-party suppliers to provide certain components of our diagnostic tests, including a select few (located in the United States, Europe and China), as critical single source providers of components. Bio-Rad, as described below, is the sole source supplier for our GeneStrat test. Freenome's United States operations (formerly "Oncimmune USA" or "Oncimmune") is also the sole source supplier for our Nodify CDT tests but there are known secondary suppliers for these materials.

We entered into a nonexclusive license and supply agreement with Bio-Rad in August 2019. We rely on Bio-Rad to supply equipment and reagents used to perform ddPCR testing, a service offered by us under a variety of fee for service agreements and the core technology powering the GeneStrat test, but these supplies are able to be supplied by known suppliers. A disruption to this supply would negatively impact our ability to perform the GeneStrat tests until alternatives can be validated.

All materials for our VeriStrat test and Nodify XL2 test have alternative suppliers readily available, and a disruption in any single supplier would not materially impact our ability to deliver the test.

We have initiated the second source qualification process for the majority of these critical components, however, we may not be successful in securing second sourcing for all of them at all or on a timely basis. A disruption to this supply would negatively impact our ability to perform these tests until an alternative supplier could be validated.

Intellectual Property

Our success depends, in part, on our ability to obtain and maintain intellectual property and proprietary protection for our products and other know-how, to operate our business without infringing, misappropriating or otherwise violating the intellectual property and proprietary rights of others, and to defend and enforce our intellectual property and proprietary rights. We take efforts to protect our proprietary position using a variety of methods, which include pursuit of United States and foreign patent applications related to our proprietary technology, inventions and improvements that we determine are important to our business. We also may rely on trade secrets, trademarks, know-how, continuing technological innovation and potential in-licensing and acquisition opportunities to develop and maintain our proprietary position. For more information regarding risks relating to intellectual property, please see “Risk Factors—Risks Related to Our Intellectual Property.”

We have invested heavily in the protection of our key assets, namely the VeriStrat and GeneStrat tests, and we acquired a patent portfolio relating to the Nodify XL2 and Nodify CDT tests in our acquisitions of Indi in June 2018, and of Oncimmune USA in October 2019 from Oncimmune Limited (Oncimmune). We own patents and patent applications as well as trade secrets relating to our products currently in development, a collection device for whole blood, our business strategy, client lists and business methods. Further, we have expanded our access to key intellectual property through license and co-development agreements, including our Non-Exclusive License Agreement with Bio-Rad (the Bio-Rad License), which allows us to use the Droplet Digital PCR technology developed by Bio-Rad and which we employ in our GeneStrat test.

Our patent strategy has focused on creating and acquiring protection for our VeriStrat and Nodify XL2 proteomic tests, while utilizing trade secret and some methods patent protection for our genomic test (the GeneStrat ddPCR and GeneStrat NGS tests) and ELISA test (the Nodify CDT test). We have entered into a non-exclusive license agreement with Bio-Rad, without the right to grant sublicenses, to utilize certain of Bio-Rad’s intellectual property, machinery, materials, reagents, supplies and know-how necessary for the performance of ddPCR in cancer detection testing for third parties in the United States. Bio-Rad owns patents relating to ddPCR and to which we have a non-exclusive license to utilize for the performance of ddPCR in cancer detection testing for third parties as set forth in the Bio-Rad License Agreement. We have patent protection in the United States and other countries around the world for the primary use of the VeriStrat test for profiling of patients with NSCLC, and various other uses of the VeriStrat test, such as breast cancer, prostate cancer, head and neck cancer have received patent protection. We have also received patent protection relating to our core classifier development program, our AI platform and our approaches to using MALDI-ToF technology (DeepMALDI® techniques). Additionally, our first device patent was issued in 2019 for our internally designed blood collection device.

As of December 31, 2025, our patent portfolio includes 60 issued United States patents, 84 issued foreign patents, and 18 pending applications (including 10 foreign patent applications). With regard to our product development efforts, new applications have been filed around developments relating to micro-organisms diagnostics, new analytic methodologies using Shapley values and semi-quantitative spectra analysis in MALDI, and national stage applications are now in active prosecution to protect our pipeline ROR and PIR tests.

11

The patent portfolio can be broken down into five major categories:

1)
Issued patents and patent applications relating to the VeriStrat and Nodify® tests and uses of these tests;

2)
Issued patents and patent applications relating to methods for developing classifiers, including using our AI platform and DeepMALDI technologies;

3)
Issued patents and patent applications relating to tests currently in development;

4)
Issued patents and patent applications relating to our novel blood collection device; and

5)
Issued patents and patent applications relating to tests developed for our third-party partners.

The patents relating to the VeriStrat test are scheduled to expire between 2026 and 2032 and are actively under review for additional protection. The patents relating to the Nodify XL2 test are scheduled to expire beginning in 2031 (excluding any patent term extension granted by the United States Patent and Trademark Office (USPTO)), and the patents relating to the Nodify CDT test are scheduled to expire in 2027 and are actively under review for additional protection. The patent related to the blood collection device is scheduled to expire in 2039. Should our current patent applications in prosecution in the United States issue, the resulting patents would be scheduled to have expiration dates between 2036 and 2040 (excluding any patent term extension(s) granted by the USPTO).

Patent Cooperation Treaty (PCT) applications are not eligible to become issued patents until, among other things, we file such PCT applications as national stage patent application(s) within 30 months in the countries in which we seek patent protection. If we do not timely file any national stage patent applications, we may lose our priority date with respect to any such PCT patent applications and any patent protection on the inventions disclosed in such PCT patent applications. Provisional patent applications are not eligible to become issued patents but can become the basis of PCT foreign stage and United States non-provisional patent applications, if such applications are filed within 12 months of filing the related provisional patent application. If we do not timely file any non-provisional patent applications, we will lose our priority date and any patent protection on the inventions disclosed in any such provisional patent application. As of December 31, 2025, we have no pending PCT applications.

In addition, the term of individual issued patents depends upon the legal term for patents in the countries in which they are obtained. In most countries in which we have filed, including the United States, the patent term is generally 20 years from the earliest filing date of a non-provisional patent application, assuming the patent has not been terminally disclaimed over a commonly-owned patent or a patent naming a common inventor, or over a patent not commonly owned but that was disqualified as prior art as the result of activities undertaken within the scope of a joint research agreement. The life of a patent, and the protection it affords, is therefore limited and once the patent lives of our issued patents have expired, we may face competition, including from other competing technologies. In the United States, the term of a patent may also be eligible for patent term adjustment for delays within the USPTO. The term of a patent that covers a biological product may also be eligible for patent term extension when FDA approval is granted for a portion of the term effectively lost as a result of the FDA regulatory review period, subject to certain limitations and provided statutory and regulatory requirements are met. Any such patent term extension can be for no more than five years, only one patent per approved product can be extended, the extension cannot extend the total patent term beyond 14 years from approval, and only those claims covering the approved biological product, a method for using it or a method for manufacturing it may be extended. We may not receive an extension if we fail to exercise due diligence during the testing phase or regulatory review process, fail to apply within applicable deadlines, fail to apply prior to expiration of relevant patents or otherwise fail to satisfy applicable requirements. Moreover, the length of the extension could be less than we request. There can be no assurance that we will benefit from any patent term extension or favorable adjustment to the term of any of our patents. As a result, our owned and licensed patent portfolio may not provide us with sufficient rights to exclude others from commercializing products similar or identical to ours.

Our ability to maintain and solidify our proprietary and intellectual property position will depend on our success in obtaining effective patent claims and maintaining and enforcing claims that are granted. However, our owned and licensed patents could be invalidated or narrowed or otherwise fail to adequately protect our proprietary and intellectual property position and our pending owned and licensed patent applications, and any patent applications that we may in the future file or license from third parties, may not result in the issuance of patents.

Branding is a part of any intellectual property strategy as patent or trade secret protection and we have a number of registered and pending trademarks relating to our company and products. We have received or filed for trademark protection in the United States for our trade name (Biodesix), the Biodesix logo, the names of five of our commercial tests (namely the VeriStrat, GeneStrat ddPCR, GeneStrat NGS, Nodify XL2 and Nodify CDT tests), and a suite of research tests (ImmunoStrat test), as well as having trademark protection for our core development and methodological platforms, such as our AI platform and DeepMALDI technologies. In all, as of December 31, 2025, we have 13 uniquely registered United States trademarks, four of which (including Biodesix, VeriStrat, Nodify and GeneStrat) have received foreign issuances as well, with one trademark pending approval from the USPTO. We will continue to pursue protection in the United States and abroad for our branded assets and will continue to use branding to protect products currently in development, key Biodesix developments and non-trade secret methodologies.

12

We also rely on trade secrets, including know-how, confidential information, unpatented technologies and other proprietary information, to strengthen or enhance our competitive position, protect and maintain aspects of our business that are not amenable to, or that we do not presently consider appropriate for, patent protection, and prevent competitors from reverse engineering or copying our technologies. We have decided that some technologies, such as our laboratory methodologies (including sample preparation and assay development), and some information (such as client and billing information) are best kept as trade secrets. However, trade secrets and confidential know-how are difficult to protect. To avoid inadvertent and improper disclosure of trade secrets, and to avoid the risks of former employees using these trade secrets to future employment, it is our policy to require employees, consultants and independent contractors to assign all rights to intellectual property they develop in connection with their employment with or services for the Company to the Company. We also protect our existing and developing intellectual property expressly through confidentiality provisions in agreements with third parties. There can be no assurance, however, that these agreements will be self-executing or otherwise provide meaningful protection for our trade secrets or other intellectual property or proprietary information, or adequate remedies in the event of unauthorized use or disclosure of such trade secrets or other intellectual property or proprietary information.

We also seek to preserve the integrity and confidentiality of our trade secrets and other confidential information by maintaining physical security of our premises and physical and electronic security of our information technology systems. While we have confidence in the measures we take to protect and preserve our trade secrets, such measures can be breached, and we may not have adequate remedies for any such breach. In addition, our trade secrets may otherwise become known or be independently discovered by competitors.

We intend to pursue additional intellectual property protection to the extent we believe it would advance our business objectives, which may include objectives within and outside the United States. Despite our efforts to protect our intellectual property rights, and despite the breadth of protection that has issued around our key assets, these rights may not be respected in the future or may be circumvented or challenged (and potentially invalidated) in a legal proceeding in any jurisdiction where we have intellectual property rights. In addition, the laws of various foreign countries where we have received intellectual property protection and where we may eventually distribute our products may not afford the same protections or assurances to the same extent as the laws in the United States. See “Risk Factors—Risks Related to Our Intellectual Property” for additional information regarding these and other risks related to our intellectual property portfolio and their potential effect on us.

Government Regulations

Clinical laboratory tests like our diagnostic tests are regulated under CLIA and state law. The FDA regulates medical devices pursuant to the Federal Food, Drug, and Cosmetic Act (FDCA), including many diagnostic test kits, such as IVDs. However, most Laboratory Developed Tests (LDTs) are not currently subject to enforcement under the FDA’s regulation (although reagents, instruments, software or components provided by third parties and used to perform LDTs may be subject to such enforcement), and the FDA has historically exercised enforcement discretion over LDTs. LDTs are a subset of IVDs that are intended for clinical use and developed, validated, and offered within a single laboratory for use only in that laboratory. Historically, high-complexity clinical laboratories have offered LDTs under the CLIA regulatory framework administered by CMS, without FDA premarket clearance or approval.

We currently market our GeneStrat, VeriStrat, Nodify XL2 and Nodify CDT tests as LDTs in the United States. As a result, we believe our diagnostic services are not currently subject to the FDA’s enforcement of its medical device regulations and the applicable FDCA provisions. If the FDA disagrees with the LDT status of any of our tests, the FDA may consider the test to be an unapproved medical device and may subject us to FDA enforcement action, including, without limitation, requiring us to seek clearance, authorization or approval for the laboratory test. If the FDA were to begin enforcement with respect to our LDTs, we could incur substantial costs and delays associated with trying to obtain pre-market clearance or approval and costs associated with complying with post-market requirements.

FDA’s authority to regulate LDTs has been contested for many years, and there have been several legislative and administrative proposals regarding LDT regulation seeking to end or limit enforcement discretion and to bring LDTs under new or existing FDA regulatory frameworks. On May 6, 2024, the FDA published a final rule to actively regulate LDTs under a multi-year phase-in framework. On May 29, 2024, the American Clinical Laboratory Association and HealthTrackRx filed suit challenging the rule, and on March 31, 2025, the U.S. District Court for the Eastern District of Texas vacated the rule, concluding that LDTs developed and used within a single clinical laboratory are not “devices” under the FDCA and therefore fall outside FDA’s statutory authority. The FDA did not appeal the ruling, and the final rule was rescinded on September 19, 2025. At this time, it remains uncertain whether or how the FDA may seek to regulate LDTs that are developed across multiple laboratories, used outside traditional clinical settings, or offered through digital health or direct to consumer channels. Legislative proposals have also periodically sought to clarify or expand FDA’s authority over LDTs, and future statutory or regulatory developments may shape FDA’s approach to oversight of LDTs and related components.

Federal and State Laboratory Licensing Requirements

The Biodesix Louisville, Colorado clinical laboratory is a CAP-accredited clinical laboratory regulated by CMS pursuant to CLIA. CMS has granted CAP deeming authority under CLIA, which allows CAP to inspect laboratories in lieu of CMS. In addition to holding a CLIA Certificate and CAP laboratory accreditation, Biodesix Quality Management System (QMS) holds an ISO 13485:2016 certificate. The Biodesix Louisville, Colorado clinical laboratory received approval from the NYSDOH, NYS CLEP in Soluble Tumor Markers,

13

and Molecular and Cellular Tumor Markers as well as held state permits and licenses in California, Maryland, New York, Pennsylvania, and Rhode Island.

CLIA regulations establish standards for proficiency testing; facility administration; general laboratory systems; pre-analytic, analytic systems, post- analytic systems; personnel qualifications and responsibilities; quality control, quality assessment; and specific provisions for laboratories performing moderate to high complexity tests. Our Louisville, Colorado clinical laboratory is inspected biennially as part of its ongoing certification under CLIA certificate of accreditation by CAP.

Under CLIA, a laboratory is any facility that performs laboratory testing on specimens derived from humans for the purpose of providing information for the diagnosis, prevention or treatment of disease, or the impairment of or assessment of health. CLIA requires that a laboratory hold a certificate applicable to the type of laboratory examinations it performs and that it complies with, among other things, standards covering operations, personnel, facilities administration, quality systems and proficiency testing, which are intended to ensure, among other things, that clinical laboratory testing services are accurate, reliable and timely.

The International Organization for Standardization (ISO) is an independent, non-governmental international organization that defines world-class specifications for products, services and systems, to ensure quality, safety and efficiency. ISO 13485:2016 is a harmonized, international regulatory benchmark for quality management systems that addresses most or all of the QMS requirements in markets including the United States, European Union, Australia, Japan and Canada. The ISO 13485:2016 certificate confirms that an organization operates a QMS that conforms to the standards established by ISO. On January 31, 2024, the FDA issued a final rule to harmonize and modernize its Quality System Regulation (QSR), which would supplant the existing requirements with ISO 13485:2016. The rule amends the current good manufacturing practice requirements of the QSR in 21 CFR 820. The FDA’s Quality Management System Regulation (QMSR) rule emphasizes risk management activities and risk-based decision making and aims to reduce regulatory burdens on device manufacturers and importers by harmonizing domestic and international requirements. Device manufacturers and importers have one year to modify their quality systems to meet the requirements of the QMSR rule by February 2, 2026. Accordingly, Biodesix’s QMS is designed and implemented, in alignment with ISO 13485:2016 and has been proactively updated to meet the requirements of the FDA’s QMSR, confirming our ongoing compliance with both international standards and the harmonized U.S. regulatory framework.

The Biodesix De Soto, Kansas clinical laboratory is a CAP-accredited clinical laboratory regulated by CMS pursuant to CLIA. CMS has granted CAP deeming authority under CLIA, which allows CAP to inspect laboratories in lieu of CMS. The De Soto, Kansas clinical laboratory has received approval from the NYSDOH, NYS CLEP in Soluble Tumor Markers and Diagnostic Immunology as well as holding state permits and licenses in California, Maryland, Pennsylvania, and Rhode Island.

To renew our CLIA certificate, we are subject to survey and inspection every two years to assess compliance with program standards. Laboratories such as ours, which are performing high complexity testing, are required to meet more stringent CLIA requirements than laboratories performing less complex tests, and therefore our laboratories are also subject to random, unannounced survey and inspection at any time. In addition, a laboratory that is certified as “high complexity” under CLIA may develop, manufacture, validate and use proprietary LDTs. CLIA requires analytical validation including accuracy, precision, specificity, sensitivity and establishment of a reference range for any LDT used in clinical testing. The regulatory and compliance standards applicable to the testing we perform may change over time and any such changes could have a material effect on our business.

CLIA provides that a state may adopt laboratory regulations that are more stringent than those under federal law, and a number of states have implemented their own more stringent laboratory regulatory requirements. State laws may require that out-of-state laboratories maintain an in-state laboratory license to perform tests on samples from patients who reside in that state. As a condition of licensure, certain states may require that laboratory personnel meet qualifications, quality control procedures, facility requirements, record maintenance requirements or other state-specific requirements.

Because our Louisville, Colorado clinical laboratory is located in the State of Colorado, we do not need a specific State of Colorado laboratory license, however, we maintain licenses to conduct testing in other states where nonresident laboratories are required to obtain state laboratory licenses. We maintain licenses for our Louisville, Colorado and De Soto, Kansas laboratories with the NYSDOH. We also hold licenses in other states in which we operate, including California, Maryland, Pennsylvania and Rhode Island, that require licensing of out-of-state laboratories under certain circumstances. Other states may currently have or adopt similar licensure requirements in the future, which may require us to modify, delay or stop its operations in those states until such requirements are met.

Failure to comply with CLIA certification and state clinical laboratory licensure requirements may result in a range of enforcement actions, including certificate or license suspension, limitation, or revocation, directed plan of action, onsite monitoring, civil monetary penalties, criminal sanctions, and revocation of the laboratory’s approval to receive Medicare and Medicaid payment for its services, as well as significant adverse publicity.

CLIA and state laws and regulations, operating together, sometimes limit the ability of laboratories to offer consumer-initiated testing, also known as direct access testing. We do not offer direct access testing and instead require that our tests be ordered by licensed healthcare providers.

Our Louisville, Colorado and De Soto, Kansas laboratories are certified and adhere to the NYS CLEP, based on New York State Public Health Law, Article 5 Title 5. NYS CLEP is exempt from CLIA and establishes their own method of laboratory certification and test

14

validation approval. To process New York State patient specimens a laboratory must submit a robust analytical and clinical validation package to demonstrate clinical utility of the test and receive approval prior to offering the test in the state of New York. All of our tests have obtained NYS CLEP approval including GeneStrat ddPCR, GeneStrat NGS, VeriStrat, Nodify XL2 and Nodify CDT tests. NYS CLEP requires semi-annual inspections to ensure the laboratory meets all general and specialty standards. Due to the pandemic, NYSDOH CLEP routine re-inspections were delayed by multiple years.

Regulatory Framework for Medical Devices in the United States and Internationally

Pursuant to its authority under the FDCA, the FDA has jurisdiction over medical devices, which are defined to include, among other things, IVDs. The FDA regulates the research, design, development, pre-clinical and clinical testing, manufacturing, safety, effectiveness, packaging, labeling, storage, recordkeeping, pre-market clearance or approval, adverse event reporting, marketing, promotion, sales, distribution and import and export of medical devices. It is possible that one or more of our current, or future, tests will be subject to FDA authority and oversight as either an IVD or a CDx pursuant to the FDA’s authority to regulate medical devices under the FDCA.

Medical devices are subject to extensive regulation in the United States and elsewhere, including by the FDA and its foreign counterparts. Government regulations specific to medical devices are wide ranging and govern, among other things:

•
product design, development, manufacturing assembly and release;

•
laboratory and clinical testing, labeling, packaging, storage and distribution;

•
product safety and efficacy;

•
premarketing clearance or approval;

•
service operations, including assay development and validation, clinical sample testing, clinical trial solutions, and quality and regulatory solutions;

•
record keeping;

•
product marketing, promotion and advertising, sales and distribution;

•
post-marketing surveillance, including reporting of deaths or serious injuries and recalls and correction and removals;

•
post-market approval studies; and

•
product import and export

Many countries in which we may offer any of our diagnostic tests in the future have anti-kickback regulations prohibiting providers from offering, paying, soliciting or receiving remuneration, directly or indirectly, in order to induce business that is reimbursable under any national health care program. In situations involving physicians employed by state-funded institutions or national health care agencies, violation of the local anti-kickback law may also constitute a violation of the Foreign Corrupt Practices Act of 1997 (FCPA).

The FCPA prohibits any United States individual, business entity or employee of a United States business entity to offer or provide, directly or through a third party, including any potential distributors we may rely on in certain markets, anything of value to a foreign government official with corrupt intent to influence an award or continuation of business or to gain an unfair advantage, whether or not such conduct violates local laws. In addition, it is illegal for a company that reports to the Securities and Exchange Commission (SEC) to have false or inaccurate books or records or to fail to maintain a system of internal accounting controls. We will also be required to maintain accurate information and control over sales and distributors’ activities that may fall within the purview of the FCPA, its books and records provisions and its anti-bribery provisions.

The standard of intent and knowledge in anti-bribery cases is minimal. Intent and knowledge are usually inferred from that fact that bribery took place. The accounting provisions do not require intent. Violations of the FCPA’s anti-bribery provisions for corporations and other business entities are subject to a fine of up to $2 million and officers, directors, stockholders, employees, and agents are subject to a fine of up to $100,000 and imprisonment for up to five years. Other countries, including the United Kingdom and other OECD Anti-Bribery Convention members, have similar anti-corruption regulations, such as the United Kingdom Anti-Bribery Act.

When marketing our diagnostic tests outside of the United States, we may be subject to foreign regulatory requirements governing human clinical testing, prohibitions on the import of tissue necessary for us to perform our diagnostic tests or restrictions on the export of tissue imposed by countries outside of the United States or the import of tissue into the United States, and marketing approval. These requirements vary by jurisdiction, differ from those in the United States and may in some cases require us to perform additional pre-clinical or clinical testing. In many countries outside of the United States, coverage, pricing and reimbursement approvals are also required.

Market access, sales and marketing of medical devices in non-U.S. countries are subject to foreign regulatory requirements that vary widely from country to country. For example, in the European Economic Area (EEA), a medical device must meet the Medical Devices

15

Directive’s (MDD)/In Vitro Medical Devices Directive’s (IVDD) Essential Requirements or, applicable on May 26, 2021, the Medical Devices Regulation’s (MDR) / applicable on May 26, 2022, In Vitro Medical Devices Regulation’s (IVDR) General Safety and Performance Requirements which apply to it, taking into account its intended purpose as defined by the data supplied by the manufacturer on the label, in the instructions for use or in promotional or sales materials or statements and as specified by the manufacturer in the clinical evaluation. Before placing a medical device on the EEA market, the manufacturer must draw up a declaration of conformity, certifying that the device complies with the MDD/IVDD/MDR/IVDR, and must then affix the CE mark. For medium and high-risk devices as well as low risk devices that are placed on the market in sterile condition, have a measuring function, or are reusable surgical instruments, the manufacturer must obtain a CE Certificate from a notified body. The notified body typically audits and examines the device’s technical documentation, including the clinical evaluation, and the quality system for the manufacture, design and final inspection of the relevant device before issuing a CE Certificate. Following the issuance of this CE Certificate, manufacturers may draw up the declaration of conformity and affix the CE mark to the devices covered by this CE Certificate.

In the EEA, manufacturers of medical devices must document in a clinical evaluation report (CER) the evaluation of the clinical data related to the device. The CER is part of the device’s technical file. The evaluation shall document that the applicable Essential Requirements/General Safety and Performance Requirements are met and document the evaluation of the undesirable side-effects and the acceptability of the benefit-risk ratio. The CER must be updated based on information from the post-market surveillance and vigilance activities related to the device. The CER shall consist, inter alia, of analyzed clinical data collected from a clinical investigation of the device, or the results of other studies on substantially equivalent devices. Reliance on “substantially equivalent” devices is very restrictive and requires, inter alia, that the manufacturer has full access to the technical documentation of the equivalent device on an ongoing basis and, if the “equivalent device” is not its own, that the manufacture has in place a contract with the manufacturer of the “equivalent device.”

Similar requirements apply in the UK. For access to the UK market, manufacturers must obtain a UKCA Certificate and affix a UKCA mark to their medical devices. Initially, the government stated the CE mark will be accepted in the UK until July 1, 2023. However, on July 1, 2023, the government updated their guidance for regulating medical devices stating their intention to extend recognition and acceptance of the CE marking for placing most goods on the market in Great Britain, indefinitely, if the device was placed on the EU market before January 1, 2021.

Device Classification

Under the FDCA, medical devices are classified into one of three classes: Class I, Class II or Class III, depending on the degree of risk to patients that is associated with each medical device and the amount of oversight needed to provide reasonable assurances with respect to safety and effectiveness of the medical device.

On January 31, 2024, the FDA’s Center for Devices and Radiological Health (CDRH) announced that the Center intends to initiate the reclassification process for most IVD tests that are currently Class III (high risk) into Class II (moderate risk). The majority of these tests are infectious disease and companion diagnostic IVDs. Reclassification would allow manufacturers of certain types of tests to seek marketing clearance through the less burdensome premarket notification (510(k)) pathway rather than the premarket approval pathway, the most stringent type of FDA medical device review.

Class I includes devices with the lowest risk to the patient and are those for which safety and effectiveness can be reasonably assured by adherence to a set of FDA regulations, referred to as the General Controls for Medical Devices, which require compliance with the applicable portions of the FDA’s QSR, facility registration and product listing, reporting of adverse events and malfunctions, and appropriate, truthful and non-misleading labeling and promotional materials. Some Class I devices also require premarket clearance by the FDA through the 510(k) premarket notification process described below. Most Class I products are exempt from the premarket notification requirements.

Class II devices are subject to the General Controls as well as any special controls deemed necessary by the FDA to ensure the safety and effectiveness of the device. These special controls can include performance standards, patient registries, FDA guidance documents and post-market surveillance. Most Class II devices are subject to premarket review and clearance by the FDA. Premarket review and clearance by the FDA for Class II devices is accomplished through the 510(k) premarket notification process, although some Class II devices are exempt from the 510(k) requirements.

Class III devices include devices deemed by the FDA to pose the greatest risk: such as life-supporting or life-sustaining devices, implantable devices, or those deemed novel and not substantially equivalent to a predicate device following the 510(k) process. CDx tests are regularly considered Class III devices.

Premarket Submission Process

Unless a statutory or regulatory exemption or enforcement discretion policy applies, before a new medical device, or a new intended use of, claim for, or significant modification to an existing device, can be marketed in the United States, the manufacturer must obtain the FDA’s: (1) permission for commercial distribution under section 510(k) of the FDCA (510(k) clearance); or (2) approval of a Premarket Approval Application (PMA); or (3) De Novo classification and authorization. These processes can be resource intensive, expensive, and lengthy, and require payment of significant user fees.

16

Under the 510(k) clearance process, the manufacturer must submit to the FDA a premarket notification, demonstrating that the device is “substantially equivalent” to a legally marketed predicate device. A predicate device is a legally marketed device that is not subject to a PMA, i.e., a Class I or II device that was legally marketed prior to May 28, 1976 (pre-amendments device), a device that has been reclassified from Class III to Class II or I, or a device that was previously found substantially equivalent through the 510(k) process. To be “substantially equivalent,” the proposed device must have the same intended use as the predicate device, and either have the same technological characteristics as the predicate device or have different technological characteristics and not raise different questions of safety or effectiveness than the predicate device. Premarket notifications typically include bench, analytical, and preclinical data. Clinical data is sometimes required to support substantial equivalence. If a manufacturer obtains a 510(k) clearance for its device and then makes a modification that could significantly affect the device’s safety or effectiveness or constitutes a major change or modification in the intended use of the device, then a new clearance, authorization or approval may be required.

By statute, the FDA is required to complete its review of a 510(k) notification within 90 days of receiving the 510(k) notification. As a practical matter, clearance often takes longer, and clearance is never assured. Although many 510(k) premarket notifications are cleared without clinical data, the FDA may require further information, including clinical data, to make a determination regarding substantial equivalence, which may significantly prolong the review process. If the FDA agrees that the device is substantially equivalent, it will grant clearance to commercially market the device. If the FDA determines that the device is not “substantially equivalent” to a predicate device, or if the device is automatically classified into Class III, the device sponsor must then fulfill the much more rigorous, costly, and time-consuming PMA approval process or seek reclassification of the device through the De Novo process.

If a predicate device is not available, the FDA allows the submission of a direct De Novo petition. This procedure allows a manufacturer whose novel device is automatically classified into Class III to request down-classification of its medical device into Class I or Class II on the basis that the device presents low or moderate risk, rather than requiring the submission and approval of a PMA application. A De Novo request includes a description of the device, a discussion of the general controls and any specific controls recommended to provide reasonable assurance of the safety and effectiveness of the device, a description of the probable benefits of the device when compared to the probable risks when the device is used as intended, non-clinical data including bench performance and animal testing, technical information about the device, and clinical data (if applicable). The FDA’s goal is to review a De Novo request within 150 review days after receiving the petition. As with a 510(k) submission or PMA, the length of the review can be prolonged if the FDA requests additional information from the applicant.

To obtain a PMA, the applicant must submit data and information demonstrating reasonable assurance of the safety and effectiveness of the device for its intended use to the FDA’s satisfaction. Accordingly, a PMA typically includes, but is not limited to, extensive technical information regarding device design and development, pre-clinical and clinical trial data, manufacturing information, labeling, and financial disclosure information for the clinical investigators in device studies. The PMA application must provide valid scientific evidence that demonstrates to the FDA’s satisfaction a reasonable assurance of the safety and effectiveness of the device for its intended use.

Once filed as a PMA, the FDA has 180 days to review the filed PMA application, although the review of an application more often occurs over a significantly longer period of time. During this review period, the FDA may request additional information or clarification of information already provided, and the FDA may issue a major deficiency letter to the applicant, requesting the applicant’s response to deficiencies communicated by the FDA.

Prior to approval of a PMA, the FDA may conduct inspections of any clinical trial data and clinical trial sites, as well as inspections of any manufacturing facility and processes. The FDA can delay, limit or deny approval of a PMA application for many reasons, including (1) the device may not be shown safe or effective to the FDA’s satisfaction; (2) the data from pre-clinical studies and/or clinical trials may be found unreliable or insufficient to support approval; (3) the manufacturing process or facilities may not meet applicable requirements; and (4) changes in FDA approval policies or adoption of new regulations may require additional data.

If the FDA evaluation of a PMA is favorable, the FDA will issue either an approval letter, or an approvable letter, the latter of which usually contains a number of conditions that must be met in order to secure final approval of the PMA. When and if those conditions have been fulfilled to the satisfaction of the FDA, the agency will issue a PMA approval letter authorizing commercial marketing of the device, subject to the conditions of approval and the limitations established in the approval letter. The FDA also may determine that additional tests or clinical trials are necessary, in which case the PMA approval may be delayed for several months or years while the trials are conducted and data is submitted in an amendment to the PMA, or the PMA is withdrawn and resubmitted when data is available. The PMA process can be expensive, uncertain and lengthy. A number of devices for which the FDA approval has been sought by other companies have never been approved by the FDA for marketing. New PMA applications or PMA supplements are required for any modifications to the manufacturing process, equipment or facility, quality control procedures, sterilization, packaging, expiration date, labeling, device specifications, ingredients, materials or design of a device that has been approved through the PMA process.

As a condition of PMA approval, the FDA may also require some form of post-approval study or post-market surveillance, whereby the applicant conducts a follow-up study or follows certain patient groups for a number of years and makes periodic reports to the FDA on the clinical status of those patients when necessary to protect the public health or to provide additional or longer-term safety and

17

effectiveness data for the device. The FDA may also approve a PMA application with other post-approval conditions intended to ensure the safety and effectiveness of the device, such as, among other things, restrictions on labeling, promotion, sale, distribution and use.

The 510(k), De Novo or PMA processes can be expensive, lengthy and unpredictable. The FDA’s 510(k) clearance process usually takes from three to 12 months, but can last longer. The process of obtaining a PMA is much more costly and uncertain than the 510(k)-clearance process and generally takes from one to three years, or even longer, from the time the application is filed with the FDA. In addition, a PMA generally requires the performance of one or more clinical trials. Despite the time, effort and cost, a device may not be approved or cleared by the FDA. Any delay or failure to obtain necessary regulatory clearances or approvals could harm our business. Furthermore, even if we are granted regulatory clearances or approvals, they may include significant limitations on the indicated uses for the device, which may limit the market for the device.

Companion Diagnostics and the Premarket Process

We believe that several of our future product candidates may include a companion diagnostic (CDx), which is defined as an IVD that provides information that is essential for the safe and effective use of the therapeutic product. CDx’s can identify patients who are most likely to benefit from a particular therapeutic product, identify patients likely to be at increased risk for serious side effects as a result of treatment with a particular therapeutic product, or monitor response to treatment with a particular therapeutic product for the purpose of adjusting treatment to achieve improved safety or effectiveness.

A CDx is often developed and approved or cleared contemporaneously with the therapeutic, and the use of the CDx is stipulated in the labeling of both the CDx and the corresponding therapeutic product. CDx’s are generally regulated as Class III medical devices by the FDA and are therefore most often subject to the PMA approval process. While the FDA supports contemporaneous marketing authorizations, if there are any deficiencies in the submissions, the FDA may place a PMA review of a CDx on hold or request additional testing, which could potentially delay the approval of the corresponding new drug application or the marketing authorization of the CDx, or otherwise complicate the review process. The FDA may also require an application for the CDx to be separate from the drug approval process, and this could also potentially delay the approval of any new drug application or the CDx, or complicate the review process.

The FDA issued guidance in July 2016 for the co-development of CDx tests with a therapeutic product, which has remained in draft format. FDA issued and finalized a separate guidance in April 2020 specific to oncology CDx tests, “Developing and Labeling In vitro Companion Diagnostic Devices for a Specific Group of Oncology Therapeutic Products.” The guidance is meant to guide the development of CDx products in a way that results in labeling for a specific group of oncology therapeutic products, rather than a single therapeutic product.

Post-Market FDA Regulation

Even if regulatory clearance, authorization or approval of a device is granted, the FDA may impose limitations on the uses and indications for which the device may be labeled and promoted, and the device remains subject to significant regulatory requirements. Medical devices may be marketed only for the uses and indications for which they are cleared, authorized, or approved. After a device, including a device exempt from FDA premarket review, is placed on the market, numerous post-market regulatory requirements apply, and the FDA has broad authority to enforce these requirements. Medical device manufacturers are subject to unannounced inspections by the FDA and other state, local and foreign regulatory authorities to assess compliance with the QSR and other applicable regulations, and these inspections may include the manufacturing facilities of any suppliers. Failure to comply with applicable regulatory requirements can result in enforcement action by the FDA, which may include sanctions such as: warning letters, fines, injunctions, consent decrees and civil penalties; unanticipated expenditures, including requirements to repair, replace, and/or refund the cost of the devices, recall or seizure of our products; operating restrictions, partial suspension or total shutdown of production; the FDA’s refusal of our requests for 510(k) clearance, De Novo classification, or PMA of new products, new intended uses or modifications to existing products; the FDA’s refusal to issue certificates to foreign governments needed to export products for sale in other countries; and withdrawing 510(k) clearance or PMAs that have already been granted and criminal prosecution. In the event that a supplier fails to maintain compliance with the FDA’s or our quality requirements, we may have to qualify a new supplier and could experience manufacturing delays as a result.

Federal and State Fraud and Abuse Laws

We are subject to federal fraud and abuse laws such as the federal Anti-Kickback Statute (AKS), the federal prohibition against physician self-referral (Stark Law), the Eliminating Kickbacks in Recovery Act (EKRA), and the federal False Claims Act (FCA). We are also subject to similar state and foreign fraud and abuse laws.

The AKS (Social Security Act § 1128B(b)) prohibits knowingly and willfully offering, paying, soliciting, or receiving remuneration, directly or indirectly, overtly or covertly, in cash or in kind, in return for or to induce such person to refer an individual, or to purchase, lease, order, arrange for, or recommend purchasing, leasing or ordering, any item or service that may be reimbursable, in whole or in part, under a federal healthcare program, such as Medicare or Medicaid. There are a number of statutory exceptions and regulatory safe harbors to the AKS that provide protection from AKS liability to arrangements that fully satisfy the applicable requirements.

18

EKRA (18 USC § 220) prohibits knowingly and willfully soliciting, receiving, offering or paying remuneration, directly or indirectly, in return for the referral of a patient to, or in exchange for an individual using the services of certain entities, including laboratories, if the services are covered by a health care benefit program. The term “health care benefit program” is broadly defined such that EKRA extends to referrals reimbursed by both governmental and commercial third-party payers. EKRA includes a number of statutory exceptions that provide protection from EKRA liability if the applicable requirements are met.

The Stark Law (Social Security Act § 1877) generally prohibits, among other things, clinical laboratories and other so-called “designated health services” entities from billing Medicare for any designated health services when the physician ordering the service, or any member of such physician’s immediate family, has a financial relationship, such as a direct or indirect investment interest in or compensation arrangement with the billing entity, unless the arrangement meets an exception to the prohibition. The Stark Law also prohibits physicians from making such referrals to a designated health services entity. There are also similar state laws that apply where Medicaid and/or commercial payers are billed.

The FCA (31 USC § 3729) imposes penalties against individuals or entities for, among other things, knowingly presenting, or causing to be presented, claims for payment to the government that are false or fraudulent, or knowingly making, using or causing to be made or used a false record or statement material to such a false or fraudulent claim, or knowingly concealing or knowingly and improperly avoiding, decreasing, or concealing an obligation to pay money to the federal government. This statute also permits a private individual acting as a “qui tam” whistleblower to bring actions on behalf of the federal government alleging violations of the FCA and to share in any monetary recovery. FCA liability is potentially significant in the healthcare industry because the statute provides for treble damages and mandatory penalties per false claim or statement for penalties assessed.

Other federal statutes pertaining to healthcare fraud and abuse include the civil monetary penalties statute, which prohibits, among other things, the offer or payment of remuneration to a Medicaid or Medicare beneficiary that the offeror or payer knows or should know is likely to influence the beneficiary to order or receive a reimbursable item or service from a particular provider, practitioner, or supplier, and contracting with an individual or entity that the person knows or should know is excluded from participation in a federal health care program. In addition, federal criminal statutes created by the Health Insurance Portability and Accountability Act (HIPAA) prohibit, among other things, knowingly and willfully executing or attempting to execute a scheme to defraud any healthcare benefit program or obtain by means of false or fraudulent pretenses, representations or promises any money or property owned by or under the control of any healthcare benefit program in connection with the delivery of or payment for healthcare benefits, items or services.

In addition to these federal laws, there are often similar state anti-kickback and false claims laws that typically apply to arrangements involving reimbursement by a state-funded Medicaid or other health care program. Often, these laws closely follow the language of their federal law counterparts, although they do not always have the same exceptions or safe harbors. In some states, these anti-kickback laws apply with respect to all payers, including commercial payers.

A number of states have enacted laws that require pharmaceutical and medical device companies to monitor and report payments, gifts and other remuneration made to physicians and other healthcare providers, and, in some states, marketing expenditures. In addition, some state statutes impose outright bans on certain manufacturer gifts to physicians or other health care professionals. Some of these laws, referred to as “aggregate spend” or “gift” laws, carry substantial fines if they are violated.

Efforts to ensure that our business arrangements with third parties will comply with applicable healthcare laws and regulations will involve substantial costs and extensive annual trainings for all of our employees and contractors. If our operations are found to be in violation of any of these laws or any other governmental regulations that may apply to us, we may be subject to significant civil, criminal and administrative penalties, damages, fines, imprisonment, exclusion from participation in government-funded healthcare programs, such as Medicare and Medicaid, disgorgement, contractual damages, reputational harm, diminished profits and future earnings, additional reporting or oversight obligations if we become subject to a corporate integrity agreement or other agreement to resolve allegations of non-compliance with the law, and the curtailment or restructuring of our operations, any of which could adversely affect our ability to operate our business and our results of operations. If any of the physicians or other healthcare providers or entities with whom we do business is found to be not in compliance with applicable laws, they may be subject to criminal, civil or administrative sanctions, including exclusions from government-funded healthcare programs.

Anti-Corruption

The FCPA and similar international bribery laws make it unlawful for persons or entities to make payments to foreign government officials to assist in obtaining and maintaining business. Specifically, the anti-bribery provisions of the FCPA prohibit any offer, payment, promise to pay, or authorizing the payment of money or anything of value to any person, while knowing that all or a portion of such money or thing of value will be offered, given or promised, directly or indirectly, to a foreign official to do or omit to do an act in violation of his or her duty, or to secure any improper advantage in order to assist in obtaining or retaining business for or with, or directing business, to any person. In addition to the anti-bribery provisions of the FCPA, the statute also contains accounting requirements designed to operate in tandem with the anti-bribery provisions. Covered companies are required to make and keep books and records that accurately and fairly reflect the transactions of the company and devise and maintain an adequate system of internal accounting controls. With our international operations through our third-party partnerships, we could incur significant fines and penalties, as well as criminal liability, if we fail to comply with either the anti-bribery or accounting requirements of the FCPA, or

19

similar international bribery laws. Even an unsuccessful challenge of our compliance with these laws could cause us to incur adverse publicity and significant legal and related costs. We successfully passed our latest FCPA compliance review in 2023 with no findings.

Privacy and Data Protection Laws

Numerous federal and state laws and regulations, including HIPAA, as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act, govern the collection, dissemination, security, use and confidentiality of protected health information (PHI) and personal information. In the course of performing our business we obtain personal information, including PHI. Laws and regulations relating to privacy, data protection, and consumer protection are evolving and, in some cases, particularly with regard to newer laws, may be subject to potentially differing interpretations. Under HIPAA and HITECH, the Department of HHS issues regulations that establish uniform standards governing the conduct of certain electronic healthcare transactions and requirements for protecting the privacy and security of PHI, used or disclosed by covered entities (CEs) and their authorized business associates (BAs). Because we are a health care provider that electronically transmits health care information, we are a CE as defined by HIPAA. Our subcontractors that create, receive, maintain, transmit or otherwise process PHI on our behalf are HIPAA BAs and must also comply with HIPAA, as applicable.

HIPAA and HITECH include the privacy and security rules, breach notification requirements and electronic transaction standards. The privacy rule governs the use and disclosure of PHI, generally prohibits the use or disclosure of PHI except as permitted under the rule, and mandates certain safeguards to protect the privacy of PHI. The privacy rule also sets forth individual rights, such as the right to access or amend certain records containing such individual’s PHI, or to request restrictions on the use or disclosure of such individual’s PHI. The security rule requires CEs and BAs to safeguard the confidentiality, integrity, and availability of electronically transmitted or stored PHI (also referred to as ePHI) by implementing administrative, physical and technical safeguards. Under HIPAA’s breach notification rule, a CE must notify individuals, the Secretary of HHS, and in some circumstances, the media of certain breaches of unsecured PHI or ePHI, and similar breach notification provisions apply to certain BAs under the HITECH Act.

Penalties for failure to comply with a requirement of HIPAA and HITECH vary depending on the number and nature of the violations and any history of prior violations, but can be significant and include civil monetary or criminal penalties. HIPAA is enforced by the Department of Health and Human Services, Office for Civil Rights (HHS OCR), and HIPAA also authorizes state attorneys general to file suit on behalf of their residents for violations. Courts are able to award damages, costs and attorneys’ fees related to violations of HIPAA in such cases. While HIPAA does not create a private right of action allowing individuals to file suit in civil court for violations of HIPAA, its standards have been used as the basis for duty of care cases in state civil suits such as those for negligence or recklessness in improper use, access to or disclosure of PHI. In addition, HIPAA provides for HHS OCR to conduct periodic compliance audits of CEs and BAs for compliance with the HIPAA privacy and security standards and breach notification rules. It also tasks HHS with establishing a methodology whereby harmed individuals who were the victims of breaches of unsecured PHI may receive a percentage of the civil monetary penalty paid by the violator.

In addition, we may be subject to state privacy, cybersecurity, and data breach notification laws, which may govern the collection, use, disclosure and protection of health-related and other personal information. California, for example, has enacted the Confidentiality of Medical Information Act, which, in addition to HIPAA and HITECH, sets forth standards with which regulated California health care providers must abide. Colorado has enacted the Colorado Privacy Act, and Virginia has enacted the Consumer Data Protection Act, both of which also have standards that supplement Federal data protection requirements. State laws may be more stringent, broader in scope or offer greater individual rights with respect to PHI than HIPAA, and state laws may differ from each other in regards to personal information treatment, which may complicate compliance efforts. For instance, the California Consumer Privacy Act (CCPA), as amended by the passage of the California Privacy Rights Act (CPRA), among other things, gives California residents rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used by requiring covered companies to provide disclosures to California consumers (as that term is broadly defined) and provide such consumers ways to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. Although there are certain exemptions for PHI and clinical trial data, the CCPA’s implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future and the CCPA may increase our compliance costs and potential liability. Several other states have enacted privacy laws, several additional states have introduced privacy bills, and further law and regulations are under consideration at the federal level. If passed, such laws may have potentially conflicting requirements that could continue to make compliance challenging and costly.

Additionally, the Federal Trade Commission (FTC) and state attorneys general enforce consumer protection laws that prohibit unfair and deceptive acts and practices, including Section 5 of the FTC Act, which creates standards for the collection, use, dissemination and security of health-related and other personal information. Claims of unfair or deceptive trade practices regarding privacy and security can lead to significant liabilities and consequences, including regulatory investigations, penalties, fines and orders as well as civil claims, which could impact our data practices and operations or cause reputational damage.

We may also be subject to laws and regulations in foreign countries covering data privacy and other protection of health and employee information that may add additional compliance burden and complexity. For example, in the EEA, the collection and use of personal

20

data is governed by the European Union's General Data Protection Regulation (GDPR). In the United Kingdom, the GDPR has been adopted in substantially the same form, however the UK may potentially make revisions in the coming years. The GDPR, together with national legislation, regulations and guidelines of the EU member states and the United Kingdom governing the processing of personal data, impose strict obligations and restrictions on the ability to collect, analyze, store, transfer and otherwise process personal data. European and United Kingdom data protection authorities may interpret the GDPR and national laws differently and impose additional requirements, which adds to the complexity of processing personal data in or from the EEA or United Kingdom. Guidance on implementation and compliance practices is often updated or otherwise revised. GDPR applies extra-territorially under certain circumstances and imposes stringent requirements on controllers and processors of personal data, including, for example, requirements to ensure a legal bases to process personal information, provide robust disclosures to individuals, facilitate data subject rights, provide data security breach notifications within 72 hours after discovering a breach in certain circumstances, limit retention of personal information and apply enhanced protections to health data and other categories of sensitive personal information. The GDPR also has requirements around international transfers of personal data. Requirements around transfers to the United States and other jurisdictions have increased since a July 2020 decision by the Court of Justice of the European Union invalidated the Privacy Shield as a basis to transfer personal data from Europe to the United States, and added requirements for reliance on Standard Contractual Clauses. Regulatory guidance on requirements for international transfers, and other GDPR compliance matters, continues to evolve; for example, in July 2023, the European Commission completed adoption of a new adequacy decision for data flows to the United States. However, it is widely expected that the new adequacy decision will itself face scrutiny from the Court of Justice, underscoring that GDPR compliance is an ongoing endeavor. Failure to comply with the requirements of the GDPR may result in fines of up to €20 million or up to 4% of the total worldwide annual turnover of our preceding fiscal year, whichever is higher, and other administrative penalties. To comply with the GDPR and other applicable international data protection laws and regulations, we may be required to put in place additional mechanisms ensuring compliance, which may result in other substantial expenditures.

Cybersecurity

Our business relies on secure and continuous processing of information and the availability of our IT networks and IT resources, as well as critical IT vendors that support our technology, research and other data processing operations. While we take steps to protect our systems and data, security incidents, data breaches, computer malware and computer hacking attacks have become more prevalent across industries, including the life sciences sector, and may occur on our systems or those of our third-party service providers. Unauthorized persons may in the future be able to exploit weaknesses in the security systems of our (or our third-party service providers) IT networks and gain access to PHI and other personal information, sensitive trade secrets, or other proprietary information. Any wrongful use or disclosure of PHI, other personal information, trade secrets or other proprietary information by us or our third-party service providers could subject us to regulatory fines or penalties, third-party claims or otherwise could adversely affect our business and results of operations. Although HIPAA and the regulations promulgated thereunder do not provide for a private right of action, failures to adequately protect PHI or our IT systems could be viewed as violations of the HIPAA security rule or violations of other applicable information security laws, regulations, contractual obligations or industry standards, and could further result in costly data breach notification obligations that negatively impact our reputation.

Moreover, data cybersecurity incidents or data breaches, as well as attacks on our IT systems, could result in operational disruptions or data loss or corruption that could adversely impact our business and operations, resulting in substantial investment of resources to investigate, recover and remediate and subject us to heightened regulatory scrutiny. See