Item 1B. Unresolved Staff Comments
Item
1B. Unresolved Staff Comments
None.
Item
1C. Cybersecurity
We
recognize the critical importance of maintaining the trust and confidence of business partners and employees, toward
our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems.
The Company proactively manages its cybersecurity and data privacy risks with organizational and technical controls including a
comprehensive set of policies and procedures for assessing, identifying, and managing material risks from cybersecurity threats
which have been integrated into the Company’s overall risk management strategy and processes. The Company seeks to address
cybersecurity risks through a comprehensive approach that is focused on implementing robust protective measures, promoting user
awareness and education, continuously monitoring for potential threats, and swiftly responding to any security incidents to ensure
the confidentiality, integrity, and availability of sensitive information.
Our
board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element
of our overall approach to risk management. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional
approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by
identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.
In
addition, we actively engage with key vendors and industry communities as part of our continuing efforts to evaluate and enhance the
effectiveness of our information security policies and procedures and have processes in place to oversee and identify the risk of cybersecurity
threats associated with our use of these third-party vendors. We generally require third parties to, among other things, maintain security
controls to protect our confidential information and data, and notify us of material cybersecurity threats that may impact our business.
In
2025, we did not identify any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially
affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial
condition.
Cybersecurity
Risk Management and Strategy; Effect of Risk
We
face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated
by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential
information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure
our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring
for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity
threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including
regular network and endpoint monitoring, audits, vulnerability assessments, and penetration testing to inform our risk identification
and assessment. As discussed in more detail under “Cybersecurity Governance” below, our audit committee provides oversight
of our cybersecurity risk management and strategy processes, which are led by our Chief Executive Officer.
To
provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity
threats, and protect against and respond to cybersecurity incidents, we undertake the following activities:
●
monitor
emerging data protection laws and implement changes to our processes that are designed to comply with such laws;
●
through
our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf,
to treat confidential information and data with care;
●
employ
technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion
prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability
assessments and cybersecurity threat intelligence;
●
provide
regular training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity
threats, and to communicate our evolving information security policies, standards, processes and practices;
●
leverage
the National Cyber Security Centre incident handling framework to help us identify, protect, detect, respond and recover when there
is an actual or potential cybersecurity incident; and
●
carry
information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.
45
Table of Contents
Our
response to an incident involves the coordination of activities to detect, respond to and recover from cybersecurity incidents, which
include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with
potentially applicable legal obligations and mitigate damage to our business and reputation.
As
part of the above processes, we regularly engage with consultants, auditors and other third parties, including having a third-party independent
qualified and accredited advisor review our cybersecurity program to help identify areas for continued focus, improvement and compliance.
Our
processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and
manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection
and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities
that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally,
we would require those third parties, although there are currently none, that could introduce significant cybersecurity risk to us to
agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we
conduct as appropriate.
We
describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents,
have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or
financial condition, under the risk factor heading “ Security incidents, loss of data and other disruptions could compromise
sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could
adversely affect our business and our reputation. Our business and operations would suffer in the event of system failures ”
which disclosures are incorporated by reference herein.
We
have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial.
Cybersecurity
Governance; Management
Cybersecurity
is an important part of our risk management processes and an area of focus for our board of directors and management. The audit committee
of our board of directors is responsible for the oversight of risks from cybersecurity threats.
At
least annually, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes.
In such sessions, our audit committee generally receives materials that include a cybersecurity dashboard and other materials discussing
current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments,
evolving standards, technological developments and information security considerations arising with respect to our peers and third parties.
Our audit committee also receives prompt and timely information regarding any cybersecurity incident that meets establishing reporting
thresholds, as well as ongoing updates regarding any such incident until it has been addressed. To date, we have not experienced any
cyber security incident.
46
Table of Contents
Members
of our audit committee are also encouraged to regularly engage in conversations with management on cybersecurity-related news events
and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered
during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity
planning, mergers and acquisitions, brand management, and other relevant matters.
Our
cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Executive Officer.
The management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents
through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including
the operation of our incident response plan. As discussed above, the management team members report to the audit committee of our board
of directors about cybersecurity threat risks, among other cybersecurity related matters, periodically.