23 unchanged sentences
determine materiality as well as operational and business impact, and reviewed for privacy impact.
−Removed: As of the date of this Form 10-K,
−Removed: we have not experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations.
+Added: As of the date of this Annual Report
+Added: on Form 10-K, we have not experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or
also conduct exercises to simulate responses to cybersecurity incidents.
9 unchanged sentences
third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers.
+Added: In the third quarter of 2025, we engaged an external vendor to conduct penetration testing and manage the security posture of our public-facing website and application.
+Added: This added an extra layer of oversight to our external security environment, complementing the efforts
+Added: of our internal data security team.
+Added: It also supported our SOC 2 audit readiness and helped us maintain a strong overall security posture.
describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents,
12 unchanged sentences
recognized standards such as the ISO 27001 framework, healthcare regulatory guidelines under HIPAA and other recognized standards.
−Removed: Cybersecurity Governance
Cybersecurity
+Added: Cybersecurity
is an important part of our risk management processes and an area of focus for our Board of Directors and management.
7 unchanged sentences
security initiatives.
−Removed: Our cybersecurity
−Removed: risk management and strategy processes are overseen by our Vice President of IT Infrastructure and leaders from our Information
+Added: cybersecurity risk management and strategy processes are overseen by our Vice President of IT Infrastructure and leaders from our Information
Technology department.
−Removed: individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through
−Removed: their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the
−Removed: operation of our incident response plan, and report to the Cybersecurity subcommittee on any appropriate items.
+Added: These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity
+Added: incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above,
+Added: including the operation of our incident response plan, and report to the Cybersecurity subcommittee on any appropriate items.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.