What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-03-31 compared with 2025-03-27 · 147 added, 309 removed, 460 unchanged (50% of the section changed)

3 unchanged sentences

We began operations in April 2013.

Our accumulated retained earnings (deficit) were ($33.0 million)

and $4.6 million as of December 31, 2024 and 2023, respectively.

We do not have any way of predicting when or if we will achieve profitability

in the future.

Potential investors should be aware of the difficulties normally encountered by early commercial stage companies, many

of which are beyond our control, including substantial risks and expenses in the course of developing new diagnostic tests, obtaining

regulatory approval of clearance to commercialize such tests, establishing or entering new markets, organizing operations and marketing

The likelihood of our success must be considered in light of these risks, expenses, complications and delays, and the competitive

environment in which we operate.

There is, therefore, nothing at this time upon which to base an assumption that our business plan will

prove successful, and we may not be able to generate significant revenue, raise additional capital or operate profitably.

We will continue

to encounter risks and difficulties frequently experienced by early commercial stage companies, including scaling up our infrastructure

and headcount, and may encounter unforeseen expenses, difficulties or delays in connection with our growth.

In addition, as a result

of the start-up nature of our business, we expect to continue to sustain substantial operating expenses and may not be able to continue

generating sufficient revenues to cover expenditures.

Any investment in our company is therefore highly speculative and could result

in the loss of any investment.

Our accumulated deficit was $80.4 million and $33.5 million

as of December 31, 2025 and 2024, respectively.

We do not have any way of predicting when or if we will achieve profitability in the

Potential investors should be aware of the difficulties normally encountered by early commercial stage companies, many of which

are beyond our control, including substantial risks and expenses in the course of developing new diagnostic tests, obtaining regulatory

approval of clearance to commercialize such tests, establishing or entering new markets, organizing operations and marketing procedures.

The likelihood of our success must be considered in light of these risks, expenses, complications and delays, and the competitive environment

in which we operate.

There is, therefore, nothing at this time upon which to base an assumption that our business plan will prove successful,

and we may not be able to generate significant revenue, raise additional capital or operate profitably.

We will continue to encounter

risks and difficulties frequently experienced by early commercial stage companies, including scaling up our infrastructure and headcount,

and may encounter unforeseen expenses, difficulties or delays in connection with our growth.

In addition, as a result of the start-up

nature of our business, we expect to continue to sustain substantial operating expenses and may not be able to continue generating sufficient

revenues to cover expenditures.

Any investment in our company is therefore highly speculative and could result in the loss of any investment.

future success is dependent on our development of our Co-Dx PCR platform and securing regulatory approval for the platform including

115 unchanged sentences

currently have limited committed sources of capital, and we have limited liquidity.

Our cash, cash equivalents, and marketable investment

securities as of December 31, 2024 were $29.7 million.

We have entered into an Equity Distribution Agreement (the “ATM Agreement”)

with Piper Sandler & Co.

(“Piper Sandler”), pursuant to which we may offer and sell shares of our common stock having

an aggregate offering price of up to $17,111,650 from time to time through Piper Sandler acting as our agent, under our prospectus supplement

dated October 18, 2024.

As of December 31, 2024, we have sold 314,707 shares of common stock under the ATM Agreement resulting in net

proceeds to the Company of $0.2 million.

We will require substantial future capital in order to continue operating our business, conduct

the research and development and regulatory clearance and approval activities necessary to bring our products to market, and to establish

effective marketing and sales capabilities.

Our cash and cash equivalents as of December 31,

2025 were $11.9 million.

The Company previously maintained an Amended and Restated Equity Distribution Agreement (the “Prior ATM

Agreement”) with Piper Sandler & Co.

(“Piper Sandler”) and Clear Street, LLC (“Clear Street”), pursuant

to which the Company could offer and sell shares of its common stock having an aggregate offering price of up to $17,111,650 from time

to time through Piper Sandler and Clear Street, acting as sales agents, under a prospectus supplement dated October 18, 2024.

As of December

31, 2025, the Company had sold 151,675 shares of common stock under the Prior ATM Agreement, resulting in net proceeds to the Company

of approximately $1,660,805.

The Prior ATM Agreement was subsequently terminated, and no further sales will be made under that program.

October 20, 2025, the Company entered into a new Equity Distribution Agreement (the “Agreement”) with Maxim Group LLC (“Maxim”)

to establish an at-the-market (“ATM”) equity offering program.

Pursuant to the Agreement, the Company may offer and sell

shares of its common stock, par value $0.001 per share, having an aggregate offering price of up to $10.0 million, from time to time

through Maxim, acting as the Company’s sales agent.

Under the terms of the Agreement, the Company will pay Maxim a commission equal

to 3.0% of the gross proceeds from the sale of any shares and will reimburse Maxim for certain legal and other out-of-pocket expenses

incurred in connection with its services.

Sales of common stock, if any, may be made in transactions deemed to be “at-the-market”

offerings as defined in Rule 415 under the Securities Act of 1933, as amended, including sales made by means of ordinary brokers’

transactions on The Nasdaq Capital Market or otherwise at market prices prevailing at the time of sale or at prices negotiated with Maxim.

The Company is not obligated to sell any shares under the Agreement and may terminate the offering at any time in accordance with its

The shares will be issued pursuant to the Company’s shelf Registration Statement on Form S-3 (File No.

333-270628), which

was declared effective by the Securities and Exchange Commission on April 6, 2023.

On October 20, 2025, the Company filed a prospectus

supplement with the SEC relating to the new ATM program, registering up to approximately $4.1 million of shares under the shelf registration

As of December 31, 2025, the Company had sold 31,667 shares of common stock under the Agreement, resulting in net proceeds

to the Company of approximately $258,563.

adequate funds to develop our product candidates and fund operations are not available on a timely basis, we may terminate or delay the

41 unchanged sentences

During the COVID 19 pandemic

the FDA determined that circumstances exist to justify the authorization of emergency use of medical devices, including alternative products

used as medical devices, during the COVID-19 pandemic.

On April 3, 2020, we received an EUA from the FDA for our Logix Smart Coronavirus

Disease 2019 (COVID-19) kit for use on individuals who are suspected of COVID-19 by their healthcare provider.

the FDA determined that circumstances existed to justify the authorization of emergency use of medical devices, including alternative

products used as medical devices, during the COVID-19 pandemic.

On April 3, 2020, we received an EUA from the FDA for our Logix Smart

Coronavirus Disease 2019 (COVID-19) kit for use on individuals who are suspected of COVID-19 by their healthcare provider.

cannot predict how long the EUA for our COVID-19 test will remain in place.

13 unchanged sentences

financial condition and results of operations.

June 2024, we filed a 510(k) application with the FDA for our PCR platform which we withdrew in February 2025 as a result of discussions

with the FDA.

Our long-term success depends substantially on our ability to obtain regulatory clearance or approval and thereafter commercialize

our product candidates;

long-term success depends substantially on our ability to obtain regulatory clearance or approval and thereafter commercialize our product

we cannot be certain that we will be able to do so in a timely manner or at all.

June 2024, we filed a 510(k) application with the FDA for our PCR platform which we withdrew in February 2025 as a result of discussions

with the FDA.

The process of obtaining regulatory clearances or approvals to market a medical diagnostic from the FDA or similar regulatory

authorities outside of the United States can be costly and time consuming, and there can be no assurance that such clearances or approvals

will be granted on a timely basis, or at all.

The FDA’s 510(k) clearance process generally takes one to six months from the date

of submission, depending on whether a special or traditional 510(k) premarket notification has been submitted, but can take significantly

An application for premarket approval, or PMA, must be submitted to the FDA if the device cannot be cleared through the 510(k)

clearance process or is not exempt from premarket review by the FDA.

The PMA process almost always requires one or more clinical trials

and can take two to three years from the date of filing, or even longer.

process of obtaining regulatory clearances or approvals to market a medical diagnostic from the FDA or similar regulatory authorities

outside of the United States can be costly and time consuming, and there can be no assurance that such clearances or approvals will be

granted on a timely basis, or at all.

The FDA’s 510(k) clearance process generally takes one to six months from the date of submission,

depending on whether a special or traditional 510(k) premarket notification has been submitted, but can take significantly longer.

application for premarket approval, or PMA, must be submitted to the FDA if the device cannot be cleared through the 510(k) clearance

process or is not exempt from premarket review by the FDA.

The PMA process almost always requires one or more clinical trials and can

take two to three years from the date of filing, or even longer.

we are required to obtain approval of any of our products through the PMA process, the costs associated with such a process will be significant,

66 unchanged sentences

sanctions, including exclusions from participation in government healthcare programs, which could also materially affect our business.

are subject to stringent and changing data protection laws, privacy policies and data protection obligations, which continue to evolve

and change over time.

The actual or perceived failure by us or our third-party service providers or vendors to comply with such obligations

could harm our reputation, subject us to significant fines and liability, or otherwise adversely affect our business.

are subject to numerous data protection laws that govern the processing of individually identifiable information and health information

and other sensitive and personal information in the jurisdictions in which we operate.

In many instances, these data protection laws,

regulations and standards apply not only to disclosures to third parties, but also to transfers of information between or among us and

other parties with which we have commercial relationships.

The regulatory framework for data privacy, data security and data transfers

worldwide is rapidly evolving and, as a result, interpretation and implementation standards and enforcement practices are likely to remain

uncertain for the foreseeable future.

These data protection laws may be interpreted and applied differently over time and from jurisdiction

to jurisdiction, and it is possible that they will be interpreted and applied in ways that will materially and adversely affect our business,

financial condition and results of operations.

Failure to comply with any of these data protection laws could result in enforcement actions

against us, including fines, imprisonment of company officials and public censure, claims for damages by affected individuals, damage

to our reputation and loss of goodwill, any of which could have a material adverse effect on our business.

are numerous U.S.

federal and state laws and regulations related to the privacy and security of personal information.

These laws and

regulations include the Health Insurance Portability and Accountability Act of 1996, or HIPAA, as amended by the Health Information Technology

for Economic and Clinical Health Act of 2009, or HITECH, and their implementing regulations, or collectively referred to as the HIPAA

Rules, which establish a set of national privacy and security standards to safeguard Protected Health Information, or PHI, by health

plans, healthcare clearinghouses and certain healthcare providers, referred to as covered entities, and the business associates and their

subcontractors with whom such covered entities contract for services that involve the creation, receipt, maintenance or transmission

of PHI for or on behalf of a covered entity or another business associate.

HIPAA requires covered entities and business associates to,

among other things, develop and maintain policies and procedures with respect to PHI that is used or disclosed, including the adoption

of administrative, physical and technical safeguards to protect such information and ensure the confidentiality, integrity and availability

of electronic PHI.

As this applies to our business, we are required to maintain security standards for any PHI that we create, receive,

maintain or transmit.

For example, we plan to offer cloud-based portal software to help our customers more efficiently use our products.

The software will maintain security safeguards that are designed to be consistent with the HIPAA Rules, but we cannot guarantee that

these safeguards will not fail or that they will not be deemed inadequate in the future.

In addition, we could be subject to periodic

audits for compliance with the HIPAA Privacy and Security Standards by the U.S.

HHS, and our customers.

HHS Office for Civil

Rights may impose significant penalties on entities subject to HIPAA for a failure to comply with a requirement of the HIPAA Rules.

we are unable to properly protect the privacy and security of the PHI of our customers, we could be found to have breached our contracts.

Determining whether PHI has been handled in compliance with applicable privacy standards and our contractual obligations can be complex

and we cannot be sure how these regulations will be interpreted, enforced or applied to our operations.

addition, many states in which we operate have laws that protect the privacy and security of sensitive and personal information, including

health-related information.

Certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect

to sensitive and personal information than federal, international or other state laws, and such laws may differ from each other, which

may complicate compliance efforts.

regulations and standards in many other jurisdictions also apply broadly to the Processing of personal information, which impose significant

compliance obligations.

Complying with these numerous, complex and often changing regulations is expensive and difficult, and failure

to comply with any Data Protection Laws or any security incident or breach involving the misappropriation, loss or other unauthorized

use or disclosure of sensitive or confidential information, whether by us, one of our service providers or another third party, could

negatively affect our business, financial condition and results of operations, including but not limited to:

investigation costs, material

fines and penalties;

compensatory, special, punitive and statutory damages;

consent orders regarding our privacy and security

requirements that we provide notices, credit monitoring services or credit restoration services or other relevant services

to impacted individuals;

adverse actions against our licenses to do business;

and injunctive relief.

statutory requirements, both in the United States and abroad, include obligations for companies to notify individuals of security breaches

involving certain personal information, which could result from breaches experienced by us or our third-party service providers.

example, laws in all 50 U.S.

states and the District of Columbia require businesses to provide notice to consumers whose unencrypted

personal information has been disclosed as a result of a data breach.

These laws are not consistent, and compliance in the event of a

widespread data breach is difficult and may be costly.

Moreover, states have been frequently amending existing laws, requiring attention

to changing regulatory requirements.

We also may be contractually required to notify affected customers, regulators, credit reporting

agencies or other affected individuals of a security breach.

Such notifications are costly, and the disclosures or the failure to comply

with such requirements, could lead to material adverse effects, including without limitation, negative publicity, a loss of customer

confidence in our services or security measures or breach of contract claims.

There can be no assurance that the limitations of liability

in our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages if we fail to comply with

applicable Data Protection Laws, Data Protection Obligations or other legal obligations.

In addition, although we may have contractual

protections with our third-party service providers, contractors and consultants, any actual or perceived security breach by our subcontractors

could harm our reputation and brand, expose us to potential liability or require us to expend significant resources on data security

and in responding to any such actual or perceived breach.

Any contractual protections we may have from our third-party service providers,

contractors or consultants may not be sufficient to adequately protect us from any such liabilities and losses, and we may be unable

to enforce any such contractual protections.

expect that there will continue to be new proposed laws and regulations concerning data privacy and security, and we cannot yet determine

the impact such future laws, regulations and standards may have on our business.

New laws, amendments to or re-interpretations of existing

laws, regulations, standards and other obligations may require us to incur additional costs and restrict our business operations.

the interpretation and application of health-related and Data Protection Laws and other obligations are still uncertain, and often contradictory

and in flux, it is possible that the scope and requirements of these laws may be interpreted and applied in a manner that is inconsistent

with our practices and our efforts to comply with the evolving data protection rules may be unsuccessful.

If so, this could result in

government-imposed fines or orders requiring that we change our practices, which could adversely affect our business.

cannot assure you that our third-party partners and service providers with access to our or our customers’, suppliers’ and

employees’ personally identifiable and other sensitive or confidential information in relation to which we are responsible will

not breach contractual obligations imposed by us or violate Data Protection Laws, or that they will not experience security breaches

or attempts thereof, which could have a corresponding effect on our business, including putting us in breach of our obligations under

the Data Protection Laws, which could in turn adversely affect our business, results of operations and financial condition.

assure you that our contractual measures and our own privacy- and security-related safeguards will protect us from the risks associated

with the third-party processing, storage and transmission of such information.

may receive inquiries or be subject to investigations, proceedings or actions, by various government entities regarding our privacy and

information security practices and Processing (“Regulatory Proceedings”).

These Regulatory Proceedings could result in a

material adverse effect, including without limitation, interruptions of, or required changes to, our business practices, the diversion

resources and the attention of management from our business, regulatory oversights and audits, discontinuance of necessary Processing,

or other remedies that adversely affect our business.

addition to the possibility of fines, lawsuits, regulatory investigations, public censure, other claims and penalties, and significant

costs for remediation and damage to our reputation, we could be materially and adversely affected if legislation or regulations are expanded

to require changes in our data processing practices and policies or if governing jurisdictions interpret or implement their legislation

or regulations in ways that negatively impact our business.

Complying with these various laws could cause us to incur substantial costs

or require us to change our business practices and compliance procedures in a manner adverse to our business.

Any inability to adequately

address data privacy or security-related concerns, even if unfounded, or to comply with applicable laws, regulations, standards and other

obligations relating to data privacy and security, could result in additional cost and liability to us, harm our reputation and brand,

damage our relationships with customers and have a material and adverse impact on our business.

we maintain general liability insurance coverage, cyber insurance coverage and other insurance, we cannot assure that such coverage will

be adequate or otherwise protect us from or adequately mitigate liabilities or damages with respect to claims, costs, expenses, litigation,

fines, penalties, business loss, data loss, regulatory actions or material adverse effects arising out of our privacy and security practices,

Processing or security breaches we may experience, or that such coverage will continue to be available on acceptable terms or at all.

The successful assertion of one or more large claims against us that exceeds our available insurance coverage, or results in changes

to our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements), could have

an adverse effect on our business.

In addition, we cannot be sure that our existing insurance coverage will continue to be available

on acceptable terms or that our insurers will not deny coverage as to any future claim.

may incur substantial costs in our efforts to comply with evolving global data protection laws and regulations, and any failure or perceived

failure by us to comply with such laws and regulations may harm our business and operations.

global data protection landscape is rapidly evolving, and we may be or become subject to or affected by numerous federal, state and foreign

laws and regulations, as well as regulatory guidance, governing the collection, use, disclosure, transfer, security and processing of

personal data, such as information that we collect about subjects and health care providers in connection with clinical trials.

Implementation

standards and enforcement practices are likely to remain uncertain for the foreseeable future, which may create uncertainty in our business;

affect our or our service providers’ ability to operate in certain jurisdictions or to collect, store, transfer use and share personal

result in liability;

or impose additional compliance or other costs on us.

Any failure or perceived failure by us to comply with

federal, state, or foreign laws or self-regulatory standards could result in negative publicity, diversion of management time and effort

and proceedings against us by governmental entities or others.

the United States, numerous federal and state laws and regulations, including federal health information privacy laws (e.g., the Health

Insurance Portability and Accountability Act, as amended by the Health Information Technology for Economic and Clinical Health Act, or

collectively HIPAA), state data breach notification laws, state health information privacy laws, and federal and state consumer protection

laws (e.g., Section 5 of the Federal Trade Commission Act), that govern the collection, use, disclosure and protection of health-related

and other personal information could apply to our operations or the operations of our collaborators.

In addition, we may obtain health

information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy

and security requirements under HIPAA or other privacy and data security laws.

Depending on the facts and circumstances, we could be

subject to criminal penalties if we knowingly obtain, use, or disclose protected health information maintained by a HIPAA-covered entity

in a manner that is not authorized or permitted by HIPAA.

However, determining whether protected health information has been handled

in compliance with applicable privacy standards and our contractual obligations can be complex and may be subject to changing interpretation.

we are unable to properly protect the privacy and security of protected health information or other personal, sensitive, or confidential

information in our possession, we could be found to have breached our contracts.

Further, if we fail to comply with applicable privacy

laws, including applicable HIPAA privacy and security standards, we could face significant administrative, civil and criminal penalties.

Enforcement activity can also result in financial liability and reputational harm, and responses to such enforcement activity can consume

significant internal and outside resources.

Furthermore, state attorneys general are authorized to bring civil actions seeking either

injunctions or damages in response to violations that threaten the privacy of state residents.

In addition, our ongoing efforts to comply

with evolving laws and regulations at the federal and state level may be costly and require continuous modifications to our compliance

policies, procedures, and systems.

state laws govern the privacy and security of personal information and data in specified circumstances, many of which differ from each

other in significant ways, are often not pre-empted by HIPAA, and may have a more prohibitive effect than HIPAA, thus complicating compliance

For example, the California Consumer Privacy Act of 2018 (the “CCPA”), which went into effect in January 2020 and

provides new data privacy rights for consumers and new operational requirements for companies, which may increase our compliance costs

and potential liability.

The CCPA gives California residents expanded rights to access and delete their personal information, opt out

of certain personal information sharing, and receive detailed information about how their personal information is used.

The CCPA provides

for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation.

While there is currently an exception for protected health information that is subject to HIPAA and clinical trial regulations, as currently

written, the CCPA may impact certain of our business activities.

In addition, the California Consumer Rights Act, or CPRA, was recently

enacted to strengthen elements of the CCPA and became effective on January 1, 2023.

The CPRA imposes additional data protection obligations

on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk

data, and opt outs for certain uses of sensitive data and expands the application of the CCPA to all human resources personal information

of California-based employees.

In addition, the CPRA created a new California data protection agency authorized to issue substantive

regulations and is expected to result in increased privacy and information security enforcement.

A number of other states have considered

similar privacy proposals, and states have recently enacted their own privacy laws.

For example, the Virginia Consumer Data Protection

Act became effective on January 1, 2023, and Colorado and Utah enacted similar laws that became effective in 2023, increasing the complexity

of compliance and the risk of failures to comply.

These privacy laws may impact our business activities and exemplify the vulnerability

of our business to the evolving regulatory environment related to personal data.

addition to our operations in the United States, which may be subject to health care and other laws relating to the privacy and security

of health information and other personal information, we may be or become subject to European data privacy laws, regulations and guidelines.

The General Data Protection Regulation, (EU) 2016/679 (“GDPR”) became effective on May 25, 2018, and deals with the collection,

use, storage, disclosure, transfer, or other processing of personal data, including personal health data, regarding individuals in the

The GDPR imposes a broad range of strict requirements on companies subject to the GDPR, including requirements relating to having

legal bases for processing personal information relating to identifiable individuals and transferring such information outside the EEA,

including to the United States, providing details to those individuals regarding the processing of their personal health and other sensitive

data, obtaining consent of the individuals to whom the personal data relates, keeping personal information secure, having data processing

agreements with third parties who process personal information, responding to individuals’ requests to exercise their rights in

respect of their personal information, reporting security breaches involving personal data to the competent national data protection

authority and affected individuals, appointing data protection officers, conducting data protection impact assessments, and record-keeping.

The GDPR increases substantially the penalties to which we could be subject in the event of any non-compliance, including fines of up

to €10,000,000 or up to 2% of our total worldwide annual turnover for certain comparatively minor offenses, or up to €20,000,000

or up to 4% of our total worldwide annual turnover, whichever is greater, for more serious offenses.

The GDPR also confers a private

right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies,

and obtain compensation for damages resulting from violations of the GDPR.

In addition, the GDPR includes restrictions on cross-border

data transfers.

the United Kingdom’s withdrawal from the European Union (i.e., Brexit), and the expiry of the Brexit transition period, which ended

on December 31, 2020, the EU GDPR has been implemented in the United Kingdom (as the UK GDPR).

The UK GDPR sits alongside the UK Data

Protection Act 2018 which implements certain derogations in the EU GDPR into UK law.

Under the UK GDPR, companies not established in

the UK but who process personal data in relation to the offering of goods or services to individuals in the UK, or to monitor their behavior

will be subject to the UK GDPR – the requirements of which are (at this time) largely aligned with those under the EU GDPR and

as such, may lead to similar compliance and operational costs with potential fines of up to £17.5 million or 4% of global turnover.

In 2022, the government of the United Kingdom proposed and debated the Data Protection and Digital Information Bill to harmonize the

2018 Data Protection Act, UK GDPR, and the Privacy and Electronic Communications Regulations under one legislative framework.

progress on the bill stalled as the government continues to assess the most optimal approach to data protection reform.

currently sell some of our products in the EEA, and the GDPR increases our responsibility and liability in relation to personal data

that we process where such processing is subject to the GDPR, and we are required to have in place additional mechanisms and safeguards

to ensure compliance with the GDPR, including as implemented by individual countries.

Compliance with the GDPR is a rigorous and time-intensive

process that increase our cost of doing business or require us to change our business practices, and despite those efforts, there is

a risk that we may be subject to fines and penalties, litigation, and reputational harm in connection with our European activities.

expect that we will continue to face uncertainty as to whether our efforts to comply with any obligations under European privacy laws

will be sufficient.

If we are investigated by a European data protection authority, we may face fines and other penalties.

Any such investigation

or charges by European data protection authorities could have a negative effect on our existing business and on our ability to attract

and retain new clients or partners.

are subject to numerous and evolving data protection, privacy and information security laws in the jurisdictions in which we operate.

These laws govern the collection, use, disclosure, transfer and safeguarding of personal information, including health-related information.

The regulatory framework for data privacy and data security is rapidly evolving, and interpretation and enforcement practices remain

New or amended laws, or differing interpretations of existing laws, may require us to incur additional compliance costs, modify

our business practices or restrict certain operations.

the United States, we may be subject to the Health Insurance Portability and Accountability Act of 1996, as amended by HITECH (collectively,

“HIPAA”), to the extent we act as a covered entity or business associate.

HIPAA establishes privacy and security standards

for the protection of protected health information and authorizes significant civil and criminal penalties for noncompliance.

states and the District of Columbia have enacted breach notification laws, and many states have adopted broader privacy and

data security requirements that may impose additional obligations and liabilities.

may also be subject to international data protection laws, including those in the European Union and other jurisdictions, which impose

stringent requirements on the processing and transfer of personal information and authorize significant fines for violations.

failure or perceived failure by us, our employees, or our third-party service providers to comply with applicable data protection laws

or to adequately safeguard personal information could result in regulatory investigations or enforcement actions, fines, litigation,

contractual liability, mandatory notifications, reputational harm and loss of customer confidence.

We rely on third-party vendors to

process and store certain data, and any security breach or noncompliance by such vendors could adversely affect us, even if we are not

directly at fault.

maintain general liability and cyber insurance coverage;

however, such coverage may not be adequate to cover all liabilities or may not

be available on acceptable terms in the future.

Any significant data security incident, regulatory proceeding or enforcement action could

materially and adversely affect our business, financial condition and results of operations.

are subject to evolving global data protection and privacy laws, and compliance with such laws may be costly and may expose us to liability.

collect and process personal information in connection with our operations, including clinical research activities and interactions with

healthcare providers.

As a result, we may be subject to various U.S.

federal and state laws governing the privacy and security of personal

information, including, where applicable, the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”),

state breach notification laws, and state consumer privacy laws such as the California Consumer Privacy Act, as amended by the California

Consumer Rights Act.

These laws impose requirements relating to the collection, use, disclosure and safeguarding of personal information

and may provide for significant civil penalties and, in some cases, private rights of action.

may also be subject to international data protection laws, including the European Union General Data Protection Regulation (“GDPR”)

and the United Kingdom GDPR, which impose strict requirements regarding the processing and transfer of personal data and authorize substantial

fines for non-compliance.

data protection regulatory environment is rapidly evolving, and new or amended laws, differing interpretations, and increased enforcement

activity may require us to incur additional compliance costs, implement new safeguards, or change our business practices.

perceived failure to comply with applicable privacy and data protection laws, or any data security incident involving personal information,

whether by us or our third-party service providers, could result in regulatory investigations, fines, litigation, contractual liability,

reputational harm and loss of customer confidence, any of which could materially and adversely affect our business, financial condition

and results of operations.

Related to Our Intellectual Property

209 unchanged sentences

capitalization, and maintaining a minimum bid price of $1.00 per share.

January 10, 2025, we received a notice from the Listing Qualifications Department of The NASDAQ Stock Market (the “Staff”)

stating that the bid price of our common stock for the previous 30 consecutive trading days had closed below the minimum $1.00 per share

required for continued listing on The NASDAQ Capital Market under NASDAQ Listing Rule 5550(a)(2).

The Company has a period of 180 calendar

days, or until July 9, 2025 (the “Compliance Date”) to regain compliance with Listing Rule 5550(a)(2).

To regain compliance,

the bid price of the Company’s common stock must close at $1 or more for a minimum of ten consecutive business days before the

Compliance Date.

the Company does not regain compliance with Rule 5550(a)(2) by July 9, 2025, the Company may be eligible for additional time.

the Company will be required to meet the continued listing requirement for market value of publicly held shares and all other initial

listing standards for The Nasdaq Capital Market, with the exception of the bid price requirement, and will need to provide written notice

As previously disclosed, on January 10, 2025, the

Company received a notice from the Listing Qualifications Department of The NASDAQ Stock Market (the “Staff”) stating that

the bid price of the Company’s common stock for the previous 30 consecutive trading days had closed below the minimum $1.00 per

share required for continued listing on The NASDAQ Capital Market under NASDAQ Listing Rule 5550(a)(2).

The Company had an initial period

of 180 calendar days to regain compliance with Listing Rule 5550(a)(2).

To regain compliance, the bid price of the Company’s common

stock must close at $1 or more for a minimum of ten consecutive business days before July 9, 2025.

On July 10, 2025, the Company received notification

from the Staff indicating that the Company would have an additional 180-day grace period, until January 5, 2026, to regain compliance

with NASDAQ’s $1.00 minimum bid requirement.

The notification indicated that the Company did not regain compliance during the initial

180-day grace period provided under the rule.

In accordance with NASDAQ Marketplace Rule 5810(c)(3)(A), the Company was eligible for

the additional grace period because it met the continued listing requirement for market value of publicly held shares and all other applicable

requirements for initial listing on the Nasdaq Capital Market with the exception of the bid price requirement, and provided written notice

of its intention to cure the deficiency during the second compliance period by effecting a reverse stock split, if necessary.

Company meets these requirements, the Staff will inform the Company that it has been granted an additional 180 calendar days.

if it appears to the Staff that the Company will not be able to cure the deficiency, or if the Company is otherwise not eligible, the

Staff will provide notice that its securities will be subject to delisting.

We intend to actively monitor our bid price and will consider

available options to resolve the deficiency and regain compliance with the Nasdaq Listing Rules.

Nasdaq delists our common stock from trading on its exchange and we are not able to list our securities on another national securities

exchange, we expect our securities could be quoted on an over-the-counter market.

If this were to occur, we could face significant material

adverse consequences, including:

limited availability of market quotations for our securities;

liquidity for our securities;

determination that our common stock is a “penny stock” which will require brokers trading in our common stock to adhere

to more stringent rules and possibly result in a reduced level of trading activity in the secondary trading market for our securities;

limited amount of news and analyst coverage;

decreased ability to issue additional securities or obtain additional financing in the future.

In order to regain compliance with the $1.00 minimum

bid price requirement, on January 1, 2026 we effected a 1-for-30 reverse stock split (the “Reverse Stock Split”).

Stock Split reduced the number of shares of common stock outstanding from approximately 62.9 million shares to approximately 2.1 million

On January 7, 2026, the Company received written notice from the Staff indicating that the Staff had determined to delist the

Company’s common stock from The Nasdaq Capital Market due to the Company’s continued non-compliance with the minimum bid

price requirement set forth in Nasdaq Listing Rule 5550(a)(2).

The Company subsequently requested a hearing before the Nasdaq Hearings

Panel to address the bid price deficiency;

however, the Company’s securities were suspended from trading on The Nasdaq Capital

Market effective at the open of trading on January 14, 2026, in accordance with Nasdaq Listing Rule 5815(a)(1)(B)(ii)(d).

On February 12, 2026, the Company participated in

a hearing with the Nasdaq Hearings Panel.

On March 9, 2026, the Company was formally notified by Nasdaq that it had demonstrated compliance

with the $1.00 bid price requirement set forth in Nasdaq Listing Rule 5550(a)(2) and all other applicable criteria for continued listing

on The Nasdaq Capital Market.

Accordingly, the Company’s securities resumed trading on Nasdaq effective with the open of the market

on March 11, 2026, and the previously disclosed listing matter before the Nasdaq Hearing Panel was closed.

The Nasdaq Hearings Panel imposed a Discretionary

Panel Monitor for a period of one year, through March 9, 2027.

If, during the monitoring period, the Company’s closing bid price

falls below $1.00 per share for 30 consecutive business days, the Company will not be eligible for a 180-day compliance period otherwise

available under the Nasdaq Listing Rules.

Rather, Nasdaq would issue a delist determination, which the Company could then appeal by requesting

a hearing before the Panel.

Such request would stay any further action by Nasdaq pending the conclusion of the hearing process.

we have regained compliance with Nasdaq’s continued listing requirements, there can be no assurance that we will maintain compliance

with all applicable listing standards in the future.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors