7 unchanged sentences
We have implemented a comprehensive set of processes for assessing, identifying, and managing material risks from cybersecurity threats.
−Removed: We conduct continuous vulnerability scanning and periodic penetration tests to evaluate risks in key infrastructure and applications as part of ongoing cybersecurity management and in accordance with required regulatory practices.
+Added: We conduct continuous vulnerability scanning and periodic penetration tests to evaluate risks in key
+Added: infrastructure and applications as part of ongoing cybersecurity management and in accordance with required regulatory practices.
Any observations are ranked by severity and prioritized for response and remediation.
12 unchanged sentences
While we have not experienced any material cybersecurity threats or incidents in recent years, there can be no guarantee that we will not be the subject of future threats or incidents.
+Added: Like other companies, we are subject to cybersecurity threats and nonmaterial cybersecurity incidents from time to time.
+Added: For example, in early February 2026, we identified a cybersecurity incident (the “Incident”) in which an unauthorized third party gained access to certain of our systems by means of a social engineering attack on two employees.
+Added: In response to the Incident, we promptly initiated our cybersecurity response plans and took steps to assess, contain, and remediate the unauthorized activity, including isolating the affected systems, launching an investigation with the assistance of external cybersecurity advisors, and coordinating with law enforcement.
+Added: As of the date of this Annual Report on Form 10-K, we have confirmed that our customer service software platform was accessed and certain customer information was obtained.
+Added: We have further confirmed that the vast majority of customer information accessed was limited to personally identifiable information (PII), specifically, names and email addresses, and less frequently phone numbers and physical addresses.
+Added: Additionally, for customers who contacted customer service between mid-February 2025 and early February 2026 through our online customer service platform, the unauthorized third party may have gained access to customer data regarding category of treatment and other information included in their communications with customer service.
+Added: Our electronic medical record was not accessed.
+Added: When our investigation is complete, we will make required regulatory and individual notifications on a rolling basis.
+Added: Our investigation into the Incident is ongoing, and we are still in the process of gathering details regarding the scope of information involved.
+Added: While our investigation and assessment of the Incident is ongoing, as of the date of this Annual Report on Form 10-K, we do not believe the Incident is reasonably likely to materially impact our financial condition or results of operations.
+Added: However, if new or additional information were to come to light as the investigation progresses, the impact of the incident could prove to be material to our business, financial condition, results of operations, or cash flows.
For a discussion of whether and how any risk from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, see Part I, Item 1A:
1 unchanged sentence
Our Board of Directors maintains overall oversight of our risk management.
−Removed: The Audit Committee is specifically tasked with reviewing cybersecurity and other information technology risks, controls, and procedures, including our plans to mitigate cybersecurity risks and to respond to data breaches.
−Removed: The Audit Committee also reviews with management any specific cybersecurity issues that could affect the adequacy of our internal controls.
−Removed: Our Head of Information Security reports to the Audit Committee on a quarterly basis on any relevant cybersecurity issues or risks, related controls, procedures and programming, material cybersecurity and data privacy incidents (if any), as well as any material updates to our cybersecurity risk management and strategy, broader cybersecurity trends, and relevant educational information.
−Removed: We employ a cybersecurity team of seasoned professionals with direct experience in securing both large and small enterprises.
−Removed: The team is led by our Head of Information Security , who reports to the Chief Operating Officer (COO) .
−Removed: The Head of Information Security has nearly 20 years of experience in various technology leadership roles.
−Removed: Of these, the last 10 years have specifically focused on building, managing, and supporting robust security programs across highly regulated industries.
+Added: The Audit Committee is specifically tasked with reviewing cybersecurity and other information technology risks, controls, and procedures, including our plans to mitigate
+Added: cybersecurity risks and to respond to data breaches.
+Added: This committee also reviews with management any specific cybersecurity issues that could affect the adequacy of our internal controls.
+Added: Our Head of Information Security reports to the Audit Committee on a quarterly basis any relevant cybersecurity issues or risks, related controls, procedures and programming, material cybersecurity and data privacy incidents (if any), as well as any material updates to our cybersecurity risk management and strategy, broader cybersecurity trends, and relevant educational information.
+Added: We maintain a dedicated cybersecurity team of seasoned professionals with proven expertise in securing large-scale enterprises across diverse industries.
+Added: The team is led by our Head of Information Security , who reports to the Chief Technology Officer (CTO) .
+Added: The Head of Information Security has 20 years of experience in various technology leadership roles.
+Added: Of these, the last 10 plus years have specifically focused on building, managing, and supporting robust security programs across highly regulated industries.
The Head of Information Security holds relevant credentials through leading organizations including CISSP (ISC2), CCSP (ISC2), CRISC (ISACA), CCISO (EC-Council), and QTE (DDN).
1 unchanged sentence
Moreover, cybersecurity team members keep themselves current through continuing professional education.
−Removed: These individuals are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, which include escalation to the CCO and the Audit Committee, as appropriate.
+Added: These individuals are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, which include escalation to the CTO and executive leadership, as well as the Audit and Risk Committees when appropriate.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.