What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-02-19 compared with 2025-02-20 · 316 added, 263 removed, 659 unchanged (47% of the section changed)

6 unchanged sentences

Risks Related to Our Industry, Business and Operations

Reimbursement by Medicare is highly regulated and subject to change, and our failure to comply with applicable regulations, including regulations not designed for remote diagnostic tests like our Zio Services, could prevent us from receiving reimbursement under the Medicare program and some commercial payors, subject us to penalties, and adversely affect our reputation, business, and results of operations.

During the twelve months ended December 31, 2024, we received approximately 24% of our total revenue from the Medicare program (inclusive of Medicare Advantage).

Reimbursement by Medicare is highly regulated and subject to change, and our failure to comply with applicable regulations, including regulations not designed for remote diagnostic tests like our iRhythm Services, could prevent us from receiving reimbursement under the Medicare program and some commercial payors, subject us to penalties, and adversely affect our reputation, business, and results of operations.

During the year ended December 31, 2025, we received approximately 24% of our total revenue from the Medicare program through CMS.

The Medicare program is administered by CMS, which imposes extensive and detailed requirements on diagnostic services providers, including IDTFs.

These requirements include, but are not limited to, rules that govern how we structure our relationships with physicians, how we operate our IDTFs and market our Zio Services, when we may perform diagnostic tests, and how and when we submit reimbursement claims.

These requirements include, but are not limited to, rules that govern how we structure our relationships with physicians, how we operate our IDTFs and market our iRhythm Services, when we may perform diagnostic tests, and how and when we submit reimbursement claims.

Our failure to comply with the applicable Medicare rules and requirements could result in discontinuation of our reimbursement under the Medicare program, a requirement to return funds already paid to us, civil monetary penalties, criminal penalties, and/or exclusion from the Medicare program, which would have a material adverse impact on our reputation, business, and results of operations.

2 unchanged sentences

For example, CMS has not addressed billing for remote diagnostic tests that are performed from one or more IDTF or other remote locations.

Our failure to comply with the applicable Medicare regulations, or regulators’ disagreement with our interpretation of the regulations as applied to indirect tests, such as the Zio Services, could result in the discontinuation of our reimbursement under the Medicare program, a requirement to return funds already paid to us, civil monetary penalties, criminal penalties, and/or exclusion from the Medicare program.

Our failure to comply with the applicable Medicare regulations, or regulators’ disagreement with our interpretation of the regulations as applied to indirect tests, such as the iRhythm Services, could result in the discontinuation of our reimbursement under the Medicare program, a requirement to return funds already paid to us, civil monetary penalties, criminal penalties, and/or exclusion from the Medicare program.

In addition, many commercial payors require our IDTFs to maintain enrollment with the Medicare program as well as accreditation and certification with the Joint Commission.

If we fail to obtain and maintain IDTF enrollment or accreditation and certification, our Zio Services may no longer be reimbursed by those commercial payors, which could have a material adverse impact on our reputation, business, and results of operations.

If reimbursement or other payment for our Zio Services is reduced or modified in the United States or in our international markets, including through cost containment measures or changes to policies with respect to coding, coverage, and pricing, our business could suffer.

If we fail to obtain and maintain IDTF enrollment or accreditation and certification, our iRhythm Services may no longer be reimbursed by those commercial payors, which could have a material adverse impact on our reputation, business, and results of operations.

If reimbursement or other payment for our iRhythm Services is reduced or modified in the United States or in our international markets, including through cost containment measures or changes to policies with respect to coding, coverage, and pricing, our business could suffer.

We receive a substantial portion of our revenue from Medicare and third-party commercial payors with which we contract, and we cannot predict whether and to what extent existing reimbursement rates will continue to be available.

If CMS or any of our key commercial payors reduce reimbursement rates for our Zio Services, our business, operating results, and prospects would be adversely affected.

If CMS or any of our key commercial payors reduce reimbursement rates for our iRhythm Services, our business, operating results, and prospects would be adversely affected.

CMS updates the reimbursement rates for diagnostic tests performed by IDTFs annually via the Medicare Physician Fee Schedule.

Effective January 1, 2025, CMS updated the national payment rates for the CPT codes we use to report our cardiac monitoring services:

Effective January 1 of each year, CMS updates the national payment rates for the CPT codes we use to report our cardiac monitoring services:

CPT code 93247 (ECG recording conducted over a period of greater than 7 days and up to 15 days), CPT code 93243 (ECG recording conducted over a period of greater than 48 hours and up to 7 days), and CPT code 93229 (mobile cardiovascular telemetry).

While the payment rates for CPT codes 93247 and 93243 saw a slight increase for calendar year 2025, the rate for CPT code 93229 experienced a decrease as compared to calendar year 2024.

Because remote cardiac monitoring technology, including the Zio System, is rapidly evolving, there is a continuing risk that relative value units assigned, and reimbursement rates set, by CMS may not adequately reflect the value and expense of this technology and associated monitoring services.

New rates were published effective January 1, 2026, which reflect an increase in the national payment amount for CPT codes 93247, 93243, and 93229 as compared to calendar year 2025.

However, there is no guarantee that these year-over-year increases will be sustained, or that payment rates will keep pace with the costs to provide our iRhythm Services in the future.

Because remote cardiac monitoring technology, including the iRhythm ACM System, is rapidly evolving, there is a continuing risk that relative value units assigned, and reimbursement rates set, by CMS may not adequately reflect the value and expense of this technology and associated monitoring services.

Further, CMS may reduce the rates for the CPT codes assigned to our services in the future, which would adversely affect our financial results, particularly to the extent commercial payors with which we contract follow suit.

4 unchanged sentences

These policies have included, and may in the future include:

basing reimbursement policies and rates on clinical outcomes, the comparative effectiveness, and costs, of different treatment technologies and services, as well as other measures.

basing reimbursement policies and rates on clinical outcomes, the comparative effectiveness, and costs, of different treatment technologies and services, changes in risk adjustment weights or the criteria required to support risk adjustment eligible diagnoses in Medicare Advantage, as well as other measures.

For example, from time to time CMS or Medicare Administrative Contractors may develop National Coverage Determinations, Local Coverage Determinations (“LCDs”), or similar policies dictating the conditions for coverage and reimbursement of our iRhythm Services.

For instance, in September 2025, Noridian Healthcare Solutions, LLC, Palmetto GBA, LLC, and CGS Administrators, LLC each published proposed LCDs regarding “Temporary Nontherapeutic Ambulatory Cardiac Monitoring Devices.” These proposed LCDs seek to outline the circumstances in which ambulatory cardiac monitoring is considered reasonable and necessary for Medicare purposes, device requirements, and associated coverage limitations.

The proposed LCDs were subject to a public comment period that concluded in November 2025, in which iRhythm and other stakeholders had the opportunity to inform consideration of whether, and in what form, the LCDs might be adopted.

The adoption of the proposed LCDs, or any other developments in the Medicare coverage policies on which the industry has come to rely, could necessitate changes to our business model, methods of operation, billing processes, and related compliance controls.

Future significant changes in the healthcare systems in the United States or elsewhere could also have a negative impact on the demand for our current and future products and services.

These include changes that may reduce reimbursement rates for our products and changes that may be proposed or implemented by the current or future laws or regulations.

These include changes that may limit coverage or reduce reimbursement rates for our products and changes that may be proposed or implemented by the current or future laws or regulations.

If we are unable to expand the number of third-party commercial payors with which we contract or expand coverage for existing third-party commercial payors, our commercial success could be impacted.

2 unchanged sentences

Since each payor decides whether to establish a policy concerning reimbursement or to contract with us to set the price of reimbursement, seeking reimbursement on a payor-by-payor basis is a time-consuming and costly process to which we dedicate substantial resources.

If we do not dedicate sufficient resources to establishing contracts with commercial payors and supporting payors’ reimbursement determinations by demonstrating the clinical value of our Zio Services through studies and physician adoption, we may encounter several adverse consequences that could compromise the commercial success of our business.

Such adverse consequences may include an inability to secure additional contracts with commercial payors, reluctance by physicians to order our Zio Services due to concerns that patients may face significant out-of-pocket expenses associated with an out-of-network IDTF, a decline in the amount that we are reimbursed for our services, less predictable revenue, and an increase in the efforts and resources necessary to obtain reimbursement for our services on a claim-by-claim basis.

If we do not dedicate sufficient resources to establishing contracts with commercial payors and supporting payors’ reimbursement determinations by demonstrating the clinical value of our iRhythm Services through studies and physician adoption, we may encounter several adverse consequences that could compromise the commercial success of our business.

Such adverse consequences may include an inability to secure additional contracts with commercial payors, reluctance by physicians to order our iRhythm Services due to concerns that patients may face significant out-of-pocket expenses associated with an out-of-network IDTF, a decline in the amount that we are reimbursed for our services, less predictable revenue, and an increase in the efforts and resources necessary to obtain reimbursement for our services on a claim-by-claim basis.

Additionally, for our out-of-network or cash pay patients, we may be subject to state and federal surprise billing laws that impose limits on amounts that can be charged to such patients and/or the amount we can receive for out-of-network services from commercial payors as well as penalties for noncompliance.

1 unchanged sentence

These laws and regulations may change and we anticipate these evolving, highly technical requirements may apply to our business in the future and could necessitate the dedication of additional resources to ensure compliance.

We report to third party payors the technical components of the remote cardiac monitoring services that are performed with our Zio Monitor, Zio XT, and Zio AT Systems using CPT codes established by the American Medical Association.

We report to third party payors the technical components of the remote cardiac monitoring services that are performed with our Zio monitor, Zio XT, and Zio AT devices using CPT codes established by the AMA.

These CPT codes are manufacturer- and technology-agnostic but describe general technical features required to support the diagnostic medical procedures represented by these billing codes.

Given the nature of CPT codes, there is always some degree of risk for an entity that bills for its services that regulators or other third parties could assert that the CPT codes utilized were not appropriate, and recent events have the potential to increase the risk of questions or inquiry regarding our use of a specific CPT code.

The CPT codes used to report remote cardiac monitoring services, including those used to report our Zio Services, were drafted by the American Medical Association (“AMA”) in a manufacturer- and specific technology-agnostic manner.

Regulators or other third parties could assert that our technology does not support certain diagnostic procedures described by the CPT codes that we currently use to report our Zio Services.

For example, a regulator or other third party could assert that the Zio AT System cannot support MCT services, which could jeopardize our ability to submit claims for reimbursement for services utilizing our Zio AT System and may require us to evaluate whether we have received any overpayments that must be reported and returned to third-party payors.

Certain language in a warning letter we received from FDA on May 25, 2023 could increase the risk of inquiries regarding our historical or current use of CPT code 93229.

Consistent with the AMA’s definition of MCT and the technology categorization in FDA’s outpatient cardiac telemetry product code, the Zio AT device is intended to capture and transmit symptomatic and asymptomatic cardiac events and record continuous ECG data for long-term monitoring on adult patients who may be asymptomatic or who may suffer from transient symptoms (e.g., palpitations, shortness of breath, dizziness, light-headedness, pre-syncope, syncope, fatigue, or anxiety), with escalation to the patient’s treating healthcare professional, consistent with the healthcare professional’s prescribed notification criteria, during the monitoring period.

Our revenue relies on our Zio Services, which are currently our only offerings.

If our Zio Services or future service offerings fail to gain, or lose, market acceptance, our business will suffer.

Our current revenue is dependent on orders for our Zio Services, and we expect that reimbursement for our Zio Services will account for substantially all our revenue for the foreseeable future.

We are in various stages of research and development for other diagnostic and/or screening solutions and new indications for our technology and our Zio Services;

Given the nature of CPT codes, there is always some degree of risk for an entity that bills for its services that regulators or other third parties could assert that the CPT codes utilized were not appropriate, and recent regulatory developments have the potential to increase the risk of questions or inquiry regarding our use of a specific CPT code.

The CPT codes used to report remote cardiac monitoring services, including those used to report our iRhythm Services, were drafted by the AMA in a manufacturer- and specific technology-agnostic manner.

Regulators’ evolving understandings and definitions of certain cardiac monitoring modalities could result in assertions that our technology does not support certain diagnostic procedures described by the CPT codes that we currently use to report our iRhythm Services.

For example, although FDA “Product Codes” are created and assigned by FDA to support the agency’s responsibility for regulating medical devices in the framework of device classifications designated under 21 C.F.R.

Parts 862-892, Product Codes have the potential to raise questions about expectations for devices.

In November 2023, FDA established a new Product Code QYX for “Outpatient Cardiac Telemetry” and retrospectively assigned Product Code QYX to several devices, including Zio AT.

FDA’s “Definition” of the “Outpatient Cardiac Telemetry” devices within this Product Code references monitoring data being “transmitted to the prescribing clinician during the monitoring period by a 24/7 attended analysis center after review by a qualified individual,” which may be read as incorporating activities of an IDTF into the device.

If our IDTF capabilities and performance do not align with FDA’s interpretation and expectations for Product Code QYX, a regulator or other third party could assert that the Zio AT cannot support MCT services.

Any such assertion could jeopardize our ability to obtain clearances with indications and labeling that provide for the scope we planned, and our ability to submit claims for reimbursement for services utilizing Zio AT and may require us to evaluate whether we have received any overpayments that must be reported and returned to third-party payors.

Our revenue relies on our iRhythm Services, which are currently our only offerings.

If our iRhythm Services or future service offerings fail to gain, or lose, market acceptance, our business will suffer.

Our current revenue is dependent on orders for our iRhythm Services, and we expect that reimbursement for our iRhythm Services will account for substantially all our revenue for the foreseeable future.

We are in various stages of research and development for other diagnostic and/or screening solutions and new indications for our technology and our iRhythm Services;

however, there can be no assurance that we will be able to successfully develop and commercialize any new services and related devices.

Any new services may not be accepted by physicians or may merely replace revenue generated by our Zio Services and not generate additional revenue.

Any new services may not be accepted by physicians or may merely replace revenue generated by our iRhythm Services and not generate additional revenue.

If we have difficulty launching new services, our reputation may be harmed and our financial results adversely affected.

In order to substantially increase our revenue, we will need to target physicians other than cardiologists, such as emergency room doctors, primary care physicians, and other physicians with whom we have had little contact and who may require a different type of marketing effort.

If we are unable to increase orders for our Zio Services, expand reimbursement for our Zio Services, or successfully develop and commercialize new services and related devices, our revenue and our ability to achieve and sustain profitability would be impaired.

If we are unable to increase orders for our iRhythm Services, expand reimbursement for our iRhythm Services, or successfully develop and commercialize new services and related devices, our revenue and our ability to achieve and sustain profitability would be impaired.

The market for remote cardiac monitoring solutions is highly competitive.

1 unchanged sentence

The market for remote cardiac monitoring products and services is competitive, characterized by rapid change resulting from technological advances, scientific discoveries, and other market activities of industry participants.

Our Zio Services compete with a variety of products and services that provide alternatives for remote cardiac monitoring, including traditional, short-term Holter monitors and event monitors.

Our iRhythm Services compete with a variety of products and services that provide alternatives for remote cardiac monitoring, including traditional, short-term Holter monitors and event monitors.

Our industry is highly fragmented and characterized by a small number of large manufacturers and a large number of smaller regional service providers.

These third parties compete with us in marketing to payors and ordering physicians, recruiting and retaining qualified personnel, acquiring technology, and developing products and services that compete with our Zio Services and related devices, and enhancing their product offerings with differentiating features.

Our ability to compete effectively depends on our ability to distinguish our company and our Zio Services from our competitors and their products and services, and includes such factors as safety and effectiveness;

These third parties compete with us in marketing to payors and ordering physicians, recruiting and retaining qualified personnel, acquiring technology, and developing products and services that compete with our iRhythm Services and related devices, and enhancing their product offerings with differentiating features.

Our ability to compete effectively depends on our ability to distinguish our company and our iRhythm Services from our competitors and their products and services, and includes such factors as safety and effectiveness;

acute and long-term outcomes;

3 unchanged sentences

Large competitors in the remote cardiac market include companies that sell standard Holter monitors including GE Healthcare, Philips Healthcare, Mortara Instrument, Inc., Spacelabs Healthcare Inc.

and Welch Allyn Holdings, Inc.

(acquired by Hill-Rom Holdings, Inc.

now part of Baxter International, Inc.).

and Welch Allyn.

Additional competitors, such as BioTelemetry, Inc.

(acquired by Royal Philips), Preventice Solutions, Inc.

(acquired by Boston Scientific, Inc.), and Bardy Diagnostics, Inc.

(acquired by Hill-Rom Holdings, Inc.

which was acquired by Baxter International, Inc.) manufacture remote cardiac monitoring devices and also offer monitoring services.

(now part of Royal Philips), Preventice Solutions, Inc.

(now part of Boston Scientific, Inc.), and BardyDx manufacture remote cardiac monitoring devices and also offer monitoring services.

These companies have also developed other patch-based cardiac monitors that have received FDA and foreign regulatory clearances.

2 unchanged sentences

Future competition could come from makers of wearable fitness products or large information technology companies focused on improving healthcare.

For example, Apple Inc., Fitbit and Samsung, among others, have added capabilities on their platforms to measure non-continuous ECG and to alert customers to the potential presence of irregular heartbeats suggestive of asymptomatic Afib.

These competitors and potential competitors may introduce new products and services that more directly compete with our Zio Services and related devices.

Billing for our Zio Services is complex and highly regulated, and we must dedicate substantial time and resources to the billing process.

For example, Apple, Fitbit and Samsung, among others, have added capabilities on their platforms to measure non-continuous ECG and to alert customers to the potential presence of irregular heartbeats suggestive of asymptomatic Afib.

These competitors and potential competitors may introduce new products and services that more directly compete with our iRhythm Services and related devices.

Billing for our iRhythm Services is complex and highly regulated, and we must dedicate substantial time and resources to the billing process.

Failure to comply with legal, regulatory, or contractual requirements applicable to our billing and collection activities could subject us to penalties, and adversely affect our reputation, business and results of operations.

Billing for diagnostic services is complex, highly regulated, time-consuming, and expensive, and failure to comply with legal or contractual requirements applicable to our billing and collection activities could subject us to penalties, and adversely affect our reputation, business and results of operations.

Depending on the billing arrangement and applicable law, we bill several types of entities and payors, including federal healthcare programs, third-party commercial payors, healthcare providers, and healthcare institutions, which may have different billing requirements, coverage criteria, procedures, or expectations.

requirements, coverage criteria, procedures, or expectations.

We also bill insured patients for co-payments, co-insurance, and deductible amounts, as well as bill self-pay patients directly.

Several factors make the billing and collection process uncertain, including differences between the submitted claim price for our Zio Services and the reimbursement rates of payors;

Several factors make the billing and collection process uncertain, including differences between the submitted claim price for our iRhythm Services and the reimbursement rates of payors;

compliance with complex federal and state regulations related to billing the Medicare and Medicaid programs and collecting co-payments, co-insurance, and deductible amounts from patients and other guarantors;

6 unchanged sentences

These activities require a tremendous dedication of resources and, as a result, we have engaged third-party vendors to undertake certain components of o ur billing and collections operations.

While common in the healthcare industry, the outsourcing of billing and collections activities to third-party vendors requires diligent monitoring and oversight to ensure the completeness, accuracy, and propriety of the claims submitted to federal healthcare programs and other third-party commercial payors for our Zio Services.

We may be held responsible by our regulators or payors for any acts, errors, or omissions by the third-party vendors engaged to perform billing and collections activities on our behalf.

The complexities we face related to billing for our Zio Services, and the related uncertainty in obtaining payment for our Zio Services, could negatively affect our revenue and cash flow, our ability to achieve profitability, and the consistency and comparability of our results of operations.

The complexities we face related to billing for our iRhythm Services, and the related uncertainty in obtaining payment for our iRhythm Services, could negatively affect our revenue and cash flow, our ability to achieve profitability, and the consistency and comparability of our results of operations.

Audits or denials of our claims by government agencies or payors could expose us to recoupment, regulatory scrutiny, and penalties.

8 unchanged sentences

As a provider enrolled in federal healthcare programs, we expect to be subject to such audits and claims reviews in the future, which may result in suspensions or other restrictions on our ability to submit claims for our services, payment delays, overpayment recoupments, and claims denials, which would negatively impact our business, financial condition, and results of operations, and may jeopardize our participation in these federal healthcare programs.

We are transforming our revenue cycle management function and we may fail to realize the anticipated benefits of these efforts.

These activities involve significant time and resources, and our failure to execute these activities efficiently and effectively may cause our revenue and accounts receivable to be delayed or reduced and could have an adverse effect on our business and cause reputational harm.

We are in the midst of a transformation of our revenue cycle management function, which transformation includes the utilization of third-party service providers to support certain activities.

The success of this plan depends on our ability to complete the integration of these service providers in a timely manner to scale our operations to facilitate growth opportunities, without adversely affecting current revenues and accounts receivable.

If we are not able to successfully achieve these objectives, the anticipated benefits of this transformation may not be realized fully or at all or may take longer to realize than expected.

In addition, there is a significant degree of difficulty and management distraction inherent in the process of integrating with service providers.

We have continued to evolve our revenue cycle management function in response to increased audit risk of our billing practices by government and commercial payers who are utilizing AI to review our bills.

As part of that evolution, we utilize third-party service providers to support certain activities and these activities involve significant time and resources on our part to train and monitor such third parties.

Our failure, or the failure of these third-party service providers, to execute our or their activities efficiently and effectively may cause our revenue and accounts receivable to be delayed or reduced and could have an adverse effect on our business and cause reputational harm.

We have continued to evolve our revenue cycle management function in response to the increased audit risk of our billing practices as a result of enhanced use of AI by government and commercial payers.

The success of our efforts to evolve our revenue cycle management function depends on the ability of our service providers to deliver timely and accurate services that will continue to support our business as we scale our operations to facilitate growth opportunities, without adversely affecting current revenues and accounts receivable.

If we are not able to successfully achieve these objectives, the anticipated benefits of these efforts may not be realized fully or at all or may take longer to realize than expected.

In addition, there is a significant degree of difficulty and management distraction inherent in the process of managing and working with third-party service providers.

These difficulties include challenges supporting certain operations and activities with more than one service provider, integrating technologies (including IT systems and processes, procedures, policies and operations), and retaining key personnel.

These activities are complex and time-consuming and involve delays or additional and unforeseen expenses.

The process of transitioning to these service providers, the integration process, and other disruptions may also disrupt our ongoing businesses or cause inconsistencies in standards, controls, procedures, and policies that could adversely affect our relationships with payors, patients, employees, and others.

Any failure to execute these activities effectively and efficiently may cause our revenue and accounts receivable to be delayed or reduced and could have an adverse effect on our business and cause reputational harm.

Although our current Zio Systems are comprised of medical devices that have received FDA marketing authorization (510(k) clearance) as well as, with respect to certain devices, regulatory certifications in the EU , Japan, Switzerland and th e UK, we may regularly engage in exploring and implementing product enhancements and in iterative changes to existing products, as well as seek to develop new technology or use of technology for new indications for use.

These activities are complex and time-consuming and can involve delays or additional and unforeseen expenses.

The process of transitioning to any new or additional providers, the integration process, and other disruptions may also disrupt our ongoing businesses or cause inconsistencies in standards, controls, procedures, and policies that could adversely affect our relationships with payors, patients, employees, and others.

Although our current iRhythm ACM Systems are comprised of medical devices that have received FDA marketing authorization (510(k) clearance) as well as, with respect to certain devices, regulatory certifications or approvals in the EU , Japan, Switzerland and th e UK, we may regularly engage in exploring and implementing product enhancements and in iterative changes to existing products, as well as seek to develop new technology or use of technology for new indications for use.

These medical device developments may trigger further regulatory reviews, and the results of those reviews are unpredictable.

1 unchanged sentence

All of these processes can be expensive, lengthy, and unpredictable.

Changes in agency personnel and resources can add to the unpredictability of this process.

We may not be able to obtain the clearances or approvals we seek or may be unduly delayed in doing so, which could harm our business.

Even if we are granted regulatory clearances or approvals, they may include significant limitations on the indicated uses for the product, which may limit the market for the product.

Although we have obtained 510(k) clearances to market our Zio Systems, our clearances can be revoked if safety, efficacy, or significant regulatory compliance problems develop.

Although we have obtained 510(k) clearances to market our iRhythm ACM Systems, our clearances can be revoked if safety, efficacy, or significant regulatory compliance problems develop.

Even planned changes and improvements to devices and their uses can trigger the need for a new submission.

1 unchanged sentence

Unless effectively planned for in advance, our desired commercial timeline may be impacted.

Significant changes or modifications in design, components, method of manufacture, or the intended use or technological characteristics of our Zio Systems may require new or modified FDA marketing authorization, CE Mark certification (EU), UKCA Mark certification (UK), Swiss Medical Devices Ordinance ("SMDO") marketing authorization or Japanese Pharmaceutical and Medical Device Agency (“PMDA”) marketing authorization.

In some instances, we have identified a need for, and sought and obtained new, 510(k) clearances from FDA for these changes or modifications.

Significant changes or modifications in design, components, method of manufacture, or the intended use or technological characteristics of our iRhythm ACM Systems may require new or modified FDA marketing authorization, CE Mark certification in the EU, UKCA Mark certification, Swiss Medical Devices Ordinance (“MedDO”) marketing authorization or Japanese PMDA marketing authorization.

In some instances, we have identified a need for, and sought and obtained new regulatory approvals for these changes or modifications.

As permitted by applicable law, FDA allows device manufacturers to internally analyze and document a decision that a new clearance or approval is viewed by the manufacturer as unnecessary.

Accordingly, we have made certain changes and modifications to our Zio Systems in the past that we believe did not require additional clearances or approvals by FDA.

Accordingly, we have made certain changes and modifications to our iRhythm ACM Systems in the past that we believe did not require additional clearances or approvals by FDA.

Such internal decisions are, however, subject to review by FDA, and may require additional action in the event FDA questions earlier internal decision-making.

For example, FDA raised questions in the warning letter issued on May 25, 2023 regarding certain changes and modifications to the Zio AT System for which we did not make 510(k) submissions, and rather documented our analysis in letters to file.

We have recently (following, and in alignment with, discussion with FDA) submitted an updated 510(k) to address Zio AT Device modifications that were, prior to our receipt of the warning letter, previously documented in letters to file.

In October 2024, following, and in alignment with, discussion with FDA, we received FDA 510(k) clearance for these design updates, as well as additional 510(k) clearance relating to further enhancements to our Zio AT Device.

In instances where FDA, an EU/UK Notified/Approved Body, the PMDA or the Swiss regulatory body disagrees with our internal analysis and decision that a new or additional approval or marketing authorization or certification is not needed for any such modifications, we may be required to recall and/or stop the distribution of the impacted Zio System and/or correct the labeling for such Zio System.

For example, FDA raised questions in the warning letter issued on May 25, 2023 regarding certain changes and modifications to Zio AT for which we did not make 510(k) submissions, and rather documented our analysis in letters to file.

We have recently (following, and in alignment with, discussion with FDA) submitted an updated 510(k) to address Zio AT modifications that were, prior to our receipt of the warning letter, previously documented in letters to file.

In instances where FDA, an EU/UK Notified/Approved Body, the PMDA or the Swiss regulatory body disagrees with our internal analysis and decision that a new or additional approval or marketing authorization or certification is not needed for any such modifications, we may be required to recall and/or stop the distribution of the impacted iRhythm ACM System and/or correct the labeling for such iRhythm ACM System.

We may be required to submit a new marketing application or certification, which could require additional testing or other supporting data, a redesign of a product, or otherwise impact the provision of services.

1 unchanged sentence

We may not be able to obtain additional marketing authorizations in a timely fashion, or at all, which could harm our ability to introduce new or enhanced products in a timely manner and to meet market expectations for the provision of the services, which in turn could harm our future growth.

We are subject to extensive compliance requirements for the quality, design, safety, performance, and post-market surveillance of the medical devices we manufacture for use in our Zio Services, and for vigilance on complaint-handling, escalation, assessment, and reporting of adverse events and malfunctions.

We are subject to extensive compliance requirements for the quality, design, safety, performance, and post-market surveillance of the medical devices we manufacture for use in our iRhythm Services, and for vigilance on complaint-handling, escalation, assessment, and reporting of adverse events and malfunctions.

A wide range of quality, risk, regulatory, or safety matters could trigger enforcement action by regulatory authorities, the need for a recall, a hold on the distribution of the marketed product, or other corrective actions to marketed product, and such matters have the potential to escalate to judicial actions that involve the DOJ.

4 unchanged sentences

Actions to which a company may be subject could include the issuance of warning letters, adverse publicity, seizures, prohibitions on product sales, recalls, and civil and criminal penalties, any one of which could significantly impact our manufacturing supply and provision of services and impair our financial results.

Failure to maintain full compliance with the requirements of the Quality System Regulation (“QSR”), also known as 21 CFR Part 820, EU Standards (presently the Medical Devices Regulations (“EU MDR”)), UK Medical Device Regulations (“UK MDR”), Japanese medical device Quality Management System (“Japanese QMS”) and the SMDO could result in similar disruptions in these markets.

Failure to maintain full compliance with the requirements of FDA's QMSR, the EU MDR, the UK MDR, the Japanese QMS and the Swiss MedDO could result in similar disruptions in these markets.

Furthermore, even if we adhere to regulatory standards and expectations in our corrective actions, the public nature of such actions can result in broader negative publicity and perceptions, which could harm our reputation.

Our design and manufacturing facilities and processes and those of certain third-party suppliers are subject to FDA, state, EU/UK Notified/Approved Body, PMDA and Swiss regulatory inspections for compliance with various medical device regulations and standards, including EU MDR, UK MDR, Japanese QMS and SMDO requirements.

Our design and manufacturing facilities and processes and those of certain third-party suppliers are subject to FDA and state, as well as EU, UK, Japanese and Swiss regulatory inspections for compliance with various medical device regulations and standards, including FDA, EU MDR, UK MDR, Japanese QMS and Swiss MedDO requirements.

Developing and maintaining a compliant quality system is time consuming and investment intensive.

Requirements and standards may change and evolve over time, and we will need to adapt.

For example, FDA has issued final regulations on updates to the QSR which will largely align with the ISO 13485 standard, and these are set to take effect February 2, 2026.

For example, FDA has issued final regulations on updates to FDA's QSR, now referred to as the Quality Management System Regulation or QMSR, which harmonizes key areas of quality management for device manufacturers in alignment with global regulatory requirements including ISO 13485:2016 and clause 3 of ISO 9000:2015.

These regulations took effect on February 2, 2026.

While the QMSR is now in effect, the transition presents some uncertainties relative to FDA practices and expectations in upcoming inspections of device quality systems.

We are required to file various reports with FDA, as well as EU, UK, Japanese and Swiss regulators, including reports required by each jurisdiction’s adverse event, certain malfunctions, and field action reporting regulations.

These reports are often required if our Zio System may have caused or contributed to a death or serious injury or malfunctioned in a way that would likely cause or contribute to a death or serious injury if the malfunction were to recur.

These reports are often required if our iRhythm ACM System may have caused or contributed to a death or serious injury or malfunctioned in a way that would likely cause or contribute to a death or serious injury if the malfunction were to recur.

They may also be reasonable, necessary, or prudent for a range of other reasons relating to the importance of gathering information in the post marketing setting and managing risk throughout the product lifecycle, or to address requests from regulators to increase or expand the scope of reporting.

An increase in the reporting of events associated with the use of our products and services from us or others and any delays to the filing of reports may increase regulator and public scrutiny, especially given that these reports are typically publicly available information in most jurisdictions, including the United States, which could harm our business.

If we initiate a field action (whether a “correction” made relative to a device that remains in the field, which could be through a labeling or software update, or “removal” or “recall” and return of that device to us, or field advisory notices) to reduce a risk to health posed by our Zio System, we would be required to report the Correction or Removal to FDA and, in many cases, similar reports to other regulatory agencies.

An increase in the reporting of events associated with the use of our products and services from us or others and any delays to

the filing of reports may increase regulator and public scrutiny, especially given that these reports are typically publicly available information in most jurisdictions, including the United States, which could harm our business.

If we initiate a field action (whether a “correction” made relative to a device that remains in the field, which could be through a labeling or software update, or “removal” or “recall” and return of that device to us, or field advisory notices) to reduce a risk to health posed by our iRhythm ACM System, we would be required to report the Correction or Removal to FDA and, in many cases, similar reports to other regulatory agencies.

Depending on the reason for the correction or removal and the potential severity of the impact to patient safety or the effectiveness of the device, FDA may require differing degrees of communication to alert those who may be in possession of an impacted device.

We would generally be subject to similar requirements in jurisdictions outside the United States where the Zio products are used.

Examples of the above include:

Examples of regulatory actions and communications in recent years include:

• Our receipt of Form 483 observations in August 2022 alleging certain quality system deficiencies, including in relation to our corrective and preventive action procedures, test validation, complaint handling and medical device reporting requirements.

2 unchanged sentences

• The Customer Advisory Notice we initiated September 28, 2022 to Zio AT customers, and our reports to FDA under 21 C.F.R.

Part 806, regarding a Zio AT labeling correction involving additions and modifications to the Zio AT labeling precautions relating to the device’s maximum transmission limits during wear, and also to the need for healthcare providers to complete registration to initiate monitoring services.

FDA classified this field action as a Class II Recall following our initial 806 report a nd although we believe we have completed the distribution of the Advisory Notice to our identified impacted customers, and we requested the closure of this field action in March 2023, the status remains open in the public FDA recall database.

Part 806, regarding a Zio AT labeling correction involving additions and modifications to Zio AT labeling precautions relating to the device’s maximum transmission limits during wear, and also to the need for healthcare providers to complete registration to initiate monitoring services.

FDA classified this field action as a Class II Recall following our initial 806 report a nd although we believe we have completed the distribution of the Advisory Notice to our identified impacted customers and requested the closure of this field action in March 2023, the status remains open in the public FDA recall database.

and FDA has not yet confirmed the termination or completion of this recall to us .

1 unchanged sentence

We submitted a timely response to FDA in June 2023 and are continuing to work with the agency to address the issues outlined in the warning letter, including specific dialogue on key topics and our planned path forward.

As part of this dialogue we agreed to make two 510(k) submissions relating to the Zio AT, and on October 21, 2024, we were granted FDA clearance for one 510(k) encompassing design updates that had previously been documented through letters to file and on October 30, 2024 we were granted FDA clearance on a second 510(k) submission related to design modifications and labeling updates for the Zio AT device.

• In the fourth quarter of 2023, as part of our commitments following the FDA 483 observations and FDA warning letter issued on May 25, 2023, our retrospective submission of certain Medical Device Reports (“MDRs”) to FDA.

Our receipt of 483 observations following July 2024 FDA inspections of our Cypress and San Francisco FDA-registered facilities centered on complaint handling and medical device reporting, risk analysis regarding the involvement of the technicians to prepare the Zio ECG reports, the corrective and preventive action process, process controls and statistical techniques.

We timely submitted our initial responses regarding the July 2024 483 observations to FDA on August 21, 2024, and provided supplemental information on September 6, 2024.

In these responses we committed to a number of follow-up actions, and we intend to work with FDA to resolve the issues identified.

Executing on our follow-up actions, commitments to FDA, and remediation activities will require significant time, attention, and resources that might otherwise be applied to future product development activities and initiatives, and could result in delays or changes to these plans.

As part of this dialogue we agreed to make two 510(k) submissions relating to Zio AT.

On October 21, 2024, we were granted FDA clearance for one 510(k) encompassing design updates that had previously been documented through letters to file.

On October 30, 2024 we were granted FDA clearance on a second 510(k) submission related to design modifications and labeling updates for Zio AT.

• Our retrospective submission of certain Medical Device Reports in the fourth quarter of 2023, as part of our commitments following FDA 483 observations and the FDA warning letter issued on May 25, 2023.

• Our receipt of 483 observations following July 2024 FDA inspections of our Cypress and San Francisco FDA-registered facilities centered on complaint handling and medical device reporting, risk analysis regarding the involvement of the technicians to prepare the Zio ECG reports, the corrective and preventive action proces s, process controls and statistical techniques.

We timely submitted our initial responses regarding 483 observations to FDA and have also submitted supplemental information.

In these responses, we committed to a number of follow-up actions and we continue to work with FDA to resolve the issues identified.

Executing on our follow-up actions, commitments to FDA, and remediation activities have and continue to require significant time, attention, and resources that might otherwise be applied to future product development activities and initiatives, and could result in delays or changes to these plans.

Our commitments will also require a high degree of attention to design strategy and compliance going forward.

In addition, although we continue to fully cooperate and are in dialogue with FDA, there are ongoing enforcement risks, including escalation of further action by FDA, that remain given the inspection and enforcement activities of FDA over the past few years.

FDA may determine that our remediation efforts to date or our responses to the 2024 483 observations are insufficient or unsatisfactory, or FDA may decide that it does not agree with the plans and commitments we have outlined in our previous communications.

FDA may determine that our remediation efforts to date or our responses to the 2024 483 observations are insufficient or unsatisfactory.

FDA could issue another warning letter, issue a consent decree in collaboration with the DOJ, and/or require recall or cessation of marketing and shipping our Zio device.

We cannot give any assurances that FDA will be satisfied with our response, the actions taken to resolve the concerns raised in the warning letter or the more recent 483 observations, or the expected date for the resolution of such matters.

Until these issues are resolved to FDA’s satisfaction, additional legal or regulatory action may be taken with or without further notice.

The warning letter and the 483 observations are publicly available on FDA’s website and have been the subject of a high degree of media and industry attention, which subjects us to additional scrutiny.

As we are already subject to an FDA warning letter associated with our Cypress facility, and in light of the 2024 inspection results, if we are unable to successfully execute follow-up actions consistent with our commitments to FDA, or if FDA determines that our follow-up commitments are insufficient or are not completed with sufficient promptness, we may face a greater risk of potential escalation, which could involve issuance of additional warning letters, or there is a possibility that FDA could initiate consent decree discussions.

The warning letter and the 483 observations are

publicly available on FDA’s website and have been the subject of a high degree of media and industry attention, which subjects us to additional scrutiny.

If we are unable to successfully execute and maintain follow-up actions consistent with our commitments to FDA, or if FDA determines that our follow-up commitments are insufficient or were not completed with sufficient promptness, we may face a greater risk of potential escalation, which could involve issuance of additional warning letters, or there is a possibility that FDA could initiate consent decree discussions.

This may pose a considerable expense, divert management’s attention, and have a potentially negative impact on the public’s perception of us, all of which could negatively impact our financial position and results of operations.

1 unchanged sentence

Because of the patient populations for which our services are provided and the complexity of the healthcare environment in which we operate, a high degree of medical and clinical input may be necessary to evaluate complaints and adverse events, and in some cases, there may be disagreement over whether our services or the medical devices used in our services may have caused or contributed to an adverse event.

Our Zio Systems and Zio Services are not intended to be prescribed or ordered for use as an emergency system.

Our iRhythm ACM Systems and iRhythm Services are not intended to be prescribed or ordered for use as an emergency system.

They are not intended for critical care patients or patients suspected of life-threatening arrhythmias who require inpatient or emergency ECG monitoring.

Given the nature of arrhythmias and the patient population for which our Zio Services are ordered by physicians, in which there may be several health conditions present, there are instances in which a patient may experience a medical event during the wear period of a Zio System.

Given the nature of arrhythmias and the patient population for which our iRhythm Services are ordered by physicians, in which there may be several health conditions present, there are instances in which a patient may experience a medical event during the wear period of an iRhythm ACM System.

In some cases, it may be medically and logistically challenging to obtain information sufficient to definitively determine all contributing factors to an event.

5 unchanged sentences

Given the structure of such reporting to FDA the full medical context is not generally available to the public, which may cause additional scrutiny, questions, or concerns regarding our products and services.

For example, in the fourth quarter of 2023, as part of our commitments following the FDA Form 483 observations and warning letter issued on May 25, 2023, we retrospectively submitted certain MDRs to FDA, and the publicly available information in these reports may receive additional scrutiny.

We are subject to FDA requirements to investigate complaints about our Zio Systems.

For example, in the fourth quarter of 2023, as part of our commitments following FDA Form 483 observations and the FDA warning letter issued on May 25, 2023, we retrospectively submitted certain Medical Device Reports to FDA, and the publicly available information in these reports may receive additional scrutiny.

We are subject to FDA requirements to investigate complaints about our iRhythm ACM Systems.

If we do not effectively manage and monitor our complaint-handling procedures, we may be subject to regulatory enforcement action, litigation risks, and risk of negative publicity.

If we are unable to keep up with demand for our Zio Services, our revenue could be impaired, market acceptance for our Zio Services could be harmed, and physicians may instead order our competitors’ services.

As demand for our Zio Services increases, we may encounter production or service delays or shortfalls.

If we are unable to keep up with demand for our iRhythm Services, our revenue could be impaired, market acceptance for our iRhythm Services could be harmed, and physicians may instead order our competitors’ services.

As demand for our iRhythm Services increases, we may encounter production or service delays or shortfalls.

Such production or service delays or shortfalls may be caused by many factors, including the following:

1 unchanged sentence

• we may experience technical challenges to increasing manufacturing capacity, including in connection with equipment design, automation, validation and installation, contractor issues and delays, licensing and permitting delays or rejections, materials procurement, manufacturing site expansion, problems with production yields, and quality control and assurance;

• key components of our Zio Systems are provided by a sole or single supplier or limited number of suppliers, and we do not maintain large inventory levels of these components;

• key components of our iRhythm ACM Systems are provided by a sole or single supplier or limited number of suppliers, and we do not maintain large inventory levels of these components;

if we experience a shortage or quality issues in any of these components, we would need to identify and qualify new supply sources, which could increase our expenses and result in manufacturing delays;

• the extent to which we become dependent upon others for the manufacture of our Zio Systems which could adversely affect our future profit margins and our ability to market our Zio Services;

• global demand and supply factors concerning commodity components common to all electronic circuits, including Zio Systems, could result in shortages that manifest as extended lead times for circuit boards, which could limit our ability to sustain and/or grow our business;

• the extent to which we become dependent upon others for the manufacture of our iRhythm ACM Systems which could adversely affect our future profit margins and our ability to market our iRhythm Services;

• global demand and supply factors concerning commodity components common to all electronic circuits, including iRhythm ACM Systems, could result in shortages that manifest as extended lead times for circuit boards, which could limit our ability to sustain and/or grow our business;

• we may experience a delay in completing validation and verification testing for new production processes and/or equipment at our manufacturing facilities;

• to increase our manufacturing output significantly and scale our services, we will have to attract and retain qualified employees for our operations;

• in response to unexpectedly rapid growth of our business, clinical operations capacity may not meet demand while new resources are being recruited and trained, which could negatively impact our volume capacity for our Zio Services.

If we were unable to successfully manufacture our Zio Systems in sufficient quantities, or to maintain sufficient capacity to provide our Zio Services, it would materially harm our business.

We depend on third-party vendors for the supply and manufacture of certain components of our Zio Systems, as well as for other aspects of our operations.

We rely on third-party vendors for components and sub-assemblies used in our Zio Systems and in connection with certain logistical aspects of our Zio Services.

If we were unable to successfully manufacture our iRhythm ACM Systems in sufficient quantities, or to maintain sufficient capacity to provide our iRhythm Services, it would materially harm our business.

We depend on third-party vendors for the supply and manufacture of certain components of our iRhythm ACM Systems, as well as for other aspects of our operations.

We rely on third-party vendors for components and sub-assemblies used in our iRhythm ACM Systems and in connection with certain logistical aspects of our iRhythm Services.

Our reliance on third-party vendors subjects us to a number of risks, including:

2 unchanged sentences

• production delays related to the evaluation and testing of products from alternative suppliers and corresponding regulatory qualifications;

• inability of the manufacturer or supplier to comply with our quality criteria and specifications and, where applicable, the QSR, state regulatory authorities, and, in some cases, the Notified Body audits;

• inability of the manufacturer or supplier to comply with our quality criteria and specifications and, where applicable, the QMSR, state regulatory authorities, and, in some cases, the Notified Body audits;

• miscommunication of design specifications due to errors/omissions by either the vendor or our company, resulting in delayed delivery of acceptable materials or components for incorporation into our devices or recall of finished products;

7 unchanged sentences

While we believe that alternative sources of supply may be available, we cannot be certain whether they will be available if and when we need them and that any alternative suppliers would be able to provide the quantity and quality of components and materials that we would need to manufacture our Zio patches if our existing suppliers were unable to satisfy our supply requirements.

Any significant delay or interruption in the supply of components or sub-assemblies, or our inability to obtain substitute components, sub-assemblies, or materials from alternate sources at acceptable prices and in a timely manner, could impair our ability to meet the demand for our Zio Services, significantly affect our future revenue, and harm our relations and reputation with physicians, hospitals, clinics, and patients.

We also rely on certain third-party vendors in connection with the analysis we perform to create diagnostic reports for our Zio Services, which is dependent upon a recording made by each Zio System.

For long-term continuous monitoring utilizing our Zio XT System, for example, requires the physical return of the Zio XT patch to one of our clinical centers and we predominantly rely on the U.S.

Any significant delay or interruption in the supply of components or sub-assemblies, or our inability to obtain substitute components, sub-assemblies, or materials from alternate sources at acceptable prices and in a timely manner, could impair our ability to meet the demand for our iRhythm Services, significantly affect our future revenue, and harm our relations and reputation with physicians, hospitals, clinics, and patients.

We also rely on certain third-party vendors in connection with the analysis we perform to create diagnostic reports for our iRhythm Services, which is dependent upon a recording made by each iRhythm ACM System.

For long-term continuous monitoring utilizing our Zio XT System, for example, requires the physical return of the Zio XT to one of our clinical centers and we predominantly rely on the U.S.

Postal Service (“USPS”) to perform this delivery service.

Delivery of the Zio XT patch to one of our clinical centers may be subject to disruption to the USPS delivery infrastructure.

Delivery of the Zio XT to one of our clinical centers may be subject to disruption to the USPS delivery infrastructure.

Further, for the MCT monitoring services utilizing our Zio AT System, we rely on the provision of cellular communication services for the timely transmission of patient information and reportable events.

The reliability of the electronic communication and cloud services required for these operations are subject to natural disasters, labor disruptions, human error, and infrastructure failure.

Any of these disruptions may render it difficult or temporarily impossible for us to provide some or all our Zio Services and bill for those services, adversely affecting our operating results, causing significant distraction for management, and negatively impacting our business reputation.

Any of these disruptions may render it difficult or temporarily impossible for us to provide some or all our iRhythm Services and bill for those services, adversely affecting our operating results, causing significant distraction for management, and negatively impacting our business reputation.

We also expect that our reliance on third-party vendors will increase as our business grows, exposing us to increased harm if such disruptions occur.

We have incorporated and continue to work to further incorporate AI into our products, services, and internal operations.

Implementation of artificial intelligence and machine learning technologies may result in legal and regulatory risks, reputational harm, or other adverse consequences to our business.

We have and are continuing to incorporate AI, including machine learning and independent algorithms, in certain of our products, services and internal operations, including in our MCT services with our Zio AT System, which is intended to enhance their operation and effectiveness internally and for physicians and patients.

Implementation of AI and machine learning technologies may result in legal and regulatory risks, reputational harm, or other adverse consequences to our business.

We have and are continuing to incorporate AI, including machine learning (including generative and predictive) algorithms, in certain of our products, services and internal operations, including in our MCT Services with our Zio AT System, which is intended to enhance their operation and effectiveness internally and for physicians and patients.

Our research and development of such technology remains ongoing.

4 unchanged sentences

Additionally, AI algorithms may be flawed or datasets may be insufficient or contain biased information resulting in perceived or actual negative outcomes.

AI solutions may be controversial because of their impact or perceived impact on human rights, privacy, employment, or other social, economic, or political issues, or if we are unable to develop effective internal policies and frameworks relating to the responsible development and use of AI models and systems, we may experience brand, reputational, and/or competitive harm, or could face legal liability.

In a healthcare context, model drift, explainability limits and reliance on de-identified or synthetic data that may be re-identifiable can exacerbate these risks.

If the output that AI algorithms assist in producing are or are alleged to be inaccurate, deficient, or biased, our business, financial condition, and results of operations may be adversely affected.

2 unchanged sentences

The regulations may impose onerous obligations and may require us to unexpectedly rework or reevaluate improvements to be compliant.

In particular, the EU Artificial Intelligence Act, which was adopted on June 13, 2024, will have a material impact on the way AI is regulated in the EU, may affect our use of AI technologies, and may require additional compliance measures and changes to our operations and processes.

In particular, the AI Act, which was adopted and entered into force in 2024 and is currently being implemented in phases since August 2024, has a material impact on the way AI is regulated in the EU, may affect our use of AI technologies, and may require additional compliance measures and changes to our operations and processes.

In the United States, there is ongoing tension between the states and the federal government over how best to regulate the use of AI.

It is possible that new laws and regulations will be adopted in the United States and elsewhere, or that existing laws and regulations may be interpreted, in ways that would affect our operations.

AI used in or as part of medical devices and other “high-risk” systems will be subject to prescriptive risk management, data governance, transparency, human oversight, and post-market monitoring obligations, which may require product, process, and documentation changes and could delay or limit deployment timelines.

Use of AI technologies may expose us to an increased risk of regulatory enforcement and litigation.

Additionally, our insurance coverage may not extend to all AI-related risks and may not cover us for all losses for errors or omissions caused by AI.

Furthermore, the integration of third-party AI models with our platform relies on certain safeguards implemented by the third-party developers of the underlying AI models, including those related to the accuracy, bias, and other variables of the data, and these safeguards may be insufficient.

3 unchanged sentences

The market for medical devices, including the remote cardiac monitoring segment, is competitive, dynamic, and marked by rapid and substantial technological development and product innovation.

While there are barriers that would challenge new entrants or existing competitors from developing products that compete directly with the devices used in our Zio Services, these barriers can be overcome.

Demand for our Zio Services and future related devices or services could be diminished by equivalent or superior products and technologies offered by competitors.

While there are barriers that would challenge new entrants or existing competitors from developing products that compete directly with the devices used in our iRhythm Services, these barriers can be overcome.

Demand for our iRhythm Services and future related devices or services could be diminished by equivalent or superior products and technologies offered by competitors.

If we are unable to innovate successfully, our services and related devices could become obsolete and our revenue would decline as our customers prescribe or purchase our competitors’ services.

In order to remain competitive, we must continue to develop new product offerings and enhancements to our Zio Services.

We can provide no assurance that we will be successful in fully recognizing the strategic value of our ECG database, expanding the indications for our Zio Services, developing new services and related devices, or commercializing them in ways that achieve market acceptance.

In order to remain competitive, we must continue to develop new product offerings and enhancements to our iRhythm Services.

We can provide no assurance that we will be successful in fully recognizing the strategic value of our ECG database, expanding the indications for our iRhythm Services, developing new services and related devices, or commercializing them in ways that achieve market acceptance.

In addition, if we develop new services, sales of those services may reduce revenue generated from our existing services.

Maintaining adequate research and development personnel and resources to meet the demands of the market is essential.

If we are unable to develop new services and related devices, applications, or features, or improve our algorithms due to constraints, such as insufficient cash resources, high employee turnover, inability to hire personnel with sufficient technical skills, inability or delay to obtain FDA marketing authorization or regulatory clearances in the EU and the UK, or a lack of other research and development resources, we may not be able to maintain our competitive position compared

to other companies.

Furthermore, many of our competitors devote a considerably greater amount of funds to their research and development programs than we do, and those that do not may be acquired by larger companies that would allocate greater resources to research and development programs.

2 unchanged sentences

These development and collaboration agreements may not result in the development of commercially viable devices or the generation of significant future revenues.

We have entered into a development and collaboration agreement in the past to develop certain next-generation Afib screening, detection, or monitoring devices to enhance our Zio Services, which could involve combining our technology platforms and capabilities with those of a third party, and we intend to enter into similar development and collaboration agreements with third parties in the future.

We have entered into a development and collaboration agreement in the past to develop certain next-generation Afib screening, detection, or monitoring devices to enhance our iRhythm Services, which could involve combining our technology platforms and capabilities with those of a third party, and we intend to enter into similar development and collaboration agreements with third parties in the future.

The success of our collaboration with third parties is highly dependent on the efforts provided to the collaboration by such third parties and us and the skill sets of our respective employees.

6 unchanged sentences

Accordingly, we cannot provide assurance that our collaboration with any third party will result in the successful development of commercially viable devices and services or result in significant additional future revenues for our company.

We generally intend to continue assessing the potential pathways for expanding indications and use cases for our Zio Services, and developing potential new products and services, for patient populations with unmet needs in the remote cardiac monitoring market and adjacent markets.

We generally intend to continue assessing the potential pathways for expanding indications and use cases for our iRhythm Services, and developing potential new products and services, for patient populations with unmet needs in the remote cardiac monitoring market and adjacent markets.

We intend to continue to invest in research and development efforts to further differentiate our biosensor, data analytics and reporting, information system, and digital platform and we may explore or enter into development or collaboration agreements with third parties to further these efforts.

6 unchanged sentences

• multiple, conflicting, and changing laws and regulations such as tax laws, privacy laws, export and import restrictions, employment laws, regulatory requirements, and other governmental approvals, permits, and licenses;

• obtaining and sustaining regulatory approvals, certifications, and regulatory compliance where required for the sale of our Zio Services in various countries or regions;

• obtaining and sustaining regulatory approvals, certifications, and regulatory compliance where required for the sale of our iRhythm Services in various countries or regions;

• requirements to maintain and secure data and the processing of that data on servers located within such countries or regions, which requirements may be subject to change;

1 unchanged sentence

• logistics and regulations associated with shipping and returning our Zio patches following patient use;

• limits on our ability to penetrate international markets if we are required to process our Zio Services locally;

• limits on our ability to penetrate international markets if we are required to process our iRhythm Services locally;

• financial risks, such as longer payment cycles, difficulty collecting accounts receivable, the effect of local and regional financial pressures on demand and payment for our services, fluctuations in trade policy and tariff regulations, changes in international tax regulations applicable to our business, and exposure to foreign currency exchange rate fluctuations, which may reduce the reported value of our foreign currency denominated revenues, expenses, and cash flows;

1 unchanged sentence

• increased risk of litigation or administrative proceedings in connection with our relationships with international business partners, including litigation against persons whom we believe have infringed on our intellectual property, infringement litigation filed against us, litigation against a competitor, or litigation filed against us by distributors or service providers resulting from a breach of contract or other claim, as well as disputes regarding government and public tenders, any of which may result in substantial costs to us, adverse judgments, settlements, and diversion of our management’s attention;

• increased risk of litigation or administrative proceedings in connection with product liability claims, driven in part by a growing third-party litigation funding market in the EU as well as legal and regulatory reform across product safety and product liability such as the newly adopted EU Product Liability Directive of October 23, 2024, the proposed AI Liability Directive and further implementation of the collective redress regime which may lead to group claims in respect of medical devices;

• increased risk of litigation or administrative proceedings in connection with product liability claims, driven in part by a growing third-party litigation funding market in the EU as well as legal and regulatory reform across product safety and product liability such as the EU Product Liability Directive (recently updated by Directive (EU) 2024/2853 to cover digital products like AI software), which makes it easier for individuals to claim compensation for harm caused by unsafe goods on the EU market, and further implementation of the collective redress regime which may lead to group claims in respect of medical devices;

• natural disasters, political and economic instability, including wars and other geopolitical conflicts, terrorism, political unrest, outbreak of disease, boycotts, curtailment of trade, and other market restrictions;

• risks associated with any shifts in economic relations between the UK and the EU, which could result in tariffs or quotas on imported goods or services moving between the UK and the EU;

• regulatory and compliance risks that relate to maintaining accurate information and control over activities subject to regulation under the Foreign Corrupt Practices Act of 1977, as amended (the “FCPA”), UK Bribery Act of 2010, and comparable laws and regulations in other countries;

• compliance risks associated with the General Data Protection Regulation (the “GDPR”) (including as it applies in the UK by virtue of the Data Protection Act 2018), enacted to protect the privacy of all individuals in the EU and the UK, and which places certain restrictions on the export of personally identifiable data outside of the EU or the UK, as applicable;

• regulatory and compliance risks that relate to maintaining accurate information and control over activities subject to regulation under the FCPA, UK Bribery Act of 2010, and comparable laws and regulations in other countries;

• compliance risks under the EU and UK General Data Protection Regulation (collectively, the “GDPR”), including restrictions on the cross-border transfers of personal data, as applicable;

• compliance risks associated with the revised regulations in the EU MDR that outline the requirements for medical device CE marking;

1 unchanged sentence

• compliance risks associated with the Japanese PMDA;

• compliance risks associated with the SMDO;

• compliance risks associated with new or upcoming regulations associated with AI applicable to Software as a Medical Device, including compliance with the EU Artificial Intelligence Act;

• compliance risks associated with new or upcoming requirements and expectations associated with medical device cybersecurity.

• compliance risks associated with the Swiss MedDO;

• compliance risks associated with new or upcoming regulations associated with AI applicable to Software as a Medical Device, including compliance with the EU AI Act;

• compliance risks associated with existing, new or upcoming requirements and expectations associated with medical device cybersecurity.

Any of these factors may require significant resources to address and could significantly harm our future international expansion and operations and, consequently, our revenue and results of operations.

5 unchanged sentences

The loss of a member of our senior management team or our professional staff would require the remaining executive officers to divert immediate and substantial attention to seeking a replacement.

We have recently experienced significant changes in our executive leadership, for example the March 2023 resignation of Douglas Devine as Chief Operating Officer and the August 2024 resignation of Brice Bobzien as Chief Financial Officer and appointment of Daniel Wilson as Chief Financial Officer, and we may experience further changes in executive leadership in the future.

We have experienced significant changes in our executive leadership in recent years and we may experience further changes in executive leadership in the future.

Changes to strategic or operating goals, which can often times occur with the appointment of new executives, can create uncertainty, may negatively impact our ability to execute quickly and effectively, and may ultimately be unsuccessful.

9 unchanged sentences

In addition to the need to scale our operational and service capacity, future growth will impose significant added responsibilities on management, including the need to identify, recruit, train, and integrate additional employees.

Rapid expansion in personnel could impact our capacity to manufacture our Zio patches, market, sell, and support our Zio Services, and analyze the data to produce Zio reports, which could result in inefficiencies and unanticipated costs, impacts to our Zio Services, including our Zio patches, and disruptions to our service operations.

Rapid expansion in personnel could impact our capacity to manufacture our Zio patches, market, sell, and support our iRhythm Services, and analyze the data to produce Zio reports, which could result in inefficiencies and unanticipated costs, impacts to our iRhythm Services, including our Zio patches, and disruptions to our service operations.

Additionally, rapid expansion could require us to rely on overtime to increase capacity that could, in turn, result in greater employee attrition and/or a loss in productivity during the process of recruiting and training additional resources and add to our operating expenses.

Further, a move toward automation to address, for example, staffing or scalability needs, could result in unintended consequences, such as increased scrap rate negatively impacting profitability.

As we seek to gain greater efficiency, we may look for ways to expand the automated portion of our Zio Services and require productivity improvements from our qualified cardiac technicians, within the framework of our wide-ranging regulatory obligations.

As we seek to gain greater efficiency, we may look for ways to expand the automated portion of our iRhythm Services and require productivity improvements from our qualified cardiac technicians, within the framework of our wide-ranging regulatory obligations.

Such improvements could impact the content of our Zio reports.

2 unchanged sentences

If we are unable to manage our growth effectively, it may be difficult for us to execute our business strategy and our business could be harmed.

Failure to receive the Zio System patches used for the provision of the Zio Services we provide may result in a loss of capital as well as revenue where the receipt of returned devices and processing of data retrieved from returned devices is required to provide our Zio Services.

Our Zio System patches and gateways are provided to patients either (1) during in-office visits with a healthcare provider or (2) remotely via at-home hookup.

Failure to receive the iRhythm ACM System patches used for the provision of the iRhythm Services we provide may result in a loss of capital as well as revenue where the receipt of returned devices and processing of data retrieved from returned devices is required to provide our iRhythm Services.

Our iRhythm ACM System patches and gateways are provided to patients either (1) during in-office visits with a healthcare provider or (2) remotely via at-home hookup.

We have also seen hybrid situations where accounts, in response to staffing shortages, provide in-clinic Zio device packages to patients for application at home.

Although in all three scenarios there is the potential that a patient will not return the device(s) at the conclusion of the wear period, home hookups historically result in a higher likelihood that the patient will fail to return his or her device, which negatively impacts our financial condition when we are unable to provide the Zio Services.

For example, when the patient returns the Zio Monitor patch to us at the end of the patient wear period, we provide the Zio Monitor services, which include the end of service report based on the data stored on the Zio Monitor patch, after which we submit a claim to the relevant payor or to the patient for the services rendered.

For example, when the patient returns a Zio monitor to us at the end of the patient wear period, we provide the Zio monitor services, which include the end of service report based on the data stored on the Zio monitor, after which we submit a claim to the relevant payor or to the patient for the services rendered.

If a patient fails to return a device, we experience financial losses, which include the cost of the device as well as the loss of potential revenue for the service that is contingent on the returned device for the submission of the associated claim.

12 unchanged sentences

Even if and when launched, the developed devices may also not be accepted in the marketplace, and there is no assurance that adequate coverage or reimbursement would be available, or that an alternative payment model can be developed.

In addition, we will likely face risks, uncertainties, and disruptions associated with the integration process, including difficulties in the integration of the operations and services of any acquired company, integration of acquired technology with our Zio Services, including our Zio Systems, diversion of our management’s attention from other business concerns, the potential loss of key employees or suppliers of the acquired businesses, and impairment charges if future acquisitions are not as successful as we originally anticipated.

In addition, we will likely face risks, uncertainties, and disruptions associated with the integration process, including difficulties in the integration of the operations and services of any acquired company, integration of acquired technology with our iRhythm Services, including our iRhythm ACM Systems, diversion of our management’s attention from other business concerns, the potential loss of key employees or suppliers of the acquired businesses, and impairment charges if future acquisitions are not as successful as we originally anticipated.

We may also face challenges integrating cybersecurity and data protection controls, heightened external scrutiny on acquired IP rights, regulatory exclusivity periods, and confidentiality agreements, and successor liability imposed by regulators for actions by a target prior to acquisition.

If we fail to successfully integrate other companies, products, or technologies that we acquire, our business could be harmed.

1 unchanged sentence

In addition, our operating results may suffer because of acquisition-related costs, amortization expenses, investment required to address risks associated with the acquisition, or charges relating to acquired intangible assets.

We also regularly evaluate a variety of other potential strategic transactions, including equity and other investments and strategic alliances.

Equity and other investments and strategic alliances pose additional risks, as we could share ownership and, in some cases, management responsibilities with one or more other parties whose objectives may diverge from ours over time;

who may not have the same priorities, strategies, or resources as we do;

or whose interpretation of applicable policies may differ from our own.

The success of our collaboration with BioIS and the extent to which we realize a return on investment in the technology licensed from BioIS is dependent on our achievement of certain regulatory milestones.

4 unchanged sentences

Should we fail to meet those milestones, or if there are material delays in doing so, this could impede our ability to commercialize any new products or solutions utilizing the technologies covered by the License Agreement and realize our return on investment.

We are currently in the early stages of exploring opportunities to expand into the market of sleep apnea screening and diagnostics, which carries unique regulatory requirements and represents an ongoing area of focus for government enforcement.

We are currently exploring opportunities to expand into the market of sleep apnea screening and diagnostics, which carries unique regulatory requirements and represents an ongoing area of focus for government enforcement.

Commercialization of new products and services in the sleep testing space will require a significant investment of time and resources.

If we are unable to successfully execute on these opportunities, it could have an adverse affect on our reputation, business, and results of operations.

Our exploration of the sleep apnea screening and diagnostics market is in the early evaluation stages, and although we are devoting time and resources to this evaluation, we do not anticipate meaningful revenue from any such opportunities to expand into the sleep apnea screening and diagnostics market for the foreseeable future.

We continue to devote time and resources into exploring the sleep apnea screening and diagnostics market.

We do not anticipate meaningful revenue from any such opportunities to expand into the sleep apnea screening and diagnostics market for the foreseeable future.

If we fail to capitalize on these opportunities, we may face threats from our competitors should they be able to commercialize products and services in the home sleep testing (“HST”) space on a more expeditious timeline.

Additionally, any new HST offering will be subject to specific requirements to qualify for reimbursement under Medicare and by third-party commercial payors.

Improper billing activities related to HST services have been an area of significant government scrutiny in recent years.

Additionally, any new HST product or service offering will be subject to specific requirements to qualify for reimbursement under Medicare and Medicaid and by third-party commercial payors.

Improper billing activities related to HST product or service offerings have been an area of significant government scrutiny in recent years.

Failure to comply with the myriad, complex legal and regulatory requirements surrounding the provision of sleep apnea diagnostics could subject us to substantial civil or criminal penalties, exclusion from participation in the Medicare program, reputational harm, and other adverse consequences to our business and results of operations.

1 unchanged sentence

Our use of third-party service providers or company resources located outside the United States to support certain customer care, clinical, and other operations of our IDTFs may present challenges, and if we are ineffective in limiting work performed by these service providers or company resources consistent with applicable regulations or our contractual agreements with commercial payors, we may be subject to penalties or experience loss of revenue.

Beginning in the third quarter of 2022, we engaged Sutherland Healthcare Solutions, Inc.

and Techindia Infoway Private Limited to support certain customer care and clinical operations of our IDTFs.

Beginning in the third quarter of 2022, we engaged third-party service providers to support certain customer care and clinical operations of our IDTFs.

We have developed operational and technical controls to limit the work performed by these vendors consistent with our interpretation of the Medicare coverage exclusion of services furnished outside the United States, other applicable laws and regulations, and any requirements imposed pursuant to our contracts with commercial payors.

If these controls do not work as intended, or if regulators or commercial payors disagree with our interpretation of these requirements and their application to our operations, we may be subject to a requirement to return funds already paid to us, civil monetary penalties, other government enforcement, as highlighted by a recent enforcement action against our competitor, BioTelemetry, Inc., with respect to the support of certain clinical operations by vendors performing work outside the United States, and termination of contracts with commercial payors, as well as the loss of revenue associated with those contracts.

If these controls do not work as intended, or if regulators or commercial payors disagree with our interpretation of these requirements and their application to our operations, we may be subject to a requirement to return funds already paid to us, civil monetary penalties, other government enforcement, as highlighted by a 2022 settlement of an enforcement action brought against our competitor, BioTelemetry, Inc., with respect to the support of certain clinical operations by vendors performing work outside the United States, and termination of contracts with commercial payors, as well as the loss of revenue associated with those contracts.

In addition, we are currently engaging with other third-party service providers that have resources located outside the United States, and we have established company resources in the Philippines to provide services in support of our IDTFs.

11 unchanged sentences

• federal and state laws and regulations regarding billing, claims payment, and enrollment for participation in government healthcare programs, including regulations requiring the timely identification and refunding of overpayments to Medicare and other federally funded healthcare programs;

• the federal Anti-Kickback Statute, which prohibits, among other things, any person from knowingly and willfully offering, soliciting, receiving, or providing remuneration, directly or indirectly, in exchange for or to induce either the referral of an individual for, or the purchase, order or recommendation of, any good or service for which payment may be made under federal healthcare programs, such as the Medicare and Medicaid programs;

• the federal AKS, which prohibits, among other things, any person from knowingly and willfully offering, soliciting, receiving, or providing remuneration, directly or indirectly, in exchange for or to induce either the referral of an individual for, or the purchase, order or recommendation of, any good or service for which payment may be made under federal healthcare programs, such as the Medicare and Medicaid programs;

• the federal FCA, which prohibits, among other things, individuals or entities from knowingly presenting, or causing to be presented, false claims, or knowingly using false statements, to obtain payment from the federal government;

2 unchanged sentences

• the federal Physician Payment Sunshine Act, or Open Payments, and its implementing regulations, which requires us to report payments or other transfers of value made to licensed physicians and certain mid-level health practitioners and teaching hospitals, as well as ownership and investment interests held by physicians and their immediate family members;

HIPAA also created criminal liability for knowingly and willfully falsifying or concealing a material fact or making a materially false statement in connection with the delivery of or payment for healthcare benefits, items, or services;

• the GDPR and the UK Data Protection Act 2018, which each provide legal requirements for the handling and disclosure (including across borders) of personal data collected in the EU and the UK, respectively;

• the FDA’s Code of Federal Regulations, including but not limited to, 21 CFR Parts 820, 803, 806, and 801, that outlines requirements for medical device design, testing, marketing authorization, manufacturing, labeling, distribution, and post-market surveillance requirements;

• Health Insurance Portability and Accountability Act (“HIPAA”), as amended by the Health Information Technology for Economic and Clinical Health Act, and its implementing regulations, which impose certain requirements for privacy, security, and electronic transmission of individually identifiable health information and establish criminal liability for knowingly making false statements or concealing material facts in connection with the delivery of or payment for healthcare benefits, items, or services;

• the GDPR, which provides legal requirements for the handling and disclosure (including across borders) of personal data collected in the EU and the UK;

• FDA’s Code of Federal Regulations, including but not limited to, 21 CFR Parts 820, 803, 806, and 801, that outlines requirements for medical device design, testing, marketing authorization, manufacturing, labeling, distribution, and post-market surveillance requirements;

• the EU MDR that outline requirements for medical device CE marking;

• the UK MDR, which, post the UK’s withdrawal from the EU, replaces the CE marking requirement for medical devices sold in the UK with a UKCA mark;

• the Swiss Medical Devices Ordinance, which governs the approval and importation requirements of medical devices into Switzerland;

• the PMDA, which outlines comprehensive standards for the design, evaluation, marketing approval, production, labeling, distribution, and ongoing monitoring of medical devices in Japan;

• the Swiss MedDO, which governs the approval and importation requirements of medical devices into Switzerland;

• the Japanese PMDA, which outlines comprehensive standards for the design, evaluation, marketing approval, production, labeling, distribution, and ongoing monitoring of medical devices in Japan;

• state law equivalents of each of the above U.S.

federal laws, such as anti-kickback and false claims laws which may apply to items or services reimbursed by any third-party payor, including commercial insurers, and state and foreign laws governing the privacy and security of individually identifiable information in certain circumstances (e.g., the Telephone Consumer Protection Act, the CAN-SPAM Act, and state privacy, consumer protection, and breach notification laws), many of which differ from each other in significant ways and often are not preempted by HIPAA, thus complicating compliance efforts.

federal laws, such as anti-kickback and false claims laws which may apply to items or services reimbursed by any third-party payor, including commercial insurers, and state and foreign laws governing the privacy and security of individually identifiable information in certain circumstances (e.g., the Telephone Consumer Protection Act, the CAN-SPAM Act, and state privacy, consumer protection, and data breach notification laws), many of which differ from each other in significant ways and often are not preempted by HIPAA, thus complicating compliance efforts.

These laws are broad in scope and available exceptions and exemptions are narrow;

4 unchanged sentences

If the government declines to intervene, the individual may pursue the case alone.

For violations assessed after January 15, 2025, the minimum FCA penalty increased from $13,946 to $14,308 per claim and the maximum penalty increased from $27,894 to $28,619 per claim.

In 2025, whistleblowers filed 1,297 qui tam lawsuits under the FCA—the highest number in a single year—and whistleblowers are becoming increasingly willing to pursue cases on their own following a declination by the government.

For violations assessed after July 3, 2025, the minimum FCA penalty increased from $13,946 to $14,308 per claim and the maximum penalty increased from $27,894 to $28,619 per claim.

In addition, FCA lawsuits may expose defendants to follow-on claims by private payers based on fraudulent marketing practices.

9 unchanged sentences

Any of the foregoing consequences could seriously harm our business and our financial results.

Further, in June 2024, the U.S.

Further, in 2024 the U.S.

Supreme Court reversed its longstanding approach under the Chevron doctrine, which provided for judicial deference to regulatory agencies, including FDA.

2 unchanged sentences

For example, this decision may result in more companies bringing lawsuits against FDA to challenge longstanding decisions and policies of FDA, which could undermine FDA’s authority, lead to uncertainties in the industry, and disrupt FDA’s normal operations, which could impact the timely review of any regulatory filings or applications we submit to FDA.

Changes in applicable laws or regulations or the interpretation or enforcement policies of regulators governing our IDTFs and Zio Services may constrain or require us to restructure our operations or adapt certain business strategies which may harm our revenue and operating results.

Changes in applicable laws or regulations or the interpretation or enforcement policies of regulators governing our medical devices, IDTFs and iRhythm Services may constrain or require us to restructure our operations or adapt certain business strategies, which may harm our revenue and operating results.

Healthcare laws and regulations, and interpretations of the same, change frequently and may change significantly in the future.

We may not be able to adapt our operations to address every new regulation or interpretation, and new regulations or interpretations may adversely affect our business.

For example, FDA has taken novel steps in recent years to regulate MCT devices—including Zio AT—through administrative actions including development of Product Code QYX and assignment of that Product Code to certain devices already on the market, and also to applicants seeking 510(k) clearance for devices used in MCT monitoring services.

FDA’s inclusion in the Product Code’s “Definition” of “Outpatient Cardiac Telemetry” devices certain activities in the purview of IDTFs and other monitoring locations presents the potential for these activities to be viewed as a component of the device subject to direct FDA oversight.

It remains unclear how FDA will continue to interpret and enforce the device requirements for devices that FDA assigns to Product Code QYX.

There also remains general uncertainty regarding future government activities, including enforcement policies.

For example, DOJ disbanded the CBP, which was responsible for enforcement of the FD&C Act.

Following dissolution of the CPB, on September 25, 2025, DOJ announced a restructuring under which the Civil Division’s litigation work would be consolidated into a new Enforcement & Affirmative Litigation Branch, and the Health and Safety Unit housed within the Fraud Section of DOJ’s Criminal Division is now charged with criminal enforcement of the FD&C Act.

The current presidential administration could also issue or promulgate executive orders, regulations, policies or guidance that adversely affect us or create a more challenging or costly environment to pursue the development of new diagnostic products or services.

Alternatively, state governments may attempt to address perceived gaps in regulation or react to changes at the federal level with changes to their own regulatory frameworks in a manner that is adverse to our operations.

If we become negatively impacted by future governmental orders, regulations, policies or guidance as a result of the current presidential administration or state regulatory responses, there could be a material adverse effect on us and our business.

We also cannot assure that a review of our business by courts or regulatory authorities would not result in a determination that adversely affects our revenue and operating results.

Our business could be negatively impacted by changes in the United States political environment.

Any policy changes as a result of the new presidential administration and Congress could significantly affect our business as well as the markets in which we operate.

Specific legislative and regulatory proposals discussed during election campaigns and more recently that might materially impact our business include, but are not limited to, promoting access to healthcare via market competition and pricing transparency, enhancing flexibility and choice in healthcare at the state and individual level, prioritizing domestic production and increasing tariffs on imports (which may complicate and increase costs associated with our supply chain), and rolling back regulatory initiatives adopted under the previous administration.

Any policy changes as a result of the current presidential administration and Congress could significantly affect our business as well as the markets in which we operate.

Specific legislative and regulatory proposals discussed during election campaigns and since inauguration that might materially impact our business include, but are not limited to, promoting access to healthcare via market competition and pricing transparency, enhancing flexibility and choice in healthcare at the state and individual level, prioritizing domestic production and increasing tariffs on imports (which may complicate and increase costs associated with our supply chain and our international

expansion), and rolling back regulatory initiatives adopted under the previous administration.

We cannot predict whether industry initiatives to seek tariff carve-outs for devices or other life sciences goods and products will be successful.

Additionally, the new administration is expected to evaluate potential budgetary cuts and reallocation of regulatory priorities by key federal agencies that oversee our products, services, and associated reimbursement, including FDA and the U.S.

Department of Health and Human Services more broadly.

The new administration also has issued, and is expected to continue relying upon, executive orders to address a wide range of policy areas, some of which may impact our business.

Examples of executive orders that have already been issued on public health and healthcare topics include orders seeking to withdraw the United States from the World Health Organization, rescind a 2022 order issued under the prior administration to lower the cost of prescription drugs, and address COVID-19 vaccination requirements.

Some of these legislative and regulatory proposals have manifested to date in the form of specific tariff proposals, and actions to reduce the size of the federal government, including large-scale reductions in force at FDA.

The loss of key personnel at FDA, including those in leadership positions, is likely to impact the operations at FDA, which could result in, among other things, delays or limitations on our ability to obtain guidance from FDA on our products, longer review times, and delays in obtaining regulatory approvals.

The escalating global economic competition and trade tensions among the U.S.

and its trading partners could have an adverse effect on our business, results of operations, financial condition and cash flows, and there is risk of additional tariffs and other kinds of restrictions .

The current administration also has issued, and is expected to continue relying upon, executive orders to address a wide range of policy areas, some of which may impact our business.

Examples of executive orders that have already been issued on public health and healthcare topics include orders seeking to promote healthcare price transparency, deliver most-favored-nation pricing for prescription drugs to patients and facilitate direct-to-consumer drug sales, promote domestic production of pharmaceutical products, and expand access to in vitro fertilization.

Such political developments may require us to allocate significant time, resources, and expense to modifying our policies and procedures, processes, systems, and practices to ensure compliance or adapt to the new regulatory climate, particularly to the extent such actions are subject to protracted and uncertain legal challenges.

To the extent changes in the political environment have a negative impact on us or on our markets, our business, results of operation, and financial condition could be materially and adversely affected in the future.

Our business relies on orders from licensed healthcare providers, and the continuing clinical acceptance and adoption of our Zio Services depends upon strong working relationships with healthcare providers, including physicians.

Our business relies on orders from licensed healthcare providers, and the continuing clinical acceptance and adoption of our iRhythm Services depends upon strong working relationships with healthcare providers, including physicians.

These relationships, interactions, and arrangements are subject to a high degree of scrutiny by government regulators and enforcement bodies.

As a CMS-enrolled IDTF, we may only provide our Zio Services upon receipt of a valid order from a licensed healthcare provider for use in the diagnosis and treatment of a patient’s medical condition.

Accordingly, our revenue and the success of our business rely on the continued clinical acceptance and adoption of our Zio Services by healthcare providers whose patients require remote cardiac monitoring services.

In addition to continuing to demonstrate the clinical value of our Zio Services, we also must support widespread clinical acceptance and adoption of our Zio Services by maintaining strong working relationships with these healthcare providers, including physicians.

As a CMS-enrolled IDTF, we may only provide our iRhythm Services upon receipt of a valid order from a licensed healthcare provider for use in the diagnosis and treatment of a patient’s medical condition.

Accordingly, our revenue and the success of our business rely on the continued clinical acceptance and adoption of our iRhythm Services by healthcare providers whose patients require remote cardiac monitoring services.

In addition to continuing to demonstrate the clinical value of our iRhythm Services, we also must support widespread clinical acceptance and adoption of our iRhythm Services by maintaining strong working relationships with these healthcare providers, including physicians.

However, as we work to establish and maintain these relationships, we face significant scrutiny of these relationships, interactions, and arrangements by government regulators and enforcement agencies.

Failure to structure and maintain these relationships, interactions, and arrangements in compliance with applicable laws and regulations, including those targeted at fraud and abuse like the federal Anti-Kickback Statute and the FCA, could expose us to significant legal and financial repercussions, including government civil and criminal investigations, civil monetary penalties, criminal penalties, and/or exclusion from federal healthcare programs.

Failure to structure and maintain these relationships, interactions, and arrangements in compliance with applicable laws and regulations, including those targeted at fraud and abuse like the AKS and the FCA, could expose us to significant legal and financial repercussions, including government civil and criminal investigations, civil monetary penalties, criminal penalties, and/or exclusion from federal healthcare programs.

Our communications with healthcare stakeholders – physicians and other healthcare professionals, payors, and similar entities, as well as patients and lay caregivers – are subject to a high degree of scrutiny for compliance with a wide range of laws and regulations.

5 unchanged sentences

This is a continued area of focus for regulators.

In the fourth quarter of 2023, FDA issued final guidance focused on the presentation of quantitative risk and efficacy information to the consumer audience, with heightened focus on presenting such information in a manner that is accurate, understandable, and consumer-friendly.

The FTC has also released updated guidance on health claims, with a high expectation for clinical data to support these claims.

4 unchanged sentences

We may also seek to communicate certain information with physicians and scientists and their practices and health systems or with payors and similar entities, and may rely on a range of laws, regulations, regulatory guidance governing topics, including scientific exchange, and communication of healthcare economic information and product information under the Preapproval Information Exchange Act.

Recent FDA final guidance on communication of scientific information on unapproved uses of cleared/approved medical products with HCPs further illustrates the agency’s focus on ensuring that such communications to those in a position to order or prescribe products are consistent with available scientific data and subject to organizational controls maintaining separation and distinction from promotional marketing.

For example, certain of our physicians may order the Zio Services for patients who are under 18, which is outside the cleared indications for use.

FDA's final guidance, issued in January 2025, on communication of scientific information on unapproved uses of cleared/approved medical products with HCPs further illustrates the agency’s focus on ensuring that such communications to those in a position to order or prescribe products are consistent with available scientific data and subject to organizational controls maintaining separation and distinction from promotional marketing.

For example, certain of our physicians may order the iRhythm Services for patients who are under 18, which is outside the cleared indications for use.

While we do not intend for any personnel to promote our devices for pediatric use and we have policies addressing appropriate responses to unsolicited requests for information about pediatric use, our approach may be subject to ongoing scrutiny from FDA.

5 unchanged sentences

While we can engage in general marketing initiatives, consistent with applicable law, we cannot make telephone, computer, and in-person contacts for the purpose of soliciting business for our IDTF.

Regarding patients for whom we have received a valid order for our Zio Services, we may send or make text messages, emails, phone calls, and other communications for various informational, business purposes, including to confirm accurate demographic and payor information or to assist a patient via a home hookup.

Communication-related laws require consent prior to certain communications and provide a specified monetary damage award or fine for each violation which could result in particularly significant damage awards or fines.

For example, under the Telephone Consumer Protection Act (“TCPA”), plaintiffs may seek actual monetary loss or statutory damages of $500 per violation, whichever is greater, and courts may treble the damage award for willful or knowing violations.

Regarding patients for whom we have received a valid order for our iRhythm Services, we may send or make text messages, emails, phone calls, and other communications for various informational, business purposes, including to confirm accurate demographic and payor information or to assist a patient via a home hookup.

Communication-related laws may require consent prior to certain communications and provide a specified monetary damage award or fine for each violation which could result in particularly significant damage awards or fines.

For example, under the Telephone Consumer Protection Act (“TCPA”), plaintiffs may seek actual monetary loss or statutory damages of $500 per violation, whichever is greater, and up to $1,500 per violation for willful or knowing violations, and courts may award injunctive relief.

In the wake of a 2021 decision by the U.S.

Supreme Court that limited the applicability of the TCPA, several states have enacted or introduced legislation that would regulate text messages and certain telephone calls to individuals.

Supreme Court that limited the applicability of the TCPA, several states have enacted or introduced legislation that would regulate text messages and certain telephone calls to individuals and, in some instances, impose stricter requirements than federal law.

Certain non ‑ marketing healthcare messages may qualify for limited TCPA exemptions if specific conditions are met (e.g., content limits, frequency caps, opt ‑ out, and no charge to the recipient).

We may be subject to lawsuits (including class-action lawsuits) containing allegations that our business violated the TCPA or other communications laws.

These lawsuits may seek damages (including statutory damages) and injunctive relief, among other remedies.

We also may face enforcement by the Federal Communications Commission (including under the Telemarketing Sales Rule and Do ‑ Not ‑ Call provisions) and state attorneys general.

A determination that there have been violations of the TCPA or other statutes regulating communications with patients could expose us to significant damage awards that could, individually or in the aggregate, materially harm our business.

3 unchanged sentences

If these models are unsuccessful, or if we are unable to fully comply with such laws as we pursue these strategies, our commercial success could be compromised and we could face substantial penalties.

Our operations may be directly or indirectly affected by various broad state and federal healthcare fraud and abuse laws, including the federal Anti-Kickback Statute, the FCA, the Anti-Mark Up Rule, and the Medicare Beneficiary Inducement Statute.

Our operations may be directly or indirectly affected by various broad state and federal healthcare fraud and abuse laws, including the federal AKS, the FCA, the Anti-Mark Up Rule, and the Medicare Beneficiary Inducement Statute.

For some of our services, we directly bill physicians or other healthcare entities, that, in turn, bill payors, and the amounts we bill may include a risk-based pricing component.

4 unchanged sentences

Risks Related to Financial and Accounting Matters

In the future we may identify additional material weaknesses or otherwise fail to maintain an effective system of internal controls, which may result in material misstatements of our consolidated financial statements or cause us to fail to meet our periodic reporting obligations.

We previously identified material weaknesses in our internal control over financial reporting.

A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim consolidated financial statements will not be prevented or detected on a timely basis.

As previously disclosed, in preparing our consolidated financial statements as of and for the years ended December 31, 2021 and 2020, our management concluded that our disclosure controls and procedures and our internal control over financial reporting were not effective at the reasonable assurance level due to a failure to maintain a sufficient number of professionals with an appropriate level of accounting and internal control knowledge, training, and experience to timely and accurately analyze, record, and disclose accounting matters.

This material weakness contributed to additional material weaknesses, which have been previously disclosed and remediated.

In aggregate, these material weaknesses (including the previously remediated material weaknesses) contributed to the misstatement of our revenues, revenue reserves, bad debt expense, property and equipment, research and development expense, and related financial disclosures, and in the revision of our consolidated financial statements for the years ended December 31, 2017, December 31, 2018, and each interim period therein as well as the quarters ended March 31, 2019, June 30, 2019, and September 30, 2019.

Additionally, this material weakness could result in a misstatement of account balances or disclosures that would result in a material misstatement to the annual or interim consolidated financial statements that would not be prevented or detected.

To address this material weakness, we took actions designed to improve our internal control over financial reporting and remediate the control deficiencies that led to the material weakness, including hiring additional accounting and finance personnel with an appropriate level of expertise, providing for additional management oversight over financial reporting including through the establishment of a SOX Steering Committee within our internal audit function, and implementing new controls and processes.

As of the year ended December 31, 2022, we concluded that our remediation efforts had been successful and that the previously identified material weakness in internal control over financial reporting had been remediated.

However, while the material weakness has been remediated, we continue to seek improvements to enhance our control environment and to strengthen our internal controls to provide reasonable assurance that our financial statements continue to be fairly stated in all material respects.

If we discover additional weaknesses in our system of internal financial and accounting controls and procedures, our consolidated financial statements may contain material misstatements, and we could be required to restate our financial results.

Our failure to maintain an effective system of internal controls, which may result in material misstatements of our consolidated financial statements or cause us to fail to meet our periodic reporting obligations.

As a public company, we are subject to certain reporting requirements, including those under the Sarbanes-Oxley Act, which requires, among other things, that we maintain effective internal control over financial reporting and disclosure controls and procedures.

In order to maintain and improve the effectiveness of our internal controls and disclosure controls and procedures, we have expended, and anticipate that we will continue to expend, significant resources, including accounting related costs and significant management oversight.

Maintaining effective internal control and disclosure controls and procedures requires ongoing attention and resources.

We continue to seek improvements to enhance our control environment and to strengthen our internal controls to provide reasonable assurance that our financial statements continue to be fairly stated in all material respects.

If we discover weaknesses in our system of internal financial and accounting controls and procedures, our consolidated financial statements may contain material misstatements, and we could be required to restate our financial results.

Our internal control over financial reporting will not prevent or detect all errors and all fraud.

7 unchanged sentences

We typically experience reduced revenue during the third quarter, as well as during the year-end holiday season.

We believe this is the result of physicians and patients taking vacations, and patients electing to delay our monitoring services during the summer months and holidays.

We believe this

is the result of physicians and patients taking vacations, and patients electing to delay our monitoring services during the summer months and holidays.

We believe that period-to-period comparisons of our operating results may not be meaningful and should not be relied on as an indication of our future performance.

1 unchanged sentence

Factors that might cause quarterly fluctuations in our operating results include:

• our inability to manufacture an adequate supply of our Zio Systems to support demand for our Zio Services at appropriate quality levels and acceptable costs;

• possible delays in our research and development programs or in the completion of any third-party clinical trials relating to our Zio Services;

• a lack of acceptance of our Zio Services, including our Zio Systems, by physicians and potential patients;

• our inability to manufacture an adequate supply of our iRhythm ACM Systems to support demand for our iRhythm Services at appropriate quality levels and acceptable costs;

• possible delays in our research and development programs or in the completion of any third-party clinical trials relating to our iRhythm Services;

• a lack of acceptance of our iRhythm Services, including our iRhythm ACM Systems, by physicians and potential patients;

• the inability of patients to receive reimbursements from third-party payors;

• the purchasing patterns of physicians and patients, including as a result of seasonality;

• failures to comply with regulatory requirements, which could lead to withdrawal of our Zio Services, including our Zio Systems, from the market;

• our failure to continue the commercialization of our Zio Services;

• failures to comply with regulatory requirements, which could lead to withdrawal of our iRhythm Services, including our iRhythm ACM Systems, from the market;

• our failure to continue the commercialization of our iRhythm Services;

• competition;

• inadequate financial and other resources;

• global business, political, and economic conditions, including inflation, interest rate volatility, cybersecurity events, uncertainty with respect to the federal debt ceiling and budget and potential government shutdowns related thereto, potential instability in the global banking system, political instability, and military hostilities, including ongoing geopolitical conflicts, such as the war in Ukraine and conflict in the Middle East.

Further, we recognize a portion of our revenue from non-contracted third-party commercial payors.

For example, during the year ended December 31, 2025, revenue from non-contracted third-party commercial payors accounted for approximately 7% of our total revenue.

We have limited visibility as to when we will receive payment for our Zio Services with non-contracted payors and we or our third party billing vendors must appeal any negative payment decisions, which often delays collections further.

We have limited visibility as to when we will receive payment for our iRhythm Services with non-contracted payors and we or our third party billing vendors must appeal any negative payment decisions, which often delays collections further.

Additionally, a portion of the revenue from non-contracted payors is received from patient co-pays, which we may not receive for several months following delivery of service or may not receive at all.

7 unchanged sentences

As of December 31, 2025, we had an accumulated deficit of $803.4 million.

We have financed our operations to date primarily through private and public offerings of equity securities and revenue generated by prescriptions of our Zio Services.

We have and expect to continue to incur significant research and development, sales and marketing, regulatory, and other expenses as we expand our marketing efforts to increase the prescription of our Zio Services, expand existing relationships with physicians, obtain regulatory clearances or approvals for our current or future services and related devices, conduct clinical trials on our existing and future services, and develop new services or add new features to our existing Zio Services.

We have financed our operations to date primarily through private and public offerings of equity and convertible debt securities and revenue generated by prescriptions of our iRhythm Services.

We have and expect to continue to incur significant research and development, sales and marketing, regulatory, and other expenses as we expand our marketing efforts to increase the prescription of our iRhythm Services, expand existing relationships with physicians, obtain regulatory clearances or approvals for our current or future services and related devices, conduct clinical trials on our existing and future services, and develop new services or add new features to our existing iRhythm Services.

We also expect that our general and administrative expenses will continue to increase due to, among other things, the operational and regulatory burdens applicable to medical service providers that are public companies.

As a result, we expect to continue to incur operating losses in the future.

As a result, we may continue to incur operating losses in the future.

These losses, among other things, may have an adverse effect on our stockholders’ equity and the value of our common stock.

5 unchanged sentences

The amount of funding we may need will depend on many factors, including:

• the revenue generated by our Zio Services;

• the revenue generated by our iRhythm Services;

• the costs, timing, and risks of delay of additional regulatory approvals;

• the expenses we incur in manufacturing, developing, selling, and marketing our Zio Services;

• our ability to scale our manufacturing operations to meet demand for the Zio Systems used in our current and any future Zio Services or other offerings;

• the expenses we incur in manufacturing, developing, selling, and marketing our iRhythm Services;

• our ability to scale our manufacturing operations to meet demand for the iRhythm ACM Systems used in our current and any future iRhythm Services or other offerings;

• the costs of filing, prosecuting, defending, and enforcing any patent claims and other intellectual property rights;

6 unchanged sentences

• the acquisition of business, products, and technologies.

If adequate funds are not available, we may not be able to commercialize our Zio Services at the rate we desire and/or we may have to delay the development or commercialization of our Zio Services or license to third parties the rights to commercialize services or technologies that we would otherwise seek to commercialize.

We also may have to reduce sales, marketing, customer support, or other resources devoted to our Zio Services.

If adequate funds are not available, we may not be able to commercialize our iRhythm Services at the rate we desire and/or we may have to delay the development or commercialization of our iRhythm Services or license to third parties the rights to commercialize services or technologies that we would otherwise seek to commercialize.

We also may have to reduce sales, marketing, customer support, or other resources devoted to our iRhythm Services.

Any of these factors could harm our business and financial condition.

17 unchanged sentences

We are involved in legal proceedings related to securities litigation, patent litigation and other matters and may become involved in other legal proceedings that arise from time to time in the future.

For example, as discussed further in Note 8, Commitments and Contingencies, to the Consolidated Financial Statements, a putative securities class action lawsuit has been filed against us and certain of our current officers or former officers alleging violations of Sections 10(b) and 20(a) of the Exchange Act and SEC Rule 10b-5 promulgated thereunder, and two patent lawsuits have been filed against us by companies affiliated with Baxter International.

Any claims against us, whether meritorious or not, can be time-consuming, result in costly litigation, be harmful to our reputation, require significant management attention, and divert significant resources.

For example, as discussed further in Note 8, Commitments and Contingencies, to the Consolidated Financial Statements, a putative securities class action lawsuit was filed against iRhythm Technologies and certain of its then current and former officer alleging violations of Sections 10(b) and 20(a) of the Exchange Act and SEC Rule 10b-5 promulgated thereunder, and two patent lawsuits have been filed against iRhythm Technologies by companies affiliated with Baxter International.

Any claims against us or our subsidiaries, whether meritorious or not, can be time-consuming, result in costly litigation, be harmful to our reputation, require significant management attention, and divert significant resources.

In addition, the expense of litigation and the timing of this expense from period to period are difficult to estimate and subject to change.

4 unchanged sentences

For example, as discussed further in Note 8, Commitments and Contingencies, to the Consolidated Financial Statements, in March 2021, we received a grand jury subpoena from the U.S.

Attorney’s Office for the Northern District of California requesting information related to communications with FDA and our Zio Systems, and, in September 2021, received a subpoena requesting additional information.

Attorney’s Office for the Northern District of California requesting information related to communications with FDA and our iRhythm ACM Systems, and, in September 2021, received a subpoena requesting additional information.

On April 4, 2023, we received a Subpoena Duces Tecum from the Consumer Protection Branch, Civil Division of the DOJ, requesting production of various documents regarding our products and services.

In addition, on May 25, 2023, we received a warning letter from FDA, which resulted from the inspection of our facility located in Cypress, California that concluded in August 2022.

The warning letter alleges non-conformities to regulations for medical devices, including medical device reporting requirements, relating to our Zio AT System and medical device quality system requirements.

The warning letter alleged non-conformities to regulations for medical devices, including medical device reporting requirements, relating to our Zio AT System and medical device quality system requirements.

On July 15, 2024, FDA initiated inspections of our Cypress and San Francisco facilities.

We received 483 observations at the close of the inspection.

We are cooperating fully in connection with these matters.

Any future investigations of our executives, our managers, or our company could result in significant liabilities or penalties to us, as well as adverse publicity.

Even if we are found to have complied with applicable law, the investigation or litigation may pose a considerable expense and would divert management’s attention, and have a potentially negative impact on the public’s perception of us, all of which could negatively impact our financial position and results of operations.

Further, should we be found out of compliance with any of these laws, regulations, or programs, depending on the nature of the findings, our business, our financial position, and our results of operations could be negatively impacted.

On December 12, 2025, we received a civil investigative demand from DOJ’s Civil Division’s Commercial Litigation Branch seeking information and documents related to Zio AT and our associated claims for reimbursement.

We have cooperated, and are continuing to cooperate, fully in connection with these matters.

Further, three decisions from the U.S.

3 unchanged sentences

The third decision extended the statute of limitations within which entities may challenge agency actions.

These cases may result in increased litigation by industry against regulatory agencies and impact how such agencies choose to pursue enforcement and compliance actions.

These cases may result in increased litigation by industry parties against regulatory agencies and impact how such agencies choose to pursue enforcement and compliance actions.

However, the specific, lasting effects of these decisions, which may vary within different judicial districts and circuits, is unknown.

1 unchanged sentence

Compliance with requirements of being a public company may strain our resources and divert management’s attention.

As a public company, we are subject to laws and regulations relating to corporate governance and public disclosure, including the Sarbanes-Oxley Act of 2002, the Dodd-Frank Wall Street Reform and Consumer Protection Act, the rules and regulations implemented by the SEC, and The Nasdaq Stock Market listing rules.

Compliance with these laws and regulations, including new laws and regulations or revisions to existing laws and regulations, has required and will continue to require, substantial management time and oversight and the incurrence of significant accounting and legal costs.

8 unchanged sentences

Our effective tax rates could be affected by numerous factors, including changes in the mix of earnings in countries with differing statutory tax rates, changes in the valuation of deferred tax assets and liabilities, and changes in tax laws or their interpretation, both in and outside the United States.

For example, in 2017, the U.S.

government enacted the TCJA, which made significant changes to the taxation of business entities, including the requirement to capitalize research and development expenditures and amortize such expenditures over five years for domestic expenditures and fifteen years for foreign expenditures for taxable years beginning on or after January 1, 2022.

While it is possible that Congress may modify or repeal this provision, we have no assurance that this provision will be modified or repealed and even if Congress makes any such decision, it may not be retroactive, and could still therefore result in an impact on cash from operating activities and on the balance of our deferred taxes.

For example, under the TCJA, as amended by the legislation commonly known as the One Big Beautiful Bill Act (“OBBBA”), for tax years beginning after December 31, 2021, taxpayers are required to capitalize and amortize certain research and development expenditures over fifteen years if incurred in foreign jurisdictions.

For tax years beginning after December 31, 2021, and beginning on or before December 31, 2024, taxpayers generally were required to capitalize and amortize certain research and development expenditures over five years if incurred in the United States;

however, beginning after that period, the OBBBA restored immediate deductibility of research and development expenditures incurred in the United States.

In addition, we have a presence in the UK, as well as sales in the UK, such that any changes in tax laws in the UK will impact our business.

22 unchanged sentences

We rely on a combination of patents, copyrights, trademarks, trade secret laws, confidentiality and invention assignment agreements with employees and third parties, unfair competition, and other related laws to protect our intellectual property rights.

Our patents and patent applications are directed to covering key aspects of the design, manufacture, and use of our Zio Services, including our Zio Systems.

Third parties may assert infringement or misappropriation claims against us with respect to our current or future Zio Services, including our Zio Systems.

We are aware of numerous patents issued to third parties that may relate to aspects of our business, including the design and manufacture of the Zio Systems used in connection with our Zio Services.

Whether a product infringes a patent involves complex legal and factual issues, the determination of which is often uncertain.

Our patents and patent applications are directed to covering key aspects of the design, manufacture, and use of our iRhythm Services, including our iRhythm ACM Systems.

Third parties may assert infringement or misappropriation claims against us with respect to our current or future devices and services, including our iRhythm ACM Systems.

We are aware of numerous patents issued to third parties that may relate to aspects of our business, including the design and manufacture of the iRhythm ACM Systems used in connection with our iRhythm Services.

Whether a device or service infringes a patent involves complex legal and factual issues, the determination of which is often uncertain.

Therefore, we cannot be certain that we have not infringed the intellectual property rights of such third parties or others.

Our competitors may assert that our Zio Systems or the methods we employ to deliver our Zio Services are covered by U.S.

Further, the intellectual property ownership and licensed rights, including patent rights, surrounding AI technologies, which we are increasingly building into our products and services, have not been fully addressed by U.S.

courts or other federal, state or foreign laws or regulations, and the use or adoption of AI technologies in our products and services may expose us to copyright infringement, patent infringement, or other intellectual property misappropriation claims.

Our competitors may assert that our iRhythm ACM Systems or the methods we employ to deliver our iRhythm Services are covered by U.S.

or foreign patents held by them and we may be required to settle such allegations in the future.

This risk is exacerbated by the fact that there are numerous issued patents and pending patent applications relating to remote cardiac monitoring services and the associated devices granted to third parties.

There may be existing patents or patent applications now pending by third parties of which we are unaware that may later result in issued patents that our Zio Services, including our Zio Systems, inadvertently infringe.

There may be existing patents or patent applications now pending by third parties of which we are unaware that may later result in issued patents that our iRhythm Services, including our iRhythm ACM Systems, inadvertently infringe.

As the number of competitors in the remote cardiac monitoring market grows, the possibility of patent infringement by us or a patent infringement claim against us increases.

1 unchanged sentence

Any infringement or misappropriation claim could cause us to incur significant costs, place significant strain on our financial resources, divert management’s attention from our business, and harm our reputation.

In addition, if the relevant patents are upheld as valid and enforceable and we are found to infringe such patents, we could be prohibited from using any portion of our Zio Services, including our Zio Systems, that is found to infringe such patent unless we could obtain licenses to use the technology covered by the patent or are able to design around the patent.

We may be unable to obtain a license on terms acceptable to us, if at all, and we may not be able to redesign our Zio Services, including our Zio Systems, to avoid infringement.

We may be unable to maintain or renew licenses on terms acceptable to us, if at all, and we may be prohibited from selling any portion of our Zio Services, including our Zio Systems, that required the technology covered by the relevant licensed patents.

Although patent and intellectual property disputes in the healthcare and medical devices area have often been settled through licensing or similar arrangements, costs associated with such arrangements may be substantial and would likely include ongoing royalties.

Even if we are able to redesign our Zio Services, including our Zio Systems, to avoid an infringement claim, we may not receive FDA approval for such changes in a timely manner or at all.

In addition, licensing technologies from third parties exposes us to increased risk of being the subject of intellectual property infringement and vulnerabilities due to, among other things, our lower level of visibility into the development process with respect to such technology and the care taken to safeguard against risks.

In addition, if the relevant patents are upheld as valid and enforceable and we are found to infringe such patents, we could be prohibited from using any portion of our iRhythm Services, including our iRhythm ACM Systems, that is found to infringe such patent unless we could obtain licenses to use the technology covered by the patent or are able to design around the patent.

We may be unable to obtain a license on terms acceptable to us, if at all, and we may not be able to redesign our iRhythm Services, including our iRhythm ACM Systems, to avoid infringement.

We may be unable to maintain or renew licenses on terms acceptable to us, if at all, and we may be prohibited from selling any portion of our iRhythm Services, including our iRhythm ACM Systems, that required the technology covered by the relevant licensed patents.

Although patent and intellectual property disputes in the healthcare and medical devices

area have often been settled through licensing or similar arrangements, costs associated with such arrangements may be substantial and would likely include ongoing royalties.

Even if we are able to redesign our iRhythm Services, including our iRhythm ACM Systems, to avoid an infringement claim, we may not receive FDA approval for such changes in a timely manner or at all.

In addition, licensing or acquiring technologies from third parties exposes us to increased risk of being the subject of intellectual property infringement and vulnerabilities due to, among other things, our lower level of visibility into the development process with respect to such technology and the care taken to safeguard against risks.

We currently rely on or incorporate, and will in the future rely on or incorporate, technology that we license from third parties, including software, into our solutions.

18 unchanged sentences

Our issued patents, and those that may issue in the future, may be challenged, invalidated, or circumvented, which could limit our ability to stop competitors from marketing related devices and services.

In addition, there are numerous recent changes to the patent laws and proposed changes to the rules of the U.S.

Patent and Trademark Office (“USPTO”), which may have a significant impact on our ability to protect our technology and enforce our intellectual property rights.

In addition, there are numerous recent changes to the patent laws and proposed changes to the rules of the USPTO, which may have a significant impact on our ability to protect our technology and enforce our intellectual property rights.

We cannot be certain that we were the first to make the inventions claimed in our pending patent applications or that we were the first to file for patent protection.

22 unchanged sentences

Opposition or cancellation proceedings may be filed against our trademarks, and our trademarks may not survive such proceedings.

Additionally, we are aware of at least one third party that has registered the “IRHYTHM” mark in the EU in connection with computer software for controlling and managing patient medical information, heart rate monitors, and heart rate monitors to be worn during moderate exercise, among other uses.

However, despite that registration, we have successfully obtained a registration for the IRHYTHM mark in the EU in Classes 9 and 10 and we also own many national registrations for IRHYTHM in Europe.

To protect our proprietary rights, we may in the future need to assert claims of infringement against third parties.

The outcome of litigation to enforce our intellectual property rights in patents, copyrights, trade secrets, or trademarks is highly unpredictable, could result in substantial costs and diversion of resources, and could have a material adverse effect on our business, financial condition, and results of operations regardless of the final outcome of such litigation.

outcome of such litigation.

In the event of an adverse judgment, a court could hold that some or all of our asserted intellectual property rights are not infringed, or are invalid or unenforceable, and could award attorneys’ fees.

4 unchanged sentences

Cybersecurity risks, including those involving network security breaches, services interruptions and other incidents affecting the confidentiality, integrity or availability of our data and systems, could result in the compromise of confidential data or critical systems and give rise to potential harm to our patients, remediation costs and other expenses, expose us to liability under HIPAA, breach notification laws, consumer protection laws, or other common law theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business and operations.

Cybersecurity threats can come from a variety of sources, ranging in sophistication from an individual hacker to malfeasance by employees, consultants or service providers to criminal or other unauthorized threat actors, including state-sponsored attacks.

Unauthorized parties may also attempt to gain access to our systems or facilities through fraud, trickery or other forms of deceiving our employees, and contractors.

9 unchanged sentences

For example, during the first quarter of 2024, we experienced a temporary delay in the billing of our contracted and non-contracted payer customers, performed by our third-party claims processing vendor.

The delay was due to a cybersecurity incident experienced by Change Healthcare, a division of UnitedHealth Group, which our third-party vendor engages for services relating to billing and collections.

While we substantially cleared the billing backlog as of the end of the first quarter of 2024, the delay in billing resulted in a temporary delay in our cash collections.

The increasing use of mobile devices for remote access to our systems and data also increases these vulnerabilities and risks.

The delay was due to a cybersecurity incident experienced by Change Healthcare, a division of UnitedHealth Group, which one of our third-party vendors engages for services relating to billing and collections.

The delay in billing resulted in a temporary delay in our cash collections.

Risks related to our reliance on third-party vendors, industry concentration risks and single points of failure could materially affect our collections and operations.

Additionally, the increasing use of mobile devices for remote access to our systems and data also increases these vulnerabilities and risks.

Our internal technology systems and infrastructure, and those of our contractors, are vulnerable to damage from natural disasters, acts of terrorism, war and other acts of foreign governments and failures of telecommunication, electrical and other critical systems.

1 unchanged sentence

Because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and may not immediately produce signs of intrusion, we may be unable to anticipate these incidents or techniques, timely discover them, or implement adequate preventative measures.

We have in the past been subject to cyber-attacks and data breaches and expect that we will be subject to additional cyber-attacks in the future and may experience future data breaches.

We have in the past been subject to cyber-attacks and data breaches and expect that we will be subject to additional cyber-attacks in the future and may experience future data breaches and other security incidents.

Such incidents may impact the integrity, availability or confidentiality of the data we maintain or disrupt our information systems, devices or business, including our ability to deliver our services.

As a result, cybersecurity, physical security and the continued development and enhancement of our controls, processes and practices designed to protect our enterprise, information systems and data from attack, damage or unauthorized access remain a priority for us.

Public company cybersecurity disclosure requirements may necessitate prompt disclosure of material incidents and enhanced risk management and governance disclosures, which could increase compliance costs and expose us to enforcement, shareholder litigation, and reputational harm if our controls are deemed inadequate.

Our cyber insurance may not cover all losses, limits may be insufficient, and coverage could become more expensive or unavailable.

As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any cybersecurity vulnerabilities.

If our Zio devices are subject to cybersecurity vulnerabilities leading to potential harm to patients or compromises data security and confidentiality, we may be required to initiate field actions, including device recalls, or subject to government inspections, investigations or enforcement actions.

In addition to any other risks this may present, this could cause significant harm to our brand reputation and consumer trust in our devices.

The secure maintenance, processing, and transmission of data is critical to our business operations and we are dependent on sophisticated information technology systems to operate our business.

2 unchanged sentences

Despite our security measures and business controls, which undergo routine testing internally and by external parties, our information technology and infrastructure may still be vulnerable to attacks.

Further, any resulting unauthorized access, disclosure, or other loss of information could result in legal claims or proceedings, and liability under laws that protect the privacy of personal information and regulatory penalties, increase in operating expenses, incurrence of expenses, including notification, mitigation, and remediation costs, disrupt our operations and the services we provide to our clients, or damage our reputation, any of which could adversely affect our profitability, revenue, and competitive position.

Cyber-attacks aimed at accessing our devices and services, or related devices and services, and modifying or using them in a way inconsistent with our FDA marketing authorizations and regulatory certifications in the EU and the UK, could create risks to patients.

We also rely on third-party service providers, including cloud, claims, and payment vendors;

their cybersecurity or availability failures could materially disrupt our operations, and we may have limited ability to monitor or control their security posture beyond contractual and diligence measures.

Any resulting unauthorized access, disclosure, or other loss of information by us or one of our service providers could result in legal claims or proceedings, and liability under laws that protect the privacy of personal data and regulatory penalties, increase in operating expenses, incurrence of expenses, including notification, mitigation, and remediation costs, disrupt our operations and the services we provide to our clients, or damage our reputation, any of which could adversely affect our profitability, revenue, and competitive position.

Cyber-attacks aimed at accessing our devices and services, or related devices and services, and modifying or using them in a way inconsistent with our FDA marketing authorizations and regulatory certifications or approvals in the EU, Switzerland, Japan and the UK, could create risks to patients.

Medical devices are increasingly connected to the Internet, hospital networks, and other medical devices to provide features that improve healthcare and increase the ability of healthcare providers to treat patients and of patients to manage their conditions and are subject to extensive oversight from FDA and foreign regulatory authorities with requirements designed to manage the risks of cyber-attacks with the potential to impact patient safety.

As such, cyber-attacks aimed at accessing our devices and services, or related devices and services, and modifying or using them in a way inconsistent with our FDA marketing authorizations and regulatory certifications in the EU and the UK, may create risks to patients and potential exposure to our company.

As such, cyber-attacks aimed at accessing our devices and services, or related devices and services, and modifying or using them in a way inconsistent with our FDA marketing authorizations and regulatory certifications or approvals in the EU, Switzerland, Japan and the UK, may create risks to patients and potential exposure to our company.

We are required to comply with various laws and regulations with respect to implementing appropriate cybersecurity measures to ensure our devices and services are not compromised or disrupted, which could lead to potential risk of harm or injury to patients.

FDA has issued guidance on cybersecurity management of medical devices during post market, and more recently finalized guidance on cybersecurity considerations for quality systems in device premarket submissions.

These guidance documents serve as an indicator of agency expectations.

If we do not implement the necessary quality measures to manage cybersecurity and minimize or avoid risks of a potential cyber-attack that impacts our devices and services, we could be subject to a range of FDA enforcement action, and such a situation could trigger the need for a recall, a hold on the distribution of our products, or require other corrective actions to our products.

FDA has issued guidance on cybersecurity management of medical devices during post market, and cybersecurity considerations for quality systems in device premarket submissions.

These guidance documents serve as an indicator of agency expectations for the cybersecurity oversight of the devices as they are deployed for use by patients and HCPs, and the assurance that cybersecurity is appropriately integrated into a company’s quality system.

If we do not implement quality measures to manage cybersecurity and minimize or avoid risks of a potential cyber-attack that impacts our devices and services in a way that regulators deem satisfactory, this could impact our product applications and in addition we could be subject to a range of FDA enforcement action or investigation by other regulatory agencies or enforcement bodies including DOJ, and such a situation could trigger the need for a recall, a hold on the distribution of our products, or require other corrective actions to our products.

In the EU, a number of interlocking rules regulate cybersecurity for medical devices.

2 unchanged sentences

The requirements in the NIS 2 Directive will sit alongside the cybersecurity requirements addressed in the EU MDR, which are supplemented by specific guidance issued by the EU’s Medical Device Coordination Group.

In addition, at this time, we cannot predict the impact on cybersecurity compliance that recent and forthcoming EU legislation such as the Artificial Intelligence Act and the European Health Data Space Regulation, may have.

In addition, on January 15, 2024, the European Commission launched a European action plan to strengthen the cybersecurity of hospitals and healthcare providers.

Several specific actions will be rolled out progressively in 2025 and 2026.

At this time, it is not clear what these actions will entail.

Additional EU and UK legislative developments, including product cybersecurity rules and evolving device software requirements, may impose further security-by-design, vulnerability handling, and reporting obligations applicable to our products and operations including the ePrivacy Directive, the Data Act, and the AI Act;

however, the timing, scope, and impact of these measures remain subject to national implementing acts and other ongoing developments.

In the UK, the government announced as part of its consultations on the future regulation of medical devices, that it intends to develop legislation to impose cybersecurity requirements for software as a medical device, including for AI.

2 unchanged sentences

Many of these laws and regulations are subject to change and uncertain interpretation, and could result in claims, changes to our business practices, monetary penalties, increased cost of operations, or declines in customer growth or engagement, or otherwise harm our business.

In the ordinary course of our business, we collect, use and store, and transmit confidential and sensitive data, such as our proprietary business information and that of our suppliers, contractors, customers, vendors and others, as well as personal information, including health information, of these parties and of our patients.

As a result, we are subject to several foreign, federal and state laws and regulations protecting the use, disclosure and confidentiality of certain personal information, namely individually identifiable information, and restricting the use and disclosure of that information.

In the ordinary course of our business, we collect, use and store, and transmit confidential and sensitive data, such as our proprietary business information and that of our suppliers, contractors, customers, vendors and others, as well as personal data, including health information, of these parties and of our patients.

As a result, we are subject to several foreign, federal and state laws and regulations protecting the use, disclosure and confidentiality of certain personal data, namely individually identifiable information, and restricting the use and disclosure of that information.

These laws include foreign, federal and state healthcare privacy laws, telehealth laws, breach notification laws and consumer protection laws.

2 unchanged sentences

Further, if we fail to comply with applicable privacy laws, we could face civil and criminal penalties, or claims for breach of contract.

In the United States, there are numerous federal and state patient and consumer, privacy and data security laws and regulations governing the collection, use, disclosure, protection and breach of personal information.

HIPAA, for example, establishes privacy standards that limit the use and disclosure of individually identifiable health information (or “protected health information”);

1 unchanged sentence

and sets forth notification standards in the event of a data breach.

In addition, states have shown an increased interest in regulating personal information in general (for example, through state consumer privacy laws and data breach notification laws), and specifically with respect to consumer health data.

In addition, states have shown an increased interest in regulating personal data in general (for example, through state consumer privacy laws and data breach notification laws), and specifically with respect to consumer health data.

Outside HIPAA, over a third of U.S.

states have passed comprehensive state consumer privacy laws and several have passed consumer health data laws which impose additional consent, transparency, data minimization, geo-fencing, and third-party sharing restrictions that may apply to health-related data that is not regulated as protected health information, all of which are subject to active enforcement by state attorneys general.

Foreign data protection, privacy, and related laws and regulations can be more restrictive than those in the United States.

For example, data localization laws in some countries generally mandate that certain types of data collected in a particular country be stored and/or processed solely within that country.

Other foreign laws, such as the GDPR, impose strict requirements for processing and cross-border transfers of personal data.

Other foreign laws, such as the GDPR and Swiss data protection laws, impose strict requirements for processing and cross-border transfers of personal data outside of the EU, UK or Switzerland to a “third country,” including the United States, unless particular compliance mechanisms are implemented.

The mechanisms that we and many other companies rely upon for such data transfers (for example, standard contractual clauses or the EU-U.S.

and Swiss-U.S.

Data Privacy Framework (“DPF”) and the UK extension to the DPF) are the subject of legal challenge, regulatory interpretation, and judicial decisions.

While we maintain EU-U.S., Swiss-U.S.

DPF certifications, we still rely on the standard contractual clauses for intercompany data transfers from the EU, Switzerland, and the UK to the United States in certain situations.

As supervisory authorities continue to issue further guidance on personal data, we could suffer additional costs, complaints, or regulatory investigations or fines, and if we are otherwise unable to transfer personal data between and among countries and regions in which we operate, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations and could adversely affect our financial results.

Determining how protected health information may be used, shared, or processed in compliance with applicable privacy standards and our contractual obligations can be complex and may be subject to changing interpretation.

Both foreign and U.S.

legislators and regulators may make legal and regulatory changes, or interpret and apply existing laws, in ways that require us to incur substantial costs, expose us to unanticipated civil or criminal liability, or cause us to change our business practices.As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints and/or regulatory investigations or fines;

As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints and/or regulatory investigations or fines;

we may have to stop using certain tools and vendors and make other operational changes;

4 unchanged sentences

We do not have any control over the analysts, or the content and opinions included in their reports.

If any of the analysts who cover us issues an adverse or misleading opinion regarding us, our business model, our intellectual property, or our stock performance, or if any third-party preclinical studies and clinical trials involving our Zio Services or our results of operations fail to meet the expectations of analysts, our stock price would likely decline.

If any of the analysts who cover us issues an adverse or misleading opinion regarding us, our business model, our intellectual property, or our stock performance, or if any third-party preclinical studies and clinical trials involving our iRhythm Services or our results of operations fail to meet the expectations of analysts, our stock price would likely decline.

If one or more of such analysts cease coverage of us or fail to publish reports on us regularly, we could lose visibility in the financial markets, which in turn could cause a decline in our stock price or trading volume.

2 unchanged sentences

It is likely that our stock price will continue to be volatile in the future.

In addition, the trading prices for our common stock and the common stocks of other medical service providers been highly volatile as a result of macroeconomic conditions, including inflation, interest rate volatility and ongoing geopolitical conflicts, such as the war in Ukraine and conflict in the Middle East.

The market price of our common stock is influenced by many factors that are beyond our control, including the following:

10 unchanged sentences

• global health pandemics, such as the COVID-19 pandemic;

• terrorist acts, acts of war, or periods of widespread civil unrest, including ongoing geopolitical conflicts, such as the war in Ukraine and conflict in the Middle East;

• terrorist acts, acts of war, or periods of widespread civil unrest, including ongoing geopolitical conflicts, such as the war in Ukraine and conflicts in the Middle East and Venezuela;

• general economic, industry, and market conditions, including inflation, interest rate volatility, uncertainty with respect to the federal debt ceiling and budget and potential government shutdowns related thereto, potential instability in the global banking system, and fluctuating foreign currency exchange rates.

32 unchanged sentences

Our indebtedness could adversely affect our financial health and our ability to respond to changes in our business.

As a result of our level of increased debt following the completion of the offering of our 1.50% Convertible Senior Notes due 2029 (the “2029 Notes”):

• our vulnerability to adverse general economic conditions and competitive pressures will be heightened;

• we will be required to dedicate a larger portion of our cash flow from operations to interest payments, limiting the availability of cash for other purposes;

As a result of our level of increased debt following the completion in 2024 of the offering of our 1.50% Convertible Senior Notes due 2029 of our wholly owned subsidiary, iRhythm Technologies, (the “2029 Notes”), of which we have provided a full and unconditional guarantee:

• our vulnerability to adverse general economic conditions and competitive pressures is heightened;

• we are required to dedicate a larger portion of our cash flow from operations to interest payments, limiting the availability of cash for other purposes;

• our flexibility in planning for, or reacting to, changes in our business and industry may be more limited;

3 unchanged sentences

Further, even if we are able to obtain additional financing, we may be required to use such proceeds to repay a portion of our debt.

Furthermore, we will not be restricted under the terms of the indenture governing the 2029 Notes from incurring additional debt, securing future debt, recapitalizing our debt, repurchasing our stock, pledging our assets, making investments, paying dividends, guaranteeing debt or taking a number of other actions that could have the effect of diminishing our ability to make payments on the 2029 Notes when due.

Furthermore, neither we nor iRhythm Technologies are restricted under the terms of the indenture governing the 2029 Notes (the "Indenture") from incurring additional debt, securing future debt, recapitalizing our debt, repurchasing our stock, pledging our assets, making investments, paying dividends, guaranteeing debt or taking a number of other actions that could have the effect of diminishing our ability to make payments on the 2029 Notes when due.

Servicing our debt requires a significant amount of cash, and we may not have sufficient cash flow from our business to pay our indebtedness.

8 unchanged sentences

The capped call transactions may affect the value of our common stock.

In connection with the pricing of the 2029 Notes, we entered into capped call transactions with the option counterparties.

In connection with the pricing of the 2029 Notes, iRhythm Technologies entered into capped call transactions with the option counterparties.

The 2029 Capped Calls are expected generally to reduce the potential dilution to our common stock upon conversion of the 2029 Notes and/or offset any cash payments we are required to make in excess of the principal amount of converted 2029 Notes, as the case may be, with such reduction and/or offset subject to a cap.

The option counterparties or their respective affiliates may modify their hedge positions by entering into or unwinding various derivatives with respect to our common stock and/or purchasing or selling our common stock or other securities of ours in secondary market transactions prior to the maturity of the 2029 Notes (and are likely to do so during any observation period related to a conversion of 2029 Notes or following any redemption or repurchase of 2029 Notes by us, in each case, if we elect to unwind a corresponding portion of the 2029 Capped Calls in connection with such conversion or such redemption or repurchase).

The option counterparties or their respective affiliates may modify their hedge positions by entering into or unwinding various derivatives with respect to our common stock and/or purchasing or selling our common stock or other securities of ours in secondary market transactions at any point prior to the maturity of the 2029 Notes (and are likely to do so during any observation period related to a conversion of 2029 Notes or following any redemption or repurchase of 2029 Notes by us, in each case, if we elect to unwind a corresponding portion of the 2029 Capped Calls in connection with such conversion or such redemption or repurchase).

This activity could also cause or avoid an increase or a decrease in the market price of our common stock.

8 unchanged sentences

Conversion of the 2029 Notes will, to the extent we deliver shares upon conversion of such 2029 Notes, dilute the ownership interest of existing stockholders, including holders who had previously converted their 2029 Notes, or may otherwise depress our stock price.

The 2029 Notes, although issued by iRhythm Technologies, our wholly owned subsidiary, are convertible into shares of our common stock.

The conversion of some or all of the 2029 Notes will dilute the ownership interests of existing stockholders to the extent we deliver shares upon conversion of any of such 2029 Notes.

2 unchanged sentences

The conditional conversion feature of the 2029 Notes, if triggered, may adversely affect our financial condition and operating results.

In the event the conditional conversion feature of the 2029 Notes is triggered, holders of the 2029 Notes will be entitled to convert the 2029 Notes at any time during specified periods at their option.

If one or more holders elect to convert their 2029 Notes, unless we elect to satisfy our conversion obligation by delivering solely shares of our common stock (other than cash in lieu of any fractional share), we would be required to settle a portion or all of our conversion obligation through the payment of cash, which could adversely affect our liquidity.

Currently, holders of the 2029 Notes are entitled to convert through March 4, 2026 as a result of the Holding Company Transaction.

If one or more holders elect to convert their 2029 Notes, unless we elect to satisfy our conversion oblig ation by delivering solely shares of our common stock (other than cash in lieu of any fractional share), we would be required to settle a portion or all of our conversion obligation through the payment of cash, which could adversely affect our liquidity.

In addition, even if holders of the 2029 Notes do not elect to convert their 2029 Notes, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the 2029 Notes as a current rather than long-term liability, which would result in a material reduction of our net working capital.

The accounting method for convertible debt securities that may be settled in cash, such as the 2029 Notes, could have a material effect on our reported financial results.

Under current accounting principles, we do not expect to separately account for the liability and equity components of the 2029 Notes and will instead present the entire amount of the 2029 Notes as debt on the balance sheet.

Under current accounting principles, we accounted for the entire amount of the 2029 Notes as debt on our balance sheet, as opposed to separately accounting for the liability and equity components of the 2029 Notes.

Additionally, under the “if-converted” method, diluted earnings per share is generally calculated assuming that all the debt securities were converted solely into shares of common stock at the beginning of the reporting period, unless the result would be anti-dilutive, which could adversely affect our diluted earnings per share.

3 unchanged sentences

General Risk Factors

We may be impacted by domestic and global economic and political conditions, as well as natural disasters, pandemics, and other catastrophic events, which could adversely affect our business, financial condition, or results of operations.

Our operations and performance may vary based on worldwide economic and political conditions, which have been adversely impacted by continued global economic uncertainty, political instability, and military hostilities in multiple geographies, including ongoing geopolitical conflicts such as the war in Ukraine and conflict in the Middle East, domestic and global inflationary trends, interest rate volatility, uncertainty with respect to the federal debt ceiling and budget and potential government shutdowns related thereto, potential instability in the global banking system, global supply shortages, and a tightening labor market.

A severe or prolonged economic downturn or period of global political instability could drive hospitals and other healthcare professionals to tighten budgets and curtail spending, which could in turn negatively impact rates at which physicians prescribe our Zio Services.

We may be impacted by domestic and global economic and political conditions, as well as natural disasters, severe weather, pandemics, and other catastrophic events, which could adversely affect our business, financial condition, or results of operations.

Our operations and performance may vary based on worldwide economic and political conditions, which have been adversely impacted by continued global economic uncertainty, political instability, and military hostilities in multiple geographies, including ongoing geopolitical conflicts such as the war in Ukraine and conflicts in the Middle East and Venezuela, domestic and global inflationary trends, interest rate volatility, uncertainty with respect to the federal debt ceiling and budget and potential government shutdowns related thereto, potential instability in the global banking system, global supply shortages, and a tightening labor market.

In addition, higher unemployment rates or reductions in employer-provided benefits plans could result in fewer commercially insured patients, resulting in a reduction in our margins and impairing the ability of uninsured patients to make timely payments.

3 unchanged sentences

We cannot predict the timing, strength, or duration of an economic downturn, instability, or recovery, whether worldwide, in the United States, or within our industry.

In addition, legislation has been introduced in Congress to limit certain U.S.

biotechnology companies from using equipment or services produced or provided by select Chinese biotechnology companies, including those affiliated with the manufacture of certain components of our Zio Monitor System, and others in Congress have advocated for the use of existing executive branch authorities to limit those Chinese service providers’ ability to engage in business in the U.S.

In addition, the BIOSECURE Act was signed into law in December 2025 as part of the National Defense Authorization Act restricting U.S.

federal contracts and funding for companies using biotech equipment or services from "biotechnology companies of concern" ("BCCs"), to curb national security risks.

A phased rollout includes publishing lists of BCCs, issuing guidance, and revising Federal Acquisition Regulations with full prohibitions taking effect over a period of years.

Compliance with this law will require us to perform additional supply chain due diligence and potentially change supplier sources if we wish to do business with the U.S.

government such as the Veterans Administration.

We cannot predict what actions may ultimately be taken with respect to trade relations between the United States and China or other countries, what products and services may be subject to such actions or what actions may be taken by the other countries in retaliation.

Further, climate-related events, including the increasing frequency of extreme weather events, natural disasters, or other catastrophic events may cause damage or disruption to our operations, international commerce, and the global economy, and could have an adverse effect on our business, operating results, and financial condition.

In the event of a natural disaster, including a major earthquake, blizzard, or hurricane, or a catastrophic event such as a fire, power loss, cyberattack, or telecommunications failure, we may be unable to continue our operations and may endure system and service interruptions, reputational harm, delays in development of our Zio Systems and Zio Services, breaches of data security, and loss of critical data, all of which could cause us to experience higher attrition, losses, and additional costs to maintain or resume operations, or otherwise have an adverse effect on our business and operating results.

Further, climate-related events, including the increasing frequency of extreme or disruptive weather events, natural disasters, or other catastrophic events may have the potential to damage or disrupt our business and/or the business of our customers or third-party suppliers, and may cause us to experience higher attrition, losses, and additional costs to maintain or resume operations.

In addition, such climate-related events may cause damage or disruption to international commerce and the global economy, and could have an adverse effect on our business, operating results and financial condition.

In the event of a natural disaster, including a major earthquake, blizzard, or hurricane, or a catastrophic event such as a fire, power loss, cyberattack, or telecommunications failure, we may be unable to continue our operations and may endure system and service interruptions, reputational harm, delays in development of our iRhythm ACM Systems and iRhythm Services, breaches of data security, and loss of critical data, all of which could cause us to experience higher attrition, losses, and additional costs to maintain or resume operations, or otherwise have an adverse effect on our business and operating results.

In addition, these events may impact or delay patient visits or the ability of prescribers or patients to receive deliveries from third parties, such as the U.S.

Postal Service.

Further, we do not maintain insurance sufficient to compensate us for the potentially significant losses that could result from disruptions to our services.

3 unchanged sentences

An increasing number of participants in the medical services industry are joining voluntary ESG groups or organizations, such as the Responsible Business Alliance.

These ESG provisions and initiatives are subject to change, can be unpredictable, and may be difficult and expensive for us to comply with, given our reliance on our supply chain and the outsourced manufacturing of certain components and sub-assemblies of the Zio Systems used with our Zio Services.

At the same time, an increasing number of stakeholders, regulators and lawmakers have expressed or pursued contrary views, including the proposal or enactment of “anti-ESG” policies, legislation, executive orders or initiatives or issued related legal opinions.

6 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors