Grace Therapeutics, Inc.

We are increasingly dependent on third-party provided software applications and computing infrastructure to conduct key operations. We depend on both our own procured systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.

Given the importance of cybersecurity to our business, we maintain a cybersecurity program that is based on a set of cybersecurity policies and processes to support our controls and our preparedness for treatment of identified information security risks. We also undergo periodic evaluations of our cybersecurity program through cybersecurity assessment and cybersecurity incident response tabletop exercises, conducted by our cybersecurity advisors. As a result of such assessments and exercises, a number of processes have been established or are being enhanced upon to support the protection of our data and systems.

We assess and manage cybersecurity risks associated with third-party service providers through a range of processes, including performing risk-based due diligence during onboarding, and conducting periodic reassessments of key and higher-risk vendors based on defined criticality and risk criteria.

We also seek to obtain and review cybersecurity audit reports (e.g., SOC reports) where available and incorporate appropriate security, data protection, and incident notification provisions into our contracts. While these measures are designed to mitigate third-party risks, they may not prevent all adverse events.

Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats

In the event of a cybersecurity incident, we maintain a Cybersecurity Incident Response Plan. Pursuant to the plan and its escalation protocols, designated personnel are responsible for assessing the severity of a cybersecurity incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the cybersecurity incident, and performing post-incident analysis and program enhancements, as appropriate. We have a relationship with various law firms to assist with advisory on legal aspects of addressing cybersecurity incidents and communicating accordingly.

Governance

Management Oversight

The existing controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our information technology (“IT”) consultant. Our IT consultant leverages its over 35 years of experience. Our IT consultant is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity incidents. Our IT consultant reports on its activities to senior management who then assess and manage risks of cybersecurity threats.

Board Oversight

While our Board of Directors (the “Board”) has overall responsibility for risk oversight, the Audit Committee of the Board (the “Audit Committee”) oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, monitoring, reporting and, where appropriate, providing recommendations to the Board regarding compliance with our internal policies and its progress in remedying any material deficiencies, including those related to our security policies, including the physical safeguarding of corporate assets and security of our networks and information systems. The Audit Committee receives periodic updates from management regarding the cybersecurity program, including top threats and risks, and updates on the cybersecurity roadmap.

Cybersecurity Risks

We maintain a Risk Management Policy that governs the process in which we identify cybersecurity risks, evaluate their associated impacts and risk levels, and document them accordingly in the Cybersecurity Risk Register.

Although we have experienced phishing and similar attempts for unauthorized access to our information technology systems and data, during the last three years, we did not experience any material cybersecurity incidents or threats, including as a result of any prior incidents or attempts, that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against such threats and incidents. For additional information, see “Item 1A—Risk Factors.”