BIODESIX INC

Previous wording

We have incurred losses since our inception and expect to continue to incur losses for the foreseeable future. We reported net losses of $42.9 million and $52.1 million for the years ended December 31, 2024 and 2023, respectively. As a result of these losses, as of December 31, 2024, we had an accumulated deficit of approximately $462.5 million.

Current wording

We have incurred losses since our inception and expect to continue to incur losses for the foreseeable future. We reported net losses of $35.3 million and $42.9 million for the years ended December 31, 2025 and 2024, respectively. As a result of these losses, as of December 31, 2025, we had an accumulated deficit of approximately $497.8 million.

Previous wording

As of December 31, 2024, we had approximately 273 full and part-time employees. Over the next several years, we expect to continue to significantly increase the number of our employees and the scope of our operations, particularly in the areas of sales, marketing and reimbursement, product development, regulatory affairs and other functional areas, including finance, accounting, quality and legal. Additionally, we expect to expand our testing capacity as we commercialize additional diagnostic tests. To manage our anticipated future growth, we must continue to implement and improve our managerial, operational quality and financial systems, expand our facilities and continue to recruit and train additional qualified personnel. Due to our limited financial resources, we may not be able to manage the expansion of our operations or recruit and train additional qualified personnel in an effective manner. Any inability to manage growth could delay the execution of our business plans or disrupt our operations and have a material and adverse effect on our business, financial condition, and results of operations.

Current wording

As of December 31, 2025, we had approximately 334 full and part-time employees. Over the next several years, we expect to continue to significantly increase the number of our employees and the scope of our operations, particularly in the areas of sales, marketing and reimbursement, product development, regulatory affairs and other functional areas, including finance, accounting, quality and legal. Additionally, we expect to expand our testing capacity as we commercialize additional diagnostic tests. To manage our anticipated future growth, we must continue to implement and improve our managerial, operational quality and financial systems, expand our facilities and continue to recruit and train additional qualified personnel. Due to our limited financial resources, we may not be able to manage the expansion of our operations or recruit and train additional qualified personnel in an effective manner. Any inability to manage growth could delay the execution of our business plans or disrupt our operations and have a material and adverse effect on our business, financial condition, and results of operations.

Previous wording

For the years ended December 31, 2024 and 2023, Medicare reimbursed 39% and 43%, respectively, of our total revenue to us. For the years ended December 31, 2024 and 2023, one customer accounted for 7% and 10%, respectively, of our total revenue. There are risks whenever a large percentage of total revenues are concentrated with a limited number of payers and customers. It is not possible for us to predict the level of demand for our diagnostic tests and services that will be generated by any of these customers in the future. In addition, revenues from these larger customers may fluctuate from time to time based on these customers’ business needs, the timing of which may be affected by market conditions or other factors outside of our control. These payers and customers could also potentially pressure us to reduce the prices we charge for our diagnostic tests and services, which could have an adverse effect on our margins and financial position and could negatively affect our revenues and results of operations. If any of our largest payers terminates its relationship with us or our tests are no longer reimbursable by such payer, such termination could negatively affect our revenues and results of operations.

Current wording

For the years ended December 31, 2025 and 2024, Medicare reimbursed 32% and 39%, respectively, of our total revenue to us. There are risks whenever a large percentage of total revenues are concentrated with a limited number of payers and customers. It is not possible for us to predict the level of demand for our diagnostic tests and services that will be generated by any of these customers in the future. In addition, revenues from these larger customers may fluctuate from time to time based on these customers’ business needs, the timing of which may be affected by market conditions or other factors outside of our control. These payers and customers could also potentially pressure us to reduce the prices we charge for our diagnostic tests and services, which could have an adverse effect on our margins and financial position and could negatively affect our revenues and results of operations. If any of our largest payers terminates its relationship with us or our tests are no longer reimbursable by such payer, such termination could negatively affect our revenues and results of operations.

Previous wording

We are exposed to significant future payments and other obligations associated with our acquisition of Oncimmune, U.S.A., and may not realize the advantages we expect from this acquisition.

Current wording

We are exposed to significant future payments and other obligations associated with our acquisition of Freenome (formerly Oncimmune, U.S.A).

Previous wording

Our acquisition may require us to incur non-recurring and other charges, increase our near and long-term expenditures, or disrupt our management and business. We cannot be certain that, following the realization of this acquisition, we will achieve the revenue or specific net income that justifies our entry into it. This could delay our sales and marketing efforts, which would harm our business prospects, financial condition and results of operations.

Current wording

Our acquisition may require us to incur non-recurring and other charges, increase our near and long-term expenditures, or disrupt our management and business. This could delay our sales and marketing efforts, which would harm our business prospects, financial condition and results of operations.

Previous wording

In general, under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended (the Code) a corporation that undergoes an ownership change, generally defined as a greater than 50% change by value in its equity ownership by certain shareholders over a three-year period, is subject to limitations on its ability to utilize its pre-change net operating losses (NOLs) and its research and development credit carryforwards to offset future taxable income. The applicable rules generally operate by focusing on changes in ownership among stockholders considered by the rules as owning, directly or indirectly, 5% or more of the stock of a company, as well as changes in ownership arising from new issuances of stock by the company. We believe that our NOLs are currently not subject to limitation under these rules. However, if we undergo an ownership change now or in the future, our ability to utilize NOLs and research and development credit carryforwards could be limited by Sections 382 and 383 of the Code. Future changes in stock ownership may be beyond our control. In addition, our ability to deduct net interest expense may be limited if we have insufficient taxable income for the year during which the interest is incurred, and any carryovers of such disallowed interest would be subject to the limitation rules similar to those applicable to NOLs and other attributes. For these reasons, in the event we experience a change of control, we may not be able to utilize a material portion of the NOLs, research and development credit carryforwards or disallowed interest expense carryovers, even if we attain profitability.

Current wording

In general, under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended (the Code) a corporation that undergoes an ownership change, generally defined as a greater than 50% change by value in its equity ownership by certain shareholders over a three-year period, is subject to limitations on its ability to utilize its pre-change net operating losses (NOLs) and its research and development credit carryforwards to offset future taxable income. The applicable rules generally operate by focusing on changes in ownership among stockholders considered by the rules as owning, directly or indirectly, 5% or more of the stock of a company, as well as changes in ownership arising from new issuances of stock by the company. If we undergo an ownership change now or in the future, our ability to utilize NOLs and research and development credit carryforwards could be limited by Sections 382 and 383 of the Code. Future changes in stock ownership may be beyond our control. In addition, our ability to deduct net interest expense may be limited if we have insufficient taxable income for the year during which the interest is incurred, and any carryovers of such disallowed interest would be subject to the limitation rules similar to those applicable to NOLs and other attributes. For these reasons, in the event we experience a change of control, we may not be able to utilize a material portion of the NOLs, research and development credit carryforwards or disallowed interest expense carryovers, even if we attain profitability.

Previous wording

On November 16, 2022 (Closing Date), we entered into a credit agreement and guaranty (the Credit Agreement) with Perceptive Credit Holdings IV, LP as the lender and administrative agent (the Lender) that provides for a senior secured delayed draw term loan facility with Perceptive Advisors LLC (Perceptive), in an aggregate principal amount of up to $50.0 million (the Perceptive Term Loan Facility)

Current wording

On November 16, 2022, we entered into a credit agreement and guaranty (the Credit Agreement) with Perceptive Credit Holdings IV, LP as the lender and administrative agent (the Lender) that provides for a senior secured delayed draw term loan facility with Perceptive Advisors LLC (Perceptive), in an aggregate principal amount of up to $50.0 million (the Perceptive Term Loan Facility) to refinance long-term debt.

Previous wording

The Perceptive Term Loan Facility contains certain covenants limiting our ability to, among other things, engage in certain corporate changes, make certain restricted payments, repay other certain indebtedness or enter into, amend or terminate any other agreements that have the impact of restricting our ability to make loan repayments.

Current wording

The Perceptive Term Loan Facility contains customary affirmative and negative covenants for a loan, requires us to comply with a minimum cash requirement covenant, and has a trailing twelve month net revenue requirement. Failure to comply with the covenants and loan requirements may result in an event of default. The Perceptive Term Loan Facility also contains certain covenants limiting our ability to, among other things, engage in certain corporate changes, make certain restricted payments, repay other certain indebtedness or enter into, amend or terminate any other agreements that have the impact of restricting our ability to make loan repayments.

Previous wording

We will need to raise additional capital to fund our existing operations, develop our platform, commercialize new diagnostic tests or expand our operations.

Current wording

We may need to raise additional capital to fund our existing operations, develop our platform, commercialize new diagnostic tests or expand our operations.

Previous wording

We will need to raise additional capital in the future to expand our business, to pursue strategic investments, to take advantage of financing opportunities or for other reasons, including to:

Current wording

We may need to raise additional capital in the future to expand our business, to pursue strategic investments, to take advantage of financing opportunities or for other reasons, including to:

Previous wording

Moreover, increasing efforts by governmental and third-party payers, in the United States and abroad, to cap or reduce healthcare costs may cause such organizations to limit both coverage and level of reimbursement for newly cleared, authorized, certified or approved devices and medicines and, as a result, they may not cover or provide adequate payment for our clinical diagnostics to be sold by us or our collaborators. For example, in May 2018 the United States government released a “blueprint,” or plan, to reduce the cost of drugs. This blueprint contains certain measures that HHS has been working to implement, although it is possible that HHS’s regulatory priorities may change under the Biden administration. At the state level, legislatures are increasingly passing legislation and implementing regulations designed to control pharmaceutical and biological pricing, including price or patient reimbursement constraints, discounts, restrictions on certain product access and marketing cost disclosure and transparency measures, which are, in some cases, designed to encourage importation from other countries and bulk purchasing.

Current wording

Moreover, increasing efforts by governmental and third-party payers, in the United States and abroad, to cap or reduce healthcare costs may cause such organizations to limit both coverage and level of reimbursement for newly cleared, authorized, certified or approved devices and medicines and, as a result, they may not cover or provide adequate payment for our clinical diagnostics to be sold by us or our collaborators.

Previous wording

There have been judicial challenges to certain aspects of the ACA, as well as efforts by the Trump administration and Congress to repeal, replace or alter the implementation of certain aspects of the ACA. For example, as part of the TCJA, Congress eliminated the tax penalty, starting January 1, 2019, for not complying with the ACA’s individual mandate to carry health insurance. The Further Consolidated Appropriations Act of 2020, Pub. L. No. 116-94, signed into law December 20, 2019, fully repealed the ACA’s “Cadillac Tax” on certain high-cost employer-sponsored insurance plans, the annual fee imposed on certain health insurance providers based on market share (repeal effective in 2021), and the medical device excise tax on non-exempt medical devices.

Current wording

There have been judicial challenges to certain aspects of the ACA, as well as efforts by the Trump administration and Congress to repeal, replace or alter the implementation of certain aspects of the ACA. For example, as part of the TCJA, Congress eliminated the tax penalty, starting January 1, 2019, for not complying with the ACA’s individual mandate to carry health insurance. The Further Consolidated Appropriations Act of 2020, Pub. L. No. 116-94, signed into law December 20, 2019, fully repealed the ACA’s “Cadillac Tax” on certain high-cost employer-sponsored insurance plans, the annual fee imposed on certain health insurance providers based on market share (repeal effective in 2021), and the medical device excise tax on non-exempt medical devices. At the end of 2025, the ACA’s enhanced premium tax credit expired, increasing premium payments for marketplace coverage.

Previous wording

The Biden administration took steps to strengthen the ACA and focus on reducing the cost of healthcare. We face uncertainties that might result from modifications or repeal of any of the provisions of the ACA, including as a result of current and future executive orders and legislative actions. The impact of those changes on us and potential effect on the medical device industry as a whole is currently unknown. Any changes to the ACA are likely to have an impact on our results of operations, and may negatively affect our business, financial condition and results of operations. We cannot predict what other healthcare programs and regulations will ultimately be implemented at the federal or state level or the effect of any future legislation or regulation in the United States on our business, financial condition and results of operations.

Current wording

We face uncertainties that might result from modifications or repeal of any of the provisions of the ACA, including as a result of current and future executive orders and legislative actions. The impact of those changes on us and potential effect on the medical device industry as a whole is currently unknown. Any changes to the ACA are likely to have an impact on our results of operations, and may negatively affect our business, financial condition and results of operations. We cannot predict what other healthcare programs and regulations will ultimately be implemented at the federal or state level or the effect of any future legislation or regulation in the United States on our business, financial condition and results of operations.

Previous wording

The FDA has recently increased its attention to marketing of pharmacogenetic tests. For example, in late 2018, the FDA issued a safety communication regarding genetic laboratory tests with claims to predict a patient’s response to specific medications that have not been reviewed by the FDA and may not be supported by clinical evidence. Among other tests, the FDA notice cited genetic tests that claim results can be used to help physicians identify which antidepressant medication would have increased effectiveness or side effects compared to other antidepressant medications. As explained by the FDA in its update to this safety communication, the FDA sent notices to several firms marketing such pharmacogenetic tests where the FDA believes the relationship between genetic variations and the medication’s effects has not been established, including a warning letter sent to a laboratory, in part, for failing to obtain premarket review of its test.

Current wording

The FDA pays attention to marketing of pharmacogenetic tests. For example, in late 2018, the FDA issued a safety communication regarding genetic laboratory tests with claims to predict a patient’s response to specific medications that have not been reviewed by the FDA and may not be supported by clinical evidence. Among other tests, the FDA notice cited genetic tests that claim results can be used to help physicians identify which antidepressant medication would have increased effectiveness or side effects compared to other antidepressant medications. As explained by the FDA in its update to this safety communication, the FDA sent notices to several firms marketing such pharmacogenetic tests where the FDA believes the relationship between genetic variations and the medication’s effects has not been established, including a warning letter sent to a laboratory, in part, for failing to obtain premarket review of its test.

Previous wording

If the FDA’s May 6, 2024 Final Rule to end enforcement discretion is implemented or the FDA otherwise issues new rules, policies, or guidance, due to new legislation or on its own accord, or otherwise determines that our tests are not subject to enforcement discretion, our tests may become subject to FDA requirements, including pre-market review. If this were to happen, it may impact our marketing practices relating to the relevant tests, which in turn may have an adverse impact on our business, financial condition and results of operations.

Current wording

If Congress were to enact legislation providing the FDA with jurisdiction over LDTs, or if the FDA otherwise issues new rules, policies, or guidance, due to new legislation or on its own accord, or otherwise determines that our tests are not LDTs, our tests may become subject to FDA requirements, including pre-market review. If this were to happen, it may impact our marketing practices relating to the relevant tests, which in turn may have an adverse impact on our business, financial condition and results of operations.

Previous wording

Pursuant to the FDCA and its implementing regulations, the FDA regulates the research, testing, manufacturing, safety, labeling, storage, recordkeeping, premarket clearance or approval, marketing and promotion, and sales and distribution of medical devices in the United States to ensure that medical products distributed domestically are safe and effective for their intended uses. Although the FDA has asserted that it has authority to regulate the development and use of LDTs, such as our and many other laboratories’ tests, as medical devices, it has generally exercised enforcement discretion and is currently not otherwise regulating most tests developed and performed within a single high complexity CLIA-certified laboratory. Pursuant to this enforcement discretion policy, FDA does not require laboratories that furnish LDTs to comply with the agency’s requirements for medical devices (e.g., establishment registration, device listing, quality systems regulations, premarket clearance or premarket approval, and post-market controls).

Current wording

Pursuant to the FDCA and its implementing regulations, the FDA regulates the research, testing, manufacturing, safety, labeling, storage, recordkeeping, premarket clearance or approval, marketing and promotion, and sales and distribution of medical devices in the United States to ensure that medical products distributed domestically are safe and effective for their intended uses. Historically, the FDA has asserted that it has authority to regulate the development and use of LDTs, such as our and many other laboratories’ tests, as medical devices, although it has generally claimed to exercise enforcement discretion over most tests developed and performed within a single high complexity CLIA-certified laboratory. Pursuant to this enforcement discretion policy, FDA does not require laboratories that furnish LDTs to comply with the agency’s requirements for medical devices (e.g., establishment registration, device listing, quality systems regulations, premarket clearance or premarket approval, and post-market controls). FDA attempted to end this policy of enforcement discretion in a May 6, 2024, final rule. However on March 31, 2025, the U.S. District Court for the Eastern District of Texas struck down the FDA’s final rule, concluding that it exceeds FDA’s statutory jurisdiction, authority, or limitations. The final rule was vacated and remanded to FDA for further consideration based on the opinion, with the court stating that “[t]here is no likelihood that FDA can justify its decision on remand, given that the final rule exceeds its authority under the FDCA.” The government did not file an appeal to the decision, and in September 2025 FDA rescinded the final rule.

Previous wording

Even if the obligations that could be imposed by the final rule do not become applicable to our tests, Congress could take action to amend the law to change the current regulatory framework for in vitro diagnostics and LDTs to require premarket review of LDTs and other regulatory requirements. New requirements, whether imposed through legislation or administratively, could result in delay or additional expense in offering our tests and tests that we may develop in the future. Moreover, failure to comply with applicable requirements under the relevant timeframes could cause us to lose the ability to perform our tests, experience disruptions to our business, or become subject to administrative or judicial enforcement actions, which in turn may have an adverse impact on our business, financial condition, and results of operations.

Current wording

Congress could take action to amend the law to change the current regulatory framework for in vitro diagnostics and LDTs to require premarket FDA review of LDTs and other regulatory requirements. New requirements, whether imposed through legislation or administratively, could result in delay or additional expense in offering our tests and tests that we may develop in the future.

Previous wording

As discussed above, we believe that our current line of diagnostic tests and their components are LDTs, which are subject to state licensing requirements and federal regulation by CMS under CLIA, which may cause us to be subject to additional FDA regulations discussed above.

Current wording

As discussed above, we believe that our current line of diagnostic tests and their components are LDTs, which are subject to state licensing requirements and federal regulation by CMS under CLIA.

Previous wording

While we believe that we are currently in material compliance with applicable laws and regulations, it is possible that the FDA, or other regulatory agencies, would not agree with our determinations. If our products became become subject to premarket submission and other FDA requirements, we would need to comply with the applicable regulations or face significant civil and criminal penalties. In addition, IVDs and CDx tests are widely considered to be Class III devices, and it is possible that in the future, we may develop tests that fall into this category. CDx tests in particular may require further administrative procedures in the PMA process. Exposure to these additional regulatory requirements would also affect our business, financial condition and results of operations.

Current wording

While we believe that we are currently in material compliance with applicable laws and regulations, it is possible that the FDA, or other regulatory agencies, would not agree with our determinations. If our products or services became subject to premarket submission and other FDA requirements, we would need to comply with the applicable regulations or face significant civil and criminal penalties. In addition, IVDs and CDx tests are widely considered to be Class III devices, and it is possible that in the future, we may develop tests that fall into this category. CDx tests in particular may require further administrative procedures in the IVD (PMA) submission process. Exposure to these additional regulatory requirements would also affect our business, financial condition and results of operations.

Previous wording

Any medical device that we manufacture, including those for which we obtain regulatory clearance or approval or certification, and the manufacturing processes, reporting requirements, post-approval clinical data and promotional activities for such diagnostic test, will be subject to continued regulatory review, oversight, and periodic inspections by the FDA and other domestic and foreign regulatory bodies or conformity assessment bodies. In particular, we and our suppliers may be required to comply with FDA’s QSR (QSR codified at 21 C.F.R. § 820) for medical devices and ISO regulations for the manufacture of our diagnostic tests and other regulations which cover the methods and documentation of the design, testing, production, control, quality assurance, labeling, packaging, storage and shipping of any diagnostic test for which we obtain clearance or approval. Regulatory bodies, such as the FDA, and conformity assessment bodies enforce the QSR and other regulations through periodic inspections and audits. The failure by us or one of our suppliers to comply with applicable statutes and regulations administered by the FDA and other regulatory bodies or conformity assessment bodies, or the failure to timely and adequately respond to any adverse inspectional observations or product safety issues, could result in, among other things, one or more of the following enforcement actions:

Current wording

Any medical device that we manufacture, including those for which we obtain regulatory clearance or approval or certification, and the manufacturing processes, reporting requirements, post-approval clinical data and promotional activities for such diagnostic test, will be subject to continued regulatory review, oversight, and periodic inspections by the FDA and other domestic and foreign regulatory bodies or conformity assessment bodies. In particular, we and our suppliers may be required to comply with the FDA’s regulatory requirements for quality systems and other current good manufacturing practices of medical devices (codified at 21 CFR Part 820), ISO regulations for the manufacture of our diagnostic tests and other regulations which cover the methods and documentation of the design, testing, production, control, quality assurance, labeling, packaging, storage and shipping of any diagnostic test for which we obtain clearance or approval. Regulatory bodies, such as the FDA, and conformity assessment bodies enforce these manufacturing and quality management-related regulations through periodic inspections and audits. The failure by us or one of our suppliers to comply with applicable statutes and regulations administered by the FDA and other regulatory bodies or conformity assessment bodies, or the failure to timely and adequately respond to any adverse inspectional observations or product safety issues, could result in, among other things, one or more of the following enforcement actions:

Previous wording

In addition, we are required to conduct surveillance to monitor the safety or effectiveness of our diagnostic tests, and we must comply with medical device reporting requirements, including the reporting of adverse events and malfunctions related to our diagnostic tests. Later discovery of previously unknown problems with our diagnostic tests, including unanticipated adverse events or adverse events of unanticipated severity or frequency, manufacturing problems, or failure to comply with regulatory requirements such as QSR, may result in changes to labeling, restrictions on such diagnostic tests or manufacturing processes, withdrawal of the diagnostic tests from the market, voluntary or mandatory recalls, a requirement to repair, replace or refund the cost of any medical device we manufacture or distribute, fines, suspension of regulatory approvals, product seizures, injunctions or the imposition of civil or criminal penalties which would adversely affect our business, operating results and prospects.

Current wording

In addition, we are required to conduct surveillance to monitor the safety or effectiveness of our diagnostic tests, and we must comply with medical device reporting requirements, including the reporting of adverse events and malfunctions related to our diagnostic tests. Later discovery of previously unknown problems with our diagnostic tests, including unanticipated adverse events or adverse events of unanticipated severity or frequency, manufacturing problems, or failure to comply with regulatory requirements such as those applicable to our QMS, may result in changes to labeling, restrictions on such diagnostic tests or manufacturing processes, withdrawal of the diagnostic tests from the market, voluntary or mandatory recalls, a requirement to repair, replace or refund the cost of any medical device we manufacture or distribute, fines, suspension of regulatory approvals, product seizures, injunctions or the imposition of civil or criminal penalties which would adversely affect our business, operating results and prospects.

Previous wording

From time to time, legislation is drafted and introduced in Congress that could significantly change the statutory provisions governing the regulatory approval, manufacture and marketing of regulated products or the reimbursement thereof. For example, the Verifying Accurate, Leading-edge IVCT Development (VALID) Act introduced in Congress would codify into law the term “in vitro clinical test” in order to create a new medical product category separate from medical devices that would include products currently regulated as in vitro diagnostics as well as LDTs.

Current wording

From time to time, legislation is drafted and introduced in Congress that could significantly change the statutory provisions governing the regulatory approval, manufacture and marketing of regulated products or the reimbursement thereof. For example, the Verifying Accurate, Leading-edge IVCT Development (VALID) Act introduced in Congress would have codified into law the term “in vitro clinical test” in order to create a new medical product category separate from medical devices that would include products currently regulated as in vitro diagnostics as well as LDTs. The VALID Act was not passed into law, but similar such proposals may be introduced in the future.

Previous wording

We maintain and process, and our third-party vendors, collaborators, contractors and consultants maintain and process on our behalf, a large quantity of sensitive information, including confidential business, personal and patient health information in connection with our clinical studies and our employees, and are subject to data privacy and protection laws and regulations that apply to the collection, transmission, storage and use of personally identifying information, which among other things, impose certain requirements relating to the privacy, security and transmission of personal information. Failure by us or our third-party vendors, collaborators, contractors and consultants to comply with any of these laws and regulations could result in notification obligations or enforcement actions against us, which could result in fines, imprisonment of company officials and public censure, claims for damages by affected individuals, damage to our reputation and loss of goodwill, any of which could have a material adverse effect on our business, financial condition, results of operations or prospects. These laws, rules and regulations evolve frequently and their scope may continually change, through new legislation, amendments to existing legislation and changes in enforcement, and may be inconsistent from one jurisdiction to another. The interpretation and application of consumer, health-related and data protection laws, especially with respect to genetic samples and data, in the United States, the EU and elsewhere, are often uncertain, contradictory and in flux. As a result, implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future.

Current wording

We maintain and process, and our third-party vendors, collaborators, contractors and consultants maintain and process on our behalf, a large quantity of sensitive information, including confidential business, personal and patient health information in connection with our clinical studies and our employees, and are subject to data privacy and protection laws and regulations that apply to the collection, transmission, storage and use of personal information, which among other things, impose certain requirements relating to the privacy, security and transmission of personal information. These laws, rules and regulations evolve frequently and their scope may continually change, through new legislation, amendments to existing legislation and changes in enforcement, and may be inconsistent from one jurisdiction to another. The interpretation and application of consumer, health-related and data protection laws, especially with respect to genetic samples and data, in the United States, the EU and elsewhere, are often uncertain, contradictory and in flux. As a result, implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future.

Previous wording

In the United States, numerous federal and state laws and regulations, including federal health information privacy laws, state data breach notification laws, state health information privacy laws and federal and state consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), that govern the collection, use, disclosure and protection of health-related and other personal information could apply to our operations or the operations of our collaborators.

Current wording

In the United States, numerous federal and state laws and regulations, including state data breach notification laws, federal and state health information privacy laws and federal and state consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), that govern the collection, use, disclosure and protection of health-related and other personal information could apply to our operations or the operations of our collaborators.

Previous wording

Domestic laws in this area are complex and developing rapidly. Many state legislatures have adopted legislation relating to privacy, data security and data breaches. Laws in all 50 states require businesses to provide notice to customers whose personally identifiable information has been disclosed as a result of a data breach. The laws are not consistent, and compliance in the event of a widespread data breach is costly. States are also frequently amending existing laws, requiring attention to frequently changing regulatory requirements. For example, California recently enacted the CCPA, which became effective on January 1, 2020. The CCPA, among other things, requires new disclosures to California consumers and affords such consumers new abilities to access and delete their personal information, opt-out of certain sales of personal information and receive detailed information about how their personal information is used. The CCPA provides for fines of up to $7,500 per violation, as well as a private right of action for data breaches that is expected to increase the frequency of data breach litigation. While the CCPA has already been amended multiple times, it is unclear how this legislation will be further modified or how it will be interpreted. Interpretations of the CCPA may continue to evolve with regulatory guidance and the CCPA continue to be amended, including through a ballot initiative, adopted by voters in November 2020, known as the California Privacy Rights Act, or CPRA. The CPRA imposes additional data protection obligations on companies doing business in California, including additional consumer rights, including regarding certain uses of sensitive data. It also creates a new California data protection agency - the California Privacy Protection Agency - specifically tasked to enforce the law, which may likely result in increased regulatory scrutiny of California businesses in the areas of data protection and security. The effects of this legislation potentially are far-reaching, however, and may require us to modify our data processing practices and policies and incur substantial compliance-related costs and expenses. The CCPA and other changes in state and federal laws or regulations relating to privacy, data protection and information security, particularly any new or modified laws or regulations that require enhanced protection of certain types of data or new obligations with regard to data retention, transfer or disclosure, could increase the cost of providing our offerings, require significant changes to our operations or even prevent us from providing certain offerings in jurisdictions in which we currently operate and in which we may operate in the future.

Current wording

Domestic laws in this area are complex and developing rapidly. Many state legislatures have adopted legislation relating to privacy and data security. The laws may be inconsistent, and compliance in the event of a widespread cybersecurity incident may be costly. States are also frequently amending existing laws, requiring attention to frequently changing regulatory requirements. For example, the CCPA requires disclosures to California consumers and affords such consumers rights to access and delete their personal information, opt-out of certain disclosures of personal information and receive detailed information about how their personal information is collected, used, and disclosed. The CCPA provides for fines per violation, as well as a private right of action for data breaches that has resulted in an uptick in data breach litigation against companies generally. While the CCPA and similar state laws have been amended, and more continue to be proposed, it is unclear how state privacy legislation will be further modified or how it will be interpreted. The effects of state comprehensive privacy legislation potentially are far-reaching and may require us to modify our data processing practices and policies and incur substantial compliance-related costs and expenses.

Previous wording

In addition, numerous state and federal laws and regulations govern the collection, dissemination, use, privacy, confidentiality, security, availability, integrity, and other processing of PHI and PII. These laws and regulations include HIPAA. HIPAA establishes a set of national privacy and security standards for the protection of protected health information (as defined in HIPAA, PHI) by health plans, healthcare clearinghouses and certain healthcare providers, referred to as covered entities (CE), and the business associates (BA) with whom such covered entities contract for services. We are a CE under HIPAA when we are conducting our clinical trials. We are a CE with regard to our observational studies and clinical trials, and also a BA under HIPAA for certain other business activities, and we execute BA agreements with our clients.

Current wording

In addition, numerous state and federal laws and regulations, including HIPAA, govern the collection, dissemination, use, privacy, confidentiality, security, availability, integrity, and other processing of PHI and PII. HIPAA establishes a set of national privacy and security standards for the protection of PHI by health plans, healthcare clearinghouses and certain healthcare providers, referred to as CEs and BA with whom such covered entities contract for services.

Previous wording

HIPAA imposes mandatory penalties for certain violations. Penalties for violations of HIPAA and its implementing regulations start at $119 per violation and are subject to a cap of $1,785,651 for violations of the same standard in a single calendar year. However, a single breach incident can result in violations of multiple standards. HIPAA also authorizes state attorneys general to file suit on behalf of their residents. Courts may award damages, costs and attorneys’ fees related to violations of HIPAA in such cases. While HIPAA does not create a private right of action allowing individuals to sue us in civil court for violations of HIPAA, its standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI.

Current wording

HIPAA provides for penalties for certain violations and authorizes state attorneys general to file suit on behalf of their residents. Courts may award damages, costs and attorneys’ fees related to violations of HIPAA in such cases. While HIPAA does not create a private right of action allowing individuals to sue us in civil court for violations of HIPAA, its standards have been used as the basis for duty of care in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI.

Previous wording

We may eventually operate in a number of countries outside of the United States whose laws, including data privacy laws, may in some cases be more stringent than the requirements in the United States. For example, EU and UK data privacy laws have specific requirements relating to cross-border transfers of personal data to certain jurisdictions, including to the United States, have strict requirements relating to personal data collection, use or sharing, and have more stringent requirements relating to organizations’ privacy programs and provide stronger individual rights. Moreover, we may also be subject to evolving international privacy and data security regulations which could result in greater compliance costs and in turn lead to penalties, where such compliance programs are not implemented correctly.

Current wording

We may eventually operate in a number of countries outside of the United States whose laws, including data privacy laws, may in some cases be more stringent than the requirements in the United States. For example, some jurisdictions have specific requirements relating to cross-border transfers of personal data to certain jurisdictions, including to the United States, have strict requirements relating to personal data collection, use or sharing, and have more stringent requirements relating to organizations’ privacy programs and provide stronger individual rights. Moreover, we may also be subject to evolving international privacy and data security regulations which could result in greater compliance costs and in turn lead to penalties, where such compliance programs are not implemented correctly.

Previous wording

Certain of our processing activities are subject to the EU General Data Protection Regulation and the UK General Data Protection Regulation (collectively, the “GDPR”) – including, those involving pseudonymised / key-coded data - as the GDPR applies extra-territorially. The GDPR imposes strict requirements on controllers and processors processing personal data, including, for example, requirements to: (i) identify a legal basis for the processing of personal data, (ii) provide robust disclosures to individuals, (iii) respond to requests from individuals to exercise their data subject rights, (iv) provide personal data breach notifications within 72 hours after discovering the breach, (v) limit the collection and retention of personal data, (vi) impose specific contractual obligations on processors engaged to process personal data on the instructions of the controller, and (vii) apply enhanced protections to health data and other special categories of personal data.

Current wording

Certain of our processing activities are subject to the EU General Data Protection Regulation and the UK General Data Protection Regulation (collectively, the “GDPR”). The GDPR imposes strict requirements on controllers and processors processing personal information and failure to comply with the requirements of the GDPR may result in significant fines and other administrative penalties.

Previous wording

The GDPR also prohibits the transfer of personal data from the EEA/UK to a country outside of the EEA/UK (e.g., the United States) unless made to a country deemed to have adequate data privacy laws by the European Commission (or UK Government in case of the UK GDPR) or a data transfer mechanism has been put in place. Until recently, one such data transfer mechanism was the EU-US Privacy Shield. However, in July 2020 the Court of Justice of the European Union (CJEU) declared the Privacy Shield to be invalid. Following an executive order on trans-Atlantic data flows issued by President Biden in October 2022, the European Commission in December 2022 announced that it had initiated the process of drafting a new adequacy decision based on a modified data transfer framework that would replace the Privacy Shield, which it completed in July 2023. Though adoption of a new adequacy decision may have the effect of making data transfers to the United States easier, it is widely expected that the updated transfer framework and the adequacy decision will also be reviewed by the CJEU. The CJEU also upheld the validity of standard contractual clauses (SCCs) as a legal mechanism to transfer personal data but companies relying on SCCs will need to carry out a transfer privacy impact assessment, which among other things, assesses laws governing access to personal data in the recipient country and considers whether supplementary measures that provide privacy protections additional to those provided under SCCs will need to be implemented to ensure an essentially equivalent level of data protection to that afforded in the EEA. In turn, the findings of the CJEU will have significant implications for cross-border data flows and may lead to increased transaction, compliance, and technological costs to support international data transfers.

Current wording

The GDPR also prohibits the transfer of personal data from the EEA/UK to a country outside of the EEA/UK (e.g., the United States) unless made to a country deemed to have adequate data privacy laws by the European Commission (or UK Government in case of the UK GDPR) or a data transfer mechanism has been put in place. Any changes with respect to adequacy decisions for transfers to the United States by the Court of Justice of the European Union (CJEU) or additional requirements or interpretations of laws with respect to cross-border data transfer mechanisms may lead to increased transaction, compliance, and technological costs.

Previous wording

If our operations are found to be in violation of any of the data protection laws described above or any other laws that apply to us, we may be subject to penalties, including, but not limited to, criminal, civil and administrative penalties, damages, fines, disgorgement, individual imprisonment, possible exclusion from participation in government healthcare programs, injunctions, private qui tam actions brought by individual whistleblowers in the name of the government, class action litigation and the curtailment or restructuring of our operations, as well as additional reporting obligations and oversight if we become subject to a corrective action plan or other agreement to resolve allegations of non-compliance with these laws, any of which could adversely affect our ability to operate our business and our results of operations.

Current wording

Complying with these various laws and regulations could cause us to incur substantial costs or require us to change our business practices, systems and compliance procedures in a manner adverse to our business. This may be onerous and adversely affect our business, financial condition, results of operations and the profitability of our platform of diagnostic tests and may prevent us from providing certain offerings in jurisdictions in which we currently operate and in which we may operate in the future. Failure to comply with U.S. or global privacy or data security-related laws, rules or regulations could result in significant penalties imposed by regulators, affect our compliance with contracts entered into with our collaborators and other third-party payers, and have an adverse effect on our business and financial condition. The scope and enforcement of each of these laws is uncertain and subject to rapid change in the current environment of heightened regulatory focus on data privacy and security issues. Although we have implemented data privacy and security measures in an effort to comply with applicable laws and regulations relating to privacy and data protection and we endeavor to comply with our policies and documentation and ensure their alignment with current laws, rules and regulations, we may at times fail to do so or a regulator, court, or third party may allege that our practices are not sufficient to fully comply with the laws to which we are subject, resulting in regulatory scrutiny, fines, litigation, and potential reputational harm. We may also be subject to penalties, including, but not limited to, criminal, civil and administrative penalties, damages, fines, disgorgement, individual imprisonment, possible exclusion from participation in government healthcare programs, injunctions, private qui tam actions brought by individual whistleblowers in the name of the government, class action litigation and the curtailment or restructuring of our operations, as well as additional reporting obligations and oversight if we become subject to a corrective action plan or other agreement to resolve allegations of non-compliance with these laws, any of which could adversely affect our ability to operate our business and our results of operations.

Previous wording

In addition to HIPAA, numerous other federal, state, and foreign laws and regulations protect the confidentiality, privacy, availability, integrity and security of PHI and other types of PII. Some of these laws and regulations may be preempted by HIPAA with respect to PHI, or may exclude PHI from their scope but impose obligations with regard to PII that is not PHI, and in some cases, can impose additional obligations with regard to PHI. These laws and regulations are often uncertain, contradictory, and subject to changing or differing interpretations, and we expect new laws, rules and regulations regarding privacy, data protection, and information security to be proposed and enacted in the future. HHS is also proposing amendments to the HIPAA Privacy Rule to modernize certain data sharing provisions and enhance patient access to their information. This complex, dynamic legal landscape regarding privacy, data protection, and information security creates significant compliance issues for us and our clients and potentially exposes us to additional expense, adverse publicity and liability. While we have implemented data privacy and security measures in an effort to comply with applicable laws and regulations relating to privacy and data protection, some PHI and other PII or confidential information is transmitted to us by third parties, who may not implement adequate security and privacy measures, but it is possible that laws, rules and regulations relating to privacy, data protection, or information security may be interpreted and applied in a manner that is inconsistent with our practices or those of third parties who transmit PHI and other PII or confidential information to us. If we or these third parties are found to have violated such laws, rules or regulations, it could result in government-imposed fines, orders requiring that we or these third parties change our or their practices, or criminal charges, which could adversely affect our business.

Current wording

Furthermore, some PHI, PII, personal information, or confidential information is transmitted to us by third parties, who may not implement adequate security and privacy measures. It is possible that laws, rules and regulations relating to privacy, data protection, or information security may be interpreted and applied in a manner that is inconsistent with our practices or those of third parties who transmit such information to us. If we or these third parties are found to have violated such laws, rules or regulations, it could result in government-imposed fines, orders requiring that we or these third parties change our or their practices, or criminal charges, which could adversely affect our business.

Previous wording

We regularly monitor, defend against and respond to attacks to our networks and other information security incidents. Despite our information security efforts, our facilities, systems, and data, as well as those of our third-party service providers, may be vulnerable to privacy and information security incidents such as data breaches, viruses or other malicious code, coordinated attacks, data loss, phishing attacks, ransomware, denial of service attacks, or other security or IT incidents caused by threat actors, technological vulnerabilities or human error. If we, or any of our vendors that support our IT or have access to our data, including any third-party vendors that collect, process and store personal data on our behalf, fail to comply with laws requiring the protection of personal information, or fail to safeguard and defend personal information or other critical data assets or IT systems, we may be subject to regulatory enforcement and fines as well as private civil actions. We may be required to expend significant resources in the response, containment, mitigation of cybersecurity incidents as well as in defense against claims that our information security was unreasonable or otherwise violated applicable laws or contractual obligations.

Current wording

We regularly monitor, defend against and respond to cybersecurity incidents which may impact our facilities systems, or data. Despite our information security efforts, our facilities, systems, and data, as well as those of our third-party service providers, may be vulnerable to cybersecurity incidents including, but not limited to, cyber-attacks (including ransomware or other extortion tactics, viruses or other malicious code, unauthorized access attempts, and denial of service attacks), social engineering attacks (including phishing), fraudulent schemes, disruptions or interruptions, or other intentional or unintentional cybersecurity incidents caused by threat actors, technological vulnerabilities or human error. If we, or any of our vendors that support or have access to our facilities, systems, or data, including any third-party vendors that collect, process and store personal information or confidential information on our behalf, fail to comply with laws requiring the protection of personal information, or fail to safeguard and defend personal information or other critical data assets or facilities, systems, or data, or fail to report such an incident or significant and extended disruption in the timeframe required by law, we may be subject to regulatory scrutiny or enforcement and fines as well as private civil actions or suffer damage to our customer, stakeholder, and investor relationships or other reputational harm. We may be required to expend significant resources in the response, containment, mitigation of cybersecurity incidents as well as in defense against claims that our information security was unreasonable or otherwise violated applicable laws or contractual obligations. Furthermore, while we may be entitled to damages if our third-party service providers or other business partners fail to satisfy their security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. While we have purchased cybersecurity insurance, there are no assurances that the coverage would be adequate in relation to any incurred losses. Moreover, as cyber-attacks and cyber intrusions increase in frequency and magnitude, we may be unable to obtain cybersecurity insurance in amounts and on terms we view as adequate for our operations.

Previous wording

Third-party payers require us to identify the test for which we are seeking reimbursement using a Current Procedural Terminology (CPT) code. The CPT code set is maintained by the American Medical Association (AMA). In cases where there is not a specific CPT code to describe a test, such as with the GeneStrat NGS test, the test may be billed under an unlisted molecular pathology procedure code or through the use of a combination of single gene CPT codes, depending on the payer. The Protecting Access to Medicare Act of 2014 (PAMA) authorized the adoption of new, temporary billing codes and unique test identifiers for FDA-cleared or approved tests as well as advanced diagnostic laboratory tests. The AMA has created a new section of CPT codes, Proprietary Laboratory Analyses codes to facilitate implementation of this section of PAMA. In addition, CMS may assign unique level II Healthcare Common Procedure Coding System codes to tests that are not already described by a unique CPT code. The VeriStrat, Nodify XL2, and Nodify CDT tests have test specific CPT codes, but the GeneStrat NGS test does not at this time.

Current wording

Third-party payers require us to identify the test for which we are seeking reimbursement using a Current Procedural Terminology (CPT) code. The CPT code set is maintained by the American Medical Association (AMA). In cases where there is not a specific CPT code to describe a test, such as with the GeneStrat NGS test, the test may be billed under an unlisted molecular pathology procedure code or through the use of a combination of single gene CPT codes, depending on the payer. The Protecting Access to Medicare Act of 2014 (PAMA) authorized the adoption of new, temporary billing codes and unique test identifiers for FDA-cleared or approved tests as well as advanced diagnostic laboratory tests. The AMA has created a new section of CPT codes, Proprietary Laboratory Analyses codes to facilitate implementation of this section of PAMA. In addition, CMS may assign unique level II Healthcare Common Procedure Coding System (HCPCS) codes to tests that are not already described by a unique CPT code. The VeriStrat, Nodify XL2, and Nodify CDT tests have test specific CPT codes, but the GeneStrat NGS test does not at this time.

Previous wording

Our research and development activities and our third-party manufacturers’ and suppliers’ activities involve the generation, use, storage and disposal of hazardous materials. We work with materials, including chemicals, biological agents and compounds and samples that could be hazardous to human health and safety or the environment. Our operations also produce hazardous and biological waste products.

Current wording

Our research and development activities and our third-party manufacturers’ and suppliers’ activities involve the generation, use, storage and disposal of hazardous materials. We work with materials, including chemicals, biological agents and compounds and samples that could be hazardous to human health and safety or the environment. Our operations also produce hazardous and biological waste products. Accordingly, we and our third-party manufacturers and suppliers are subject to federal, state, local and foreign environmental, health and safety laws and regulations, and permitting and licensing requirements, including those governing the generation, use, manufacture, storage, handling, transportation, release and disposal of, and exposure to, these materials, and worker health and safety.

Previous wording

The trading market for our common stock develops is influenced to some extent by the research and reports that industry or financial analysts publish about us and our business. We do not control these analysts. As a small reporting company and emerging growth company, we may be slow to attract research coverage and the analysts who publish information about our common stock will have had relatively little experience with us, which could affect their ability to accurately forecast our results and could make it more likely that we fail to meet their estimates. In the event we obtain securities or industry analyst coverage, if any of the analysts who cover us provide inaccurate or unfavorable research or issue an adverse opinion regarding our stock price, our stock price could decline. If one or more of these analysts cease coverage of us or fail to publish reports covering us regularly, we could lose visibility in the market, which in turn could cause our stock price or trading volume to decline.

Current wording

The trading market for our common stock is partially influenced by the research and reports that industry or financial analysts publish about us and our business. We do not control these analysts. As a small reporting company, we may be slow to attract research coverage and the analysts who publish information about our common stock will have had relatively little experience with us, which could affect their ability to accurately forecast our results and could make it more likely that we fail to meet their estimates. In the event we obtain securities or industry analyst coverage, if any of the analysts who cover us provide inaccurate or unfavorable research or issue an adverse opinion regarding our stock price, our stock price could decline. If one or more of these analysts cease coverage of us or fail to publish reports covering us regularly, we could lose visibility in the market, which in turn could cause our stock price or trading volume to decline.

Previous wording

We are also a “smaller reporting company” as defined in Item 10(f)(1) of Regulation S-K. Smaller reporting companies may take advantage of certain reduced disclosure obligations, including, among other things, providing only two years of audited financial statements. We will remain a smaller reporting company until the last day of the fiscal year in which (1) the market value of our common shares held by non-affiliates exceeds $250 million as of the end of that year’s second fiscal quarter, or (2) our annual revenues exceeded $100 million during such completed fiscal year and the market value of our common shares held by nonaffiliates exceeds $700 million as of the end of that year’s second fiscal quarter. To the extent we take advantage of such reduced disclosure obligations, it may also make comparison of our financial statements with other public companies difficult or impossible.

Current wording

We are a “smaller reporting company” as defined in Item 10(f)(1) of Regulation S-K. Smaller reporting companies may take advantage of certain reduced disclosure obligations, including, among other things, providing only two years of audited financial statements. We will remain a smaller reporting company until the last day of the fiscal year in which (1) the market value of our common shares held by non-affiliates exceeds $250 million as of the end of that year’s second fiscal quarter, or (2) our annual revenues exceeded $100 million during such completed fiscal year and the market value of our common shares held by nonaffiliates exceeds $700 million as of the end of that year’s second fiscal quarter. To the extent we take advantage of such reduced disclosure obligations, it may also make comparison of our financial statements with other public companies difficult or impossible.

Previous wording

Our officers, directors and principal stockholders each holding more than 5% of our common stock collectively control approximately 44.0% of our outstanding common stock as of December 31, 2024. As a result, these stockholders, if they act together, could control the management and affairs of our company and most matters requiring stockholder approval, including the election of directors and approval of significant corporate transactions. This concentration of ownership may have the effect of delaying or preventing a change of control and might adversely affect the market price of our common stock. This concentration of ownership may not be in the best interests of our other stockholders.

Current wording

Our officers, directors and principal stockholders each holding more than 5% of our common stock collectively control approximately 41.2% of our outstanding common stock as of December 31, 2025. As a result, these stockholders, if they act together, could control the management and affairs of our company and most matters requiring stockholder approval, including the election of directors and approval of significant corporate transactions. This concentration of ownership may have the effect of delaying or preventing a change of control and might adversely affect the market price of our common stock. This concentration of ownership may not be in the best interests of our other stockholders.

Previous wording

When we cease to be an “emerging growth company” under the federal securities laws, our auditors will be required to express an opinion on the effectiveness of our internal controls. If we are unable to confirm that our internal control over financial reporting is effective, or if our independent registered public accounting firm is unable to express an opinion on the effectiveness of our internal controls, we could lose investor confidence in the accuracy and completeness of our financial reports, which could cause the price of our common stock to decline.

Current wording

When we cease to be a “smaller reporting company” and/or “non-accelerated filer” under the federal securities laws, our auditors may be required to express an opinion on the effectiveness of our internal controls. If we are unable to confirm that our internal control over financial reporting is effective, or if our independent registered public accounting firm is unable to express an opinion on the effectiveness of our internal controls, we could lose investor confidence in the accuracy and completeness of our financial reports, which could cause the price of our common stock to decline.