Regenerative Medical Technology Group Inc.

We rely on our information technology systems, including those managed by third parties, to operate our business. These systems are critical to our manufacturing operations at the Cancún facility, physician training programs through the International Society for Stem Cell Application (ISSCA), global distribution of Cellgenic products (including Peptide Pens and exosome therapies), management of sensitive clinical and research data, and coordination across our international clinic network and strategic partnerships in regions such as Latin America, Southeast Asia, the Middle East, and South Asia.

Cybersecurity threats, including but not limited to ransomware, phishing attacks, data breaches, malware, supply chain compromises, denial-of-service attacks, and insider threats, represent significant risks to our operations, intellectual property (such as proprietary protocols for mesenchymal stem cells, exosomes, and peptide-based products), patient and clinical data, financial condition, and reputation. These risks are heightened by our increasing reliance on digital platforms for online education and certification programs, inventory and supply chain management, international collaborations, and the handling of sensitive biological and health-related information in a global, multi-jurisdictional environment.

We have developed and implemented policies, procedures, and controls designed to protect our information technology systems and to identify, assess, and respond to cybersecurity threats and incidents in a timely manner. Our cybersecurity risk management program isintegrated into our broader enterprise risk management framework and is designed to protect the confidentiality, integrity, and availability of our systems and data.

Key elements of our cybersecurity risk management program include:

We engage qualified third-party consultants and cybersecurity service providers to support our risk management efforts. These third parties assist with independent assessments, continuous monitoring, threat detection, incident response support, and enhancement of our overall cybersecurity posture. The third-party consultant team is overseen by our sole officer and director on relevant matters, including the status of our cybersecurity program, emerging threats, and any significant incidents.

As of December 31, 2025, we havenot identified any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition, including our consolidated financial statements.

We continue to monitor the evolving cybersecurity threat landscape closely, particularly in light of our rapid international expansion, increasing dependence on third-party vendors for manufacturing components, logistics, cloud services, and technology infrastructure, and the sensitive nature of the biological, clinical, and patient data we handle. While we believe our current cybersecurity measures are appropriate and proportionate to the risks we face, no system of safeguards can provide absolute protection. A significant cybersecurity incident in the future could result in operational disruptions, loss of intellectual property, unauthorized disclosure of sensitive data, regulatory investigations, litigation, reputational harm, financial losses, and other adverse consequences.