OptimizeRx Corp

Disclosure Controls and Procedures.

We maintain disclosure controls and procedures designed to provide reasonable assurance that information required to be disclosed in reports filed or submitted under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the SEC’s rules and forms and accumulated and communicated to our management, including our Chief Executive Officer and Chief Financial Officer, or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosures.

Our management, with the participation of our Chief Executive Officer and our Chief Financial Officer, conducted an evaluation, as of the end of the period covered by this report, of the effectiveness of our disclosure controls and procedures, as such term is defined in Exchange Act Rule 13a-15(e). Based on this evaluation, our Chief Executive Officer and our Chief Financial Officer have concluded that, as of the end of the period covered by this report, our disclosure controls and procedures, as defined in Rule 13a-15(e), were not effective at the reasonable assurance level due to a previously identified material weakness in our internal control over financial reporting related to controls ensuring data received from third-party service organizations were complete and accurate.

To address the material weakness referenced above, the Company performed additional analysis and performed other procedures including formalized internal control audits to prepare the audited consolidated financial statements in accordance with GAAP. Accordingly, management believes that the consolidated financial statements included in this Annual Report on Form 10-K fairly present, in all material respects, our financial condition, results of operations and cash flows for the periods presented.

Management’s Report on Internal Control Over Financial Reporting.

The Company’s management is responsible for establishing and maintaining adequate internal control over financial reporting, as defined in Exchange Act Rule 13a-15(f). Internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP in the United States of America. The Company’s internal control over financial reporting includes those policies and procedures that:

•pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the Company;

•provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with GAAP, and that receipts and expenditures of the Company are being made only in accordance with authorizations of management and directors of the Company; and

•provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the Company's assets that could have a material effect on the financial statements.

Because of its inherent limitations, any system of internal control over financial reporting, no matter how well defined, may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become ineffective because of changes in conditions, or that the degree of compliance with the policies or procedures may weaken. The Company’s management, with the participation of our Chief Executive Officer and our Chief Financial Officer, assessed the effectiveness of the Company’s internal control over financial reporting as of December 31, 2025. In making this assessment, management used the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”) in Internal Control — Integrated Framework (2013). Based on this assessment using those criteria, management identified the following material weakness existed as of December 31, 2025: inadequate controls to ensure that data received from third-party service organizations is complete and accurate. As a result, based on the COSO criteria, the Company’s management has concluded that we did not maintain effective internal control over financial reporting as of December 31, 2025.

Ongoing Remediation of Previously Identified Material Weakness

As previously disclosed, a material weakness in our internal control over financial reporting was identified which related to controls ensuring data received from third-party service organizations were complete and accurate.

Management, with oversight from the Audit Committee, is committed to remediating the material weakness that has been identified and maintaining an effective system of disclosure controls and procedures. These remediation efforts, summarized below, are intended to both address the identified material weakness and to enhance our overall financial control environment. Management is in the process of fully implementing process and control improvements to remediate the above material weakness previously identified as follows:

a. The Company requires each third-party service organization to provide us, at least annually, a SOC-1 Type 2 audit report, with adequate complimentary user entity controls to ensure the data received are complete and accurate. Management relies upon a SOC-1 Type 2 audit report from the service organizations attesting to the vendor’s internal controls.

b. If a SOC-1 Type 2 audit report is not available, the Company evaluates each third-party’s relevant system(s) and control environment reporting directly through process and control reviews and formal substantive testing of such third-party’s control environment to ensure the data received are complete and accurate.

c. If the Company is unable to obtain a valid SOC-1 Type 2 audit report or perform substantive testing of such third-party’s control environment, the Company implements a third-party qualification and program triaging process, which could include modifying customer contracts, limiting the volume of activity with those third-parties, and implementing additional operational controls to ensure the completeness and accuracy of information received from those third-parties, such as performing tagging procedures where possible.

During the year ended December 31, 2025, the Company has made substantial progress in remediating the material weakness of its internal controls, primarily as a result of the Company's newly appointed Senior VP of Internal Controls’ oversight of the internal controls processes, the engagement of a third-party consulting firm, and the development of a framework to assess the reliability of data received from third-party service organizations. The Company was able to improve its controls over the completeness and accuracy of information received from third parties by obtaining SOC-1 Type 2 audit reports from service organizations and performing tests of controls at service organizations where the audit reports were unable to be obtained or completed in the prior year. Despite the Company's best efforts, due to a lack of data reporting controls at one service organization and/or the inability of the Company to validate controls at the same service organization, the Company was unable to conclude that the material weakness with the one third party service provider had been fully remediated; however, 2024 material weaknesses with three other third party service providers were remediated in 2025.

The remaining material weakness will be considered remediated when management concludes through testing, the applicable remediated controls are designed and implemented and operating effectively.

When fully implemented and operational, the Company believes the measures described above will remediate the identified material weakness and strengthen the internal controls over financial reporting. The material weakness will not be considered remediated until the newly implemented internal controls operate for a sufficient period of time and management has concluded, through testing, the internal controls are operating effectively. The Company stays committed toward full remediation of the material weakness as soon as reasonably possible.

The Company is committed to continuing to improve the internal control processes and will continue to review and assess financial reporting controls and procedures on an ongoing basis. As the Company continues to evaluate and improve the internal controls over financial reporting, management may determine whether it is appropriate or necessary to take additional measures.

Changes in Internal Control over Financial Reporting.

Except as noted above, there was no change in our internal control over financial reporting (as defined in Rule 13a-15(f) under the Exchange Act), that occurred during the quarter ended December 31, 2025 that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting.

Limitations on the Effectiveness of Controls

A control system, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Further, the design of a control system must reflect the fact that there are resource constraints, and the benefits of controls must be considered relative to their costs. Because of the inherent limitations in a cost-effective control system, misstatements due to error or fraud may occur and not be detected. The Company conducts on-going evaluations of its internal controls to enhance, where necessary, its procedures and controls.