LifeMD Inc

In the ordinary course of our business, we receive, process, use, store, and share digitally large amounts of data, including user data as well as confidential, sensitive, proprietary, and personal information. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to our operations and business strategy. To this end, we have implemented a program designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them.

The program is managed and monitored by a dedicated security team, which is led by our Vice President of Information Security and includes mechanisms, controls, technologies, systems, policies and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the systems and data residing in them. Cybersecurity incidents are escalated to management when they meet pre-defined severity and impact criteria and to the Board of Directors for major events. Mitigation and remediation are monitored by tracking progress, providing regular updates, and measuring key metrics. The Company continues to formalize its cybersecurity policies and procedures.

Our Vice President of Information Security, who reports directly to the Chief Technology Officer and has over 20 years of experience working in information technology and information security, including more than two years at the Company, together with our Compliance Team, are responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified any prior cybersecurity incidents that have materially affected us or is reasonably likely to do so, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, “Risk Factors,” under the heading “Risks Related to Our Business and Industry.”

The Board of Directors has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Board of Directors receives regular updates on cybersecurity and information technology matters and related risk exposures from members of the senior leadership team.