Co-Diagnostics, Inc.

Current report

On October 20, 2025, the Company entered into a new Equity Distribution Agreement (the “Agreement”) with Maxim Group LLC (“Maxim”) to establish an at-the-market (“ATM”) equity offering program. Pursuant to the Agreement, the Company may offer and sell shares of its common stock, par value $0.001 per share, having an aggregate offering price of up to $10.0 million, from time to time through Maxim, acting as the Company’s sales agent. Under the terms of the Agreement, the Company will pay Maxim a commission equal to 3.0% of the gross proceeds from the sale of any shares and will reimburse Maxim for certain legal and other out-of-pocket expenses incurred in connection with its services. Sales of common stock, if any, may be made in transactions deemed to be “at-the-market” offerings as defined in Rule 415 under the Securities Act of 1933, as amended, including sales made by means of ordinary brokers’ transactions on The Nasdaq Capital Market or otherwise at market prices prevailing at the time of sale or at prices negotiated with Maxim. The Company is not obligated to sell any shares under the Agreement and may terminate the offering at any time in accordance with its terms. The shares will be issued pursuant to the Company’s shelf Registration Statement on Form S-3 (File No. 333-270628), which was declared effective by the Securities and Exchange Commission on April 6, 2023. On October 20, 2025, the Company filed a prospectus supplement with the SEC relating to the new ATM program, registering up to approximately $4.1 million of shares under the shelf registration statement. As of December 31, 2025, the Company had sold 31,667 shares of common stock under the Agreement, resulting in net proceeds to the Company of approximately $258,563.

Current report

We are subject to numerous and evolving data protection, privacy and information security laws in the jurisdictions in which we operate. These laws govern the collection, use, disclosure, transfer and safeguarding of personal information, including health-related information. The regulatory framework for data privacy and data security is rapidly evolving, and interpretation and enforcement practices remain uncertain. New or amended laws, or differing interpretations of existing laws, may require us to incur additional compliance costs, modify our business practices or restrict certain operations.

Current report

In the United States, we may be subject to the Health Insurance Portability and Accountability Act of 1996, as amended by HITECH (collectively, “HIPAA”), to the extent we act as a covered entity or business associate. HIPAA establishes privacy and security standards for the protection of protected health information and authorizes significant civil and criminal penalties for noncompliance. In addition, all 50 U.S. states and the District of Columbia have enacted breach notification laws, and many states have adopted broader privacy and data security requirements that may impose additional obligations and liabilities.

Current report

We may also be subject to international data protection laws, including those in the European Union and other jurisdictions, which impose stringent requirements on the processing and transfer of personal information and authorize significant fines for violations.

Current report

A failure or perceived failure by us, our employees, or our third-party service providers to comply with applicable data protection laws or to adequately safeguard personal information could result in regulatory investigations or enforcement actions, fines, litigation, contractual liability, mandatory notifications, reputational harm and loss of customer confidence. We rely on third-party vendors to process and store certain data, and any security breach or noncompliance by such vendors could adversely affect us, even if we are not directly at fault.

Current report

We maintain general liability and cyber insurance coverage; however, such coverage may not be adequate to cover all liabilities or may not be available on acceptable terms in the future. Any significant data security incident, regulatory proceeding or enforcement action could materially and adversely affect our business, financial condition and results of operations.

Current report

We are subject to evolving global data protection and privacy laws, and compliance with such laws may be costly and may expose us to liability.

Current report

We collect and process personal information in connection with our operations, including clinical research activities and interactions with healthcare providers. As a result, we may be subject to various U.S. federal and state laws governing the privacy and security of personal information, including, where applicable, the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”), state breach notification laws, and state consumer privacy laws such as the California Consumer Privacy Act, as amended by the California Consumer Rights Act. These laws impose requirements relating to the collection, use, disclosure and safeguarding of personal information and may provide for significant civil penalties and, in some cases, private rights of action.

Current report

We may also be subject to international data protection laws, including the European Union General Data Protection Regulation (“GDPR”) and the United Kingdom GDPR, which impose strict requirements regarding the processing and transfer of personal data and authorize substantial fines for non-compliance.

Current report

The data protection regulatory environment is rapidly evolving, and new or amended laws, differing interpretations, and increased enforcement activity may require us to incur additional compliance costs, implement new safeguards, or change our business practices. A failure or perceived failure to comply with applicable privacy and data protection laws, or any data security incident involving personal information, whether by us or our third-party service providers, could result in regulatory investigations, fines, litigation, contractual liability, reputational harm and loss of customer confidence, any of which could materially and adversely affect our business, financial condition and results of operations.

Current report

On July 10, 2025, the Company received notification from the Staff indicating that the Company would have an additional 180-day grace period, until January 5, 2026, to regain compliance with NASDAQ’s $1.00 minimum bid requirement. The notification indicated that the Company did not regain compliance during the initial 180-day grace period provided under the rule. In accordance with NASDAQ Marketplace Rule 5810(c)(3)(A), the Company was eligible for the additional grace period because it met the continued listing requirement for market value of publicly held shares and all other applicable requirements for initial listing on the Nasdaq Capital Market with the exception of the bid price requirement, and provided written notice of its intention to cure the deficiency during the second compliance period by effecting a reverse stock split, if necessary.

Current report

In order to regain compliance with the $1.00 minimum bid price requirement, on January 1, 2026 we effected a 1-for-30 reverse stock split (the “Reverse Stock Split”). The Reverse Stock Split reduced the number of shares of common stock outstanding from approximately 62.9 million shares to approximately 2.1 million shares. On January 7, 2026, the Company received written notice from the Staff indicating that the Staff had determined to delist the Company’s common stock from The Nasdaq Capital Market due to the Company’s continued non-compliance with the minimum bid price requirement set forth in Nasdaq Listing Rule 5550(a)(2). The Company subsequently requested a hearing before the Nasdaq Hearings Panel to address the bid price deficiency; however, the Company’s securities were suspended from trading on The Nasdaq Capital Market effective at the open of trading on January 14, 2026, in accordance with Nasdaq Listing Rule 5815(a)(1)(B)(ii)(d).

Current report

On February 12, 2026, the Company participated in a hearing with the Nasdaq Hearings Panel. On March 9, 2026, the Company was formally notified by Nasdaq that it had demonstrated compliance with the $1.00 bid price requirement set forth in Nasdaq Listing Rule 5550(a)(2) and all other applicable criteria for continued listing on The Nasdaq Capital Market. Accordingly, the Company’s securities resumed trading on Nasdaq effective with the open of the market on March 11, 2026, and the previously disclosed listing matter before the Nasdaq Hearing Panel was closed.

Current report

The Nasdaq Hearings Panel imposed a Discretionary Panel Monitor for a period of one year, through March 9, 2027. If, during the monitoring period, the Company’s closing bid price falls below $1.00 per share for 30 consecutive business days, the Company will not be eligible for a 180-day compliance period otherwise available under the Nasdaq Listing Rules. Rather, Nasdaq would issue a delist determination, which the Company could then appeal by requesting a hearing before the Panel. Such request would stay any further action by Nasdaq pending the conclusion of the hearing process. Although we have regained compliance with Nasdaq’s continued listing requirements, there can be no assurance that we will maintain compliance with all applicable listing standards in the future.

Previous report

We are subject to stringent and changing data protection laws, privacy policies and data protection obligations, which continue to evolve and change over time. The actual or perceived failure by us or our third-party service providers or vendors to comply with such obligations could harm our reputation, subject us to significant fines and liability, or otherwise adversely affect our business.

Previous report

We are subject to numerous data protection laws that govern the processing of individually identifiable information and health information and other sensitive and personal information in the jurisdictions in which we operate. In many instances, these data protection laws, regulations and standards apply not only to disclosures to third parties, but also to transfers of information between or among us and other parties with which we have commercial relationships. The regulatory framework for data privacy, data security and data transfers worldwide is rapidly evolving and, as a result, interpretation and implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. These data protection laws may be interpreted and applied differently over time and from jurisdiction to jurisdiction, and it is possible that they will be interpreted and applied in ways that will materially and adversely affect our business, financial condition and results of operations. Failure to comply with any of these data protection laws could result in enforcement actions against us, including fines, imprisonment of company officials and public censure, claims for damages by affected individuals, damage to our reputation and loss of goodwill, any of which could have a material adverse effect on our business.

Previous report

There are numerous U.S. federal and state laws and regulations related to the privacy and security of personal information. These laws and regulations include the Health Insurance Portability and Accountability Act of 1996, or HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, or HITECH, and their implementing regulations, or collectively referred to as the HIPAA Rules, which establish a set of national privacy and security standards to safeguard Protected Health Information, or PHI, by health plans, healthcare clearinghouses and certain healthcare providers, referred to as covered entities, and the business associates and their subcontractors with whom such covered entities contract for services that involve the creation, receipt, maintenance or transmission of PHI for or on behalf of a covered entity or another business associate. HIPAA requires covered entities and business associates to, among other things, develop and maintain policies and procedures with respect to PHI that is used or disclosed, including the adoption of administrative, physical and technical safeguards to protect such information and ensure the confidentiality, integrity and availability of electronic PHI. As this applies to our business, we are required to maintain security standards for any PHI that we create, receive, maintain or transmit. For example, we plan to offer cloud-based portal software to help our customers more efficiently use our products. The software will maintain security safeguards that are designed to be consistent with the HIPAA Rules, but we cannot guarantee that these safeguards will not fail or that they will not be deemed inadequate in the future. In addition, we could be subject to periodic audits for compliance with the HIPAA Privacy and Security Standards by the U.S. HHS, and our customers. The U.S. HHS Office for Civil Rights may impose significant penalties on entities subject to HIPAA for a failure to comply with a requirement of the HIPAA Rules. If we are unable to properly protect the privacy and security of the PHI of our customers, we could be found to have breached our contracts. Determining whether PHI has been handled in compliance with applicable privacy standards and our contractual obligations can be complex and we cannot be sure how these regulations will be interpreted, enforced or applied to our operations.

Previous report

In addition, many states in which we operate have laws that protect the privacy and security of sensitive and personal information, including health-related information. Certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to sensitive and personal information than federal, international or other state laws, and such laws may differ from each other, which may complicate compliance efforts.

Previous report

Laws, regulations and standards in many other jurisdictions also apply broadly to the Processing of personal information, which impose significant compliance obligations. Complying with these numerous, complex and often changing regulations is expensive and difficult, and failure to comply with any Data Protection Laws or any security incident or breach involving the misappropriation, loss or other unauthorized use or disclosure of sensitive or confidential information, whether by us, one of our service providers or another third party, could negatively affect our business, financial condition and results of operations, including but not limited to: investigation costs, material fines and penalties; compensatory, special, punitive and statutory damages; litigation; consent orders regarding our privacy and security practices; requirements that we provide notices, credit monitoring services or credit restoration services or other relevant services to impacted individuals; adverse actions against our licenses to do business; and injunctive relief.

Previous report

Many statutory requirements, both in the United States and abroad, include obligations for companies to notify individuals of security breaches involving certain personal information, which could result from breaches experienced by us or our third-party service providers. For example, laws in all 50 U.S. states and the District of Columbia require businesses to provide notice to consumers whose unencrypted personal information has been disclosed as a result of a data breach. These laws are not consistent, and compliance in the event of a widespread data breach is difficult and may be costly. Moreover, states have been frequently amending existing laws, requiring attention to changing regulatory requirements. We also may be contractually required to notify affected customers, regulators, credit reporting agencies or other affected individuals of a security breach. Such notifications are costly, and the disclosures or the failure to comply with such requirements, could lead to material adverse effects, including without limitation, negative publicity, a loss of customer confidence in our services or security measures or breach of contract claims. There can be no assurance that the limitations of liability in our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages if we fail to comply with applicable Data Protection Laws, Data Protection Obligations or other legal obligations. In addition, although we may have contractual protections with our third-party service providers, contractors and consultants, any actual or perceived security breach by our subcontractors could harm our reputation and brand, expose us to potential liability or require us to expend significant resources on data security and in responding to any such actual or perceived breach. Any contractual protections we may have from our third-party service providers, contractors or consultants may not be sufficient to adequately protect us from any such liabilities and losses, and we may be unable to enforce any such contractual protections.

Previous report

We expect that there will continue to be new proposed laws and regulations concerning data privacy and security, and we cannot yet determine the impact such future laws, regulations and standards may have on our business. New laws, amendments to or re-interpretations of existing laws, regulations, standards and other obligations may require us to incur additional costs and restrict our business operations. Because the interpretation and application of health-related and Data Protection Laws and other obligations are still uncertain, and often contradictory and in flux, it is possible that the scope and requirements of these laws may be interpreted and applied in a manner that is inconsistent with our practices and our efforts to comply with the evolving data protection rules may be unsuccessful. If so, this could result in government-imposed fines or orders requiring that we change our practices, which could adversely affect our business.

Previous report

We cannot assure you that our third-party partners and service providers with access to our or our customers’, suppliers’ and employees’ personally identifiable and other sensitive or confidential information in relation to which we are responsible will not breach contractual obligations imposed by us or violate Data Protection Laws, or that they will not experience security breaches or attempts thereof, which could have a corresponding effect on our business, including putting us in breach of our obligations under the Data Protection Laws, which could in turn adversely affect our business, results of operations and financial condition. We cannot assure you that our contractual measures and our own privacy- and security-related safeguards will protect us from the risks associated with the third-party processing, storage and transmission of such information.

Previous report

We may receive inquiries or be subject to investigations, proceedings or actions, by various government entities regarding our privacy and information security practices and Processing (“Regulatory Proceedings”). These Regulatory Proceedings could result in a material adverse effect, including without limitation, interruptions of, or required changes to, our business practices, the diversion resources and the attention of management from our business, regulatory oversights and audits, discontinuance of necessary Processing, or other remedies that adversely affect our business.

Previous report

In addition to the possibility of fines, lawsuits, regulatory investigations, public censure, other claims and penalties, and significant costs for remediation and damage to our reputation, we could be materially and adversely affected if legislation or regulations are expanded to require changes in our data processing practices and policies or if governing jurisdictions interpret or implement their legislation or regulations in ways that negatively impact our business. Complying with these various laws could cause us to incur substantial costs or require us to change our business practices and compliance procedures in a manner adverse to our business. Any inability to adequately address data privacy or security-related concerns, even if unfounded, or to comply with applicable laws, regulations, standards and other obligations relating to data privacy and security, could result in additional cost and liability to us, harm our reputation and brand, damage our relationships with customers and have a material and adverse impact on our business.

Previous report

While we maintain general liability insurance coverage, cyber insurance coverage and other insurance, we cannot assure that such coverage will be adequate or otherwise protect us from or adequately mitigate liabilities or damages with respect to claims, costs, expenses, litigation, fines, penalties, business loss, data loss, regulatory actions or material adverse effects arising out of our privacy and security practices, Processing or security breaches we may experience, or that such coverage will continue to be available on acceptable terms or at all. The successful assertion of one or more large claims against us that exceeds our available insurance coverage, or results in changes to our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements), could have an adverse effect on our business. In addition, we cannot be sure that our existing insurance coverage will continue to be available on acceptable terms or that our insurers will not deny coverage as to any future claim.

Previous report

The global data protection landscape is rapidly evolving, and we may be or become subject to or affected by numerous federal, state and foreign laws and regulations, as well as regulatory guidance, governing the collection, use, disclosure, transfer, security and processing of personal data, such as information that we collect about subjects and health care providers in connection with clinical trials. Implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, which may create uncertainty in our business; affect our or our service providers’ ability to operate in certain jurisdictions or to collect, store, transfer use and share personal data; result in liability; or impose additional compliance or other costs on us. Any failure or perceived failure by us to comply with federal, state, or foreign laws or self-regulatory standards could result in negative publicity, diversion of management time and effort and proceedings against us by governmental entities or others.

Previous report

In the United States, numerous federal and state laws and regulations, including federal health information privacy laws (e.g., the Health Insurance Portability and Accountability Act, as amended by the Health Information Technology for Economic and Clinical Health Act, or collectively HIPAA), state data breach notification laws, state health information privacy laws, and federal and state consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), that govern the collection, use, disclosure and protection of health-related and other personal information could apply to our operations or the operations of our collaborators. In addition, we may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy and security requirements under HIPAA or other privacy and data security laws. Depending on the facts and circumstances, we could be subject to criminal penalties if we knowingly obtain, use, or disclose protected health information maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA. However, determining whether protected health information has been handled in compliance with applicable privacy standards and our contractual obligations can be complex and may be subject to changing interpretation.

Previous report

If we are unable to properly protect the privacy and security of protected health information or other personal, sensitive, or confidential information in our possession, we could be found to have breached our contracts. Further, if we fail to comply with applicable privacy laws, including applicable HIPAA privacy and security standards, we could face significant administrative, civil and criminal penalties. Enforcement activity can also result in financial liability and reputational harm, and responses to such enforcement activity can consume significant internal and outside resources. Furthermore, state attorneys general are authorized to bring civil actions seeking either injunctions or damages in response to violations that threaten the privacy of state residents. In addition, our ongoing efforts to comply with evolving laws and regulations at the federal and state level may be costly and require continuous modifications to our compliance policies, procedures, and systems.

Previous report

Many state laws govern the privacy and security of personal information and data in specified circumstances, many of which differ from each other in significant ways, are often not pre-empted by HIPAA, and may have a more prohibitive effect than HIPAA, thus complicating compliance efforts. For example, the California Consumer Privacy Act of 2018 (the “CCPA”), which went into effect in January 2020 and provides new data privacy rights for consumers and new operational requirements for companies, which may increase our compliance costs and potential liability. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. While there is currently an exception for protected health information that is subject to HIPAA and clinical trial regulations, as currently written, the CCPA may impact certain of our business activities. In addition, the California Consumer Rights Act, or CPRA, was recently enacted to strengthen elements of the CCPA and became effective on January 1, 2023. The CPRA imposes additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data and expands the application of the CCPA to all human resources personal information of California-based employees. In addition, the CPRA created a new California data protection agency authorized to issue substantive regulations and is expected to result in increased privacy and information security enforcement. A number of other states have considered similar privacy proposals, and states have recently enacted their own privacy laws. For example, the Virginia Consumer Data Protection Act became effective on January 1, 2023, and Colorado and Utah enacted similar laws that became effective in 2023, increasing the complexity of compliance and the risk of failures to comply. These privacy laws may impact our business activities and exemplify the vulnerability of our business to the evolving regulatory environment related to personal data.

Previous report

In addition to our operations in the United States, which may be subject to health care and other laws relating to the privacy and security of health information and other personal information, we may be or become subject to European data privacy laws, regulations and guidelines. The General Data Protection Regulation, (EU) 2016/679 (“GDPR”) became effective on May 25, 2018, and deals with the collection, use, storage, disclosure, transfer, or other processing of personal data, including personal health data, regarding individuals in the EEA. The GDPR imposes a broad range of strict requirements on companies subject to the GDPR, including requirements relating to having legal bases for processing personal information relating to identifiable individuals and transferring such information outside the EEA, including to the United States, providing details to those individuals regarding the processing of their personal health and other sensitive data, obtaining consent of the individuals to whom the personal data relates, keeping personal information secure, having data processing agreements with third parties who process personal information, responding to individuals’ requests to exercise their rights in respect of their personal information, reporting security breaches involving personal data to the competent national data protection authority and affected individuals, appointing data protection officers, conducting data protection impact assessments, and record-keeping. The GDPR increases substantially the penalties to which we could be subject in the event of any non-compliance, including fines of up to €10,000,000 or up to 2% of our total worldwide annual turnover for certain comparatively minor offenses, or up to €20,000,000 or up to 4% of our total worldwide annual turnover, whichever is greater, for more serious offenses. The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR. In addition, the GDPR includes restrictions on cross-border data transfers.

Previous report

Following the United Kingdom’s withdrawal from the European Union (i.e., Brexit), and the expiry of the Brexit transition period, which ended on December 31, 2020, the EU GDPR has been implemented in the United Kingdom (as the UK GDPR). The UK GDPR sits alongside the UK Data Protection Act 2018 which implements certain derogations in the EU GDPR into UK law. Under the UK GDPR, companies not established in the UK but who process personal data in relation to the offering of goods or services to individuals in the UK, or to monitor their behavior will be subject to the UK GDPR – the requirements of which are (at this time) largely aligned with those under the EU GDPR and as such, may lead to similar compliance and operational costs with potential fines of up to £17.5 million or 4% of global turnover. In 2022, the government of the United Kingdom proposed and debated the Data Protection and Digital Information Bill to harmonize the 2018 Data Protection Act, UK GDPR, and the Privacy and Electronic Communications Regulations under one legislative framework. However, progress on the bill stalled as the government continues to assess the most optimal approach to data protection reform.

Previous report

We currently sell some of our products in the EEA, and the GDPR increases our responsibility and liability in relation to personal data that we process where such processing is subject to the GDPR, and we are required to have in place additional mechanisms and safeguards to ensure compliance with the GDPR, including as implemented by individual countries. Compliance with the GDPR is a rigorous and time-intensive process that increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation, and reputational harm in connection with our European activities. We expect that we will continue to face uncertainty as to whether our efforts to comply with any obligations under European privacy laws will be sufficient. If we are investigated by a European data protection authority, we may face fines and other penalties. Any such investigation or charges by European data protection authorities could have a negative effect on our existing business and on our ability to attract and retain new clients or partners.

Previous report

If the Company does not regain compliance with Rule 5550(a)(2) by July 9, 2025, the Company may be eligible for additional time. To qualify, the Company will be required to meet the continued listing requirement for market value of publicly held shares and all other initial listing standards for The Nasdaq Capital Market, with the exception of the bid price requirement, and will need to provide written notice of its intention to cure the deficiency during the second compliance period, by effecting a reverse stock split, if necessary. If the Company meets these requirements, the Staff will inform the Company that it has been granted an additional 180 calendar days. However, if it appears to the Staff that the Company will not be able to cure the deficiency, or if the Company is otherwise not eligible, the Staff will provide notice that its securities will be subject to delisting. We intend to actively monitor our bid price and will consider available options to resolve the deficiency and regain compliance with the Nasdaq Listing Rules.

Previous report

If Nasdaq delists our common stock from trading on its exchange and we are not able to list our securities on another national securities exchange, we expect our securities could be quoted on an over-the-counter market. If this were to occur, we could face significant material adverse consequences, including: