Polomar Health Services, Inc.

We currently use a third-party sub-contractor to manage Information Technology (IT) issues, including with respect to protection against, detection, and response to cyberattacks but have not adopted an Information Technology Policy as a result of our size and the status of our operations.

Additionally, we utilize third party vendors and service providers for legal, accounting, web hosting and maintenance and other activities. We believe that ourthird-party vendors and service providers have their own respective cybersecurity protocols which our management believes to be adequate for protecting any of the Company’s data that might be in their possession from time to time.

Our chief executive officer and directors are responsible for assessing and managing cybersecurity risks, but our officers and directors do not have specific cybersecurity expertise. We believe that cybersecurity represents an important component of the Company’s overall approach to risk management and oversight.

The nature of our business provides us with access to personal health information (“PHI”) which is considered protected data under the Health Insurance Portability and Accountability Act of the 1996 (“HIPAA”). Our data storage and websites that access PHI are HIPAA compliant.

Cybersecurity threats have not materially affected the Company, as of the filing date of this Annual Report on Form 10-K. The Company is not aware of any material security breach to date. Accordingly, the Company has not incurred any expenses over the last two years relating to information security breaches. The occurrence of cyber-incidents, or a deficiency in our cybersecurity or in those of any of our third party service providers could negatively impact us by causing a disruption to our operations, if any, a compromise or corruption of our confidential information and systems, or damage to our business relationships or reputation, all of which could negatively impact our business, if any, and results of operations. There can be no assurance that the Company’s third-party vendors’ and service providers’ cybersecurity risk management processes, including its their policies, controls or procedures, will be fully implemented, complied with or effective in protecting the Company’s systems and information.