iSpecimen Inc

Our Mission, Vision, and Core Values

iSpecimen’s mission is to accelerate life science research, discovery and development with a global marketplace platform that connects researchers to subjects, specimens, and associated data. Our vision is to create an “Amazon-like” global Marketplace of patients, biospecimens, and data for research to improve the quality of human life. We implement employee programs that foster a company culture predicated on the core values of corporate and individual growth, results and accountability, team before self; a can-do positive attitude, and the perseverance to succeed.

Overview

iSpecimen is technology-driven company founded to address a critical challenge: how to connect life science researchers who need human biospecimens for their research, with the billions of biospecimens available (but not easily accessible) in healthcare provider organizations worldwide. Our ground-breaking iSpecimen Marketplace platform was designed to solve this problem and transform the biospecimen procurement process to accelerate medical discovery.

The iSpecimen Marketplace brings new capabilities to a highly fragmented and inefficient biospecimen procurement market. Our technology consolidates the biospecimen buying experience in a single, online marketplace that brings together healthcare providers who have biospecimens and researchers across industry, academia, and government institutions who need them. We are seeking to be transformative in the world of biospecimen procurement.

The iSpecimen Marketplace offers single-source access to millions of human biospecimens and patients across a diverse network of specimen providers quickly and compliantly, saving researchers time and money in their specimen procurement process while making it easier and more efficient for providers to get their specimens in the hands of researchers who need them. We have adopted many of the same ease-of-use characteristics of these business to consumer, or B2C marketplaces, from simple guided searches, to the ability to refine search criteria with sliders and checkboxes, to the ability to add chosen items to a cart in order to purchase them, to online order management. Our two-sided marketplace platform makes it easy for researchers and healthcare providers to connect and transact, introducing efficiencies into what is otherwise a very time-consuming and manual process.

The platform is built upon a robust healthcare data set comprised of information about available specimens and research subjects, which then enables the search and matchmaking process. It receives de-identified specimen and patient data from electronic medical records, laboratory information systems, biobank inventory systems, and other healthcare data sources (either in real time via data feeds or regularly via file extracts) and harmonizes this “big data” across all participating organizations into a common dataset, which now incorporates external clinical content to further optimize and standardize the biospecimen data on iSpecimen’s proprietary Marketplace platform. The data is then easily searchable by researchers using our intuitive, web-based user interface. Researchers can use their unique study inclusion and exclusion criteria as selection filters to search the de-identified healthcare data to find matching specimens currently available in laboratories and biobanks in our network. Researchers can then select the specific specimens they need for their studies, add them to a cart, request quotes, place orders, and track and manage their specimen requests and associated data across projects. When specimens are not available that meet their research criteria, researchers can, with a click of a button, request a quote for a custom specimen collection and this custom specimen request will be distributed across our network of biospecimen providers.

Biospecimen providers also gain efficiencies using the iSpecimen Marketplace, not only by giving providers instant access to a large researcher base, but because the technology orchestrates the bioprocurement workflow from specimen request to fulfilment. Specimen providers gain access to intuitive dashboards to view requests, create proposals, and track and manage their orders.

In addition to providing the technology platform to connect researchers and healthcare providers, iSpecimen handles all marketing, sales, contracting, and compliance functions across both sides of the marketplace.

We market to and develop relationships with researchers and specimen providers alike to bring them together into a single platform. We contract once with each participating customer and with each supplier organization and a single agreement then enables all users in that

organization to instantly connect and work with all other organizations in the iSpecimen network. We also audit our suppliers to confirm they have proper Institutional Review Board (“IRB”) (or equivalent) protocols in place where required by law.

As of December 31, 2023, we had more than 7,428 external registered users on the iSpecimen Marketplace platform, representing more than 2,817 unique internet domains. Collectively, these users logged into the iSpecimen Marketplace more than 161,565 times and performed nearly 18,700 specimen searches yielding more than 2,475 quote requests since its launch.

Our iSpecimen Marketplace platform has compiled de-identified healthcare data provided by our healthcare supply partners’ approximately 18 million patient records, 101 million clinical specimen records, 1.3 million banked specimen records, 730 million laboratory test results, and 1,100,000 medical conditions as of December 31, 2023 — to allow researchers to easily search for and select research subjects, specimens, and associated data they need to drive their research programs. It then orchestrates and manages the biospecimen procurement workflows of both researchers and suppliers to bring efficiency to the entire buying process. Through the iSpecimen Marketplace, researchers gain instant access to millions of specimens anytime, anywhere, while participating supply organizations gain an opportunity to contribute compliantly to medical research while increasing their revenue and sustainability.

Planned Developments of our Marketplace

While the iSpecimen Marketplace currently supports our business model of providing access to search, find, and acquire human biospecimens and associated data from “inquiry to invoice” and positions us for future expanded business model exploration, there are a number of areas in which the iSpecimen Marketplace functionality could be enhanced to better support our stakeholders, including our prospects and customers, iSpecimen sales and operations staff, and our supply partners. We believe with additional investment in technology development resources, we could make significant progress in scaling our iSpecimen Marketplace and, in addition to increased patient and specimen data integration, we expect to continue to improve the matchmaking across the platform and have capabilities such as more direct support for our prospective collections, deeper search and workflow capabilities, increased automation, and direct pricing availability in the platform.

As investment allows, we plan to continue to better connect healthcare researchers with our network of suppliers to enable the acquisition of human biospecimens and data to help accelerate research and expand the impact of our iSpecimen Marketplace platform from “inquiry to invoice” through the following key approaches:

We continue to prioritize and release updated versions of the iSpecimen Marketplace platform in alignment with these areas and believe that continuing to focus on these approaches will enable us to scale our business model more effectively. As part of this continued platform evolution, iSpecimen continues to explore adjacencies that leverage the platform including a data as a product model.

Our Technology

Technology Components

The iSpecimen Marketplace technology is comprised of four major functional areas: search, workflow, data, administrative, compliance and reporting. We continue to invest in the evolution of these areas to improve customer and supplier engagement with the platform; provide operational efficiencies for our suppliers, our customers, and our internal operations; and increase the liquidity of products and services obtained through the platform. Our core business objective is to retain and grow both researcher and supplier engagement with iSpecimen and usage of our platform to support biospecimen procurement, as well as to position our Company to explore other adjacent business opportunities that can benefit from the use of the iSpecimen Marketplace.

By entering subject and sample selection requests through the iSpecimen Marketplace, researchers can instantly search across the available medical records of large populations within iSpecimen’s healthcare provider network to create customized patient and specimen cohorts. Researchers can specify their criteria and either refine and review results to select specific specimens instantly, or they can request that iSpecimen find patients, specimens, and associated data to satisfy their needs when specimens do not currently exist in our network. Using our own proprietary algorithms, we enable researchers to explore both what is currently available and what is likely to be available based on historic statistical analysis of data. This allows researchers to quickly and easily determine how we can fulfill their requirements, which is especially useful for project planning and budgeting.

Our search capabilities are what most notably distinguishes the iSpecimen Marketplace from other business-to-business, or B2B bioprocurement marketplaces. Whereas some other bioprocurement marketplaces support a search that generates a list ofservice providersthat the researcher must then contact to inquire about specimen availability, the iSpecimen Marketplace goes a step further and returns a list of availablespecimens and datathat actually meet the researcher’s specific requirements. Researchers can then select the individual specimens, add them to a cart, and request a quote for these exact specimens. By incorporating user experiences that researchers are accustomed to from their online consumer shopping experiences, such as faceted searches and the ability to add items to a cart, the iSpecimen Marketplace brings B2C ease of use to the B2B space.

In addition to supporting our suppliers’ workflow requirements, our workflow engine orchestrates customers’ bioprocurement workflows from specimen requests through fulfillment. Customers can not only search for and select specimens, but they can track and manage their specimen quote requests, place orders, track the progress of orders as they are fulfilled and shipped, and download packing lists, data sheets, and other accompanying data.

Finally, the Marketplace technology acts as the command and control center for internal iSpecimen operations users and allows them to easily federate and manage the sourcing of specimens and data for all requested projects across a large and growing supply chain. The technology tracks and manages requests for specimens from inquiry-to-invoice and provides a single place for internal users to manage all specimen requests, orders, shipments, and data. Additionally, because our technology easily scales to support a growing supply network and customer base, we have satisfied projects of all types and sizes — from small specimen requests to projects with more than a thousand samples from specific patient cohorts. As of December 31, 2023, we had delivered more than 210,000 specimens in support of nearly 3,000 unique projects since inception.

In addition, our platform gathers usage data that enables us to granularly understand supply and demand as well as provide value-added insights to our business partners. For example, our biobanking partners often have access to more samples than they can economically store.

Understanding which samples are likely to be the most useful to researchers helps guide the biobanks’ operational practices to optimize their supply chain (for example, providing them with information on the medical conditions and specimen types that are in highest demand can help guide their collection practices). Our ability to deliver relevant insights further increases the engagement with our platform and positions us as a valuable partner. Additional inventory and capabilities data collected in the year ended December 31, 2023 as part of our data initiatives has dramatically reduced, or entirely eliminated the need to perform a feasibility assessment, increasing conversion rates and decreasing sales and fulfillment time leading to increased revenue.

As we continue to ingest and generate more data, there are additional business opportunities to leverage our platform and continue to evolve the iSpecimen Marketplace using modern approaches such as robotic process automation and artificial intelligence/machine learning techniques to further improve the efficiency and effectiveness of the platform and enhance the value of the data. Our ability to leverage network effects will enable us to realize increasing returns from our investments and expand into adjacent markets such as clinical trial patient recruitment, data as a product, software-as-a-service (“SaaS”), and Next Generation Sequencing (an initiative launched in late 2023). With additional data comes additional security risks we worked to mitigate through shoring up existing security processes and protocols and the addition of a 24x7 managed risk vendor.

Our Products and Services

The iSpecimen Marketplace currently supports the supply chain management and bioprocurement process for specimens and associated data. We derive our revenue by procuring specimens from our healthcare provider network and then distributing these annotated biospecimens to our research client base. Revenue flows from the researchers who pay our Company to provide the specimens and we share that revenue back with the healthcare providers who supplied them. Revenue share back to the supplying organization is generally 20% to 50%, depending upon the sample type, collection requirements, and data provided. We are flexible and allow our suppliers to work with us using a number of revenue share constructs, including a fixed percent revenue share arrangement (whereby we share a fixed percentage of the revenue back with them), a fixed pricing schedule (whereby they set their pricing per specimen type), or on a project-based pricing (whereby the supply site sets fees on a per project basis). We have derived substantially all of our revenue from annotated biospecimen procurement and to date, have not charged our customers or suppliers fees for the use of the iSpecimen Marketplace platform, or for marketing, sales, contracting, or compliance functions that we provide as part of the specimen procurement process.

We generally operate in a “just in time” fashion, meaning we procure specimens from our suppliers and distribute specimens to our customers after we obtain an order for specimens from a research client. Generally, we do not speculatively purchase and bank samples in anticipation of future, unspecified needs. We believe our approach offers many advantages over a more traditional inventory-based supplier business model where biorepositories take inventory risks, and where turnover and cash conversion cycles can be lengthy, depending on market demand for certain specimen types.

Currently, we provide access to the following types of human biospecimens from healthy and diseased-state subjects:

For each of the biospecimen types, we offer:

The cross product of all these categories (i.e. remnant or research use only and biofluids, tissues, or hematopoietic stem or immune cells) describes the product types we use to track and manage the business. These groupings include:

primarily from our blood donor center partners or picked from banked inventory maintained by our supply site partners. The collection of these samples may require subjects to undergo apheresis procedures, bone marrow extraction procedures, and/or hematopoietic stem cell (HSC) mobilization therapies. These products are generally priced to the researcher per collection depending upon collection type, specimen type, rarity (subject phenotype or attributes selected), required procedures, and requested data. Research use only hematopoietic stem and immune cells were a relatively new product to us in 2019. These specimens accounted for approximately 1% and 2% of our revenue in 2023 and 2022, respectively.

For each of these product types, biospecimens may already exist in laboratory archives or banked in our network of biorepositories (“banked”) or may be collected in the future from our network of healthcare providers and commercial specimen providers (“prospectively-collected” or “custom collections”).

Our Supply Partners

Critical to the success of the iSpecimen Marketplace is the network of healthcare providers who make their patients, samples, and data available to researchers. This supply network was built over a ten-year period and as of December 31, 2023, our supply network consisted of approximately 234 unique healthcare organizations and biospecimen providers under agreement, including healthcare systems, community hospitals, clinics, private practice groups, commercial laboratories, blood centers, commercial biobanks, clinical research sites, and cadaveric donation centers.

Our suppliers are located in 19 countries across the Americas, Europe, and Asia and our cost of revenue for the years ended December 31, 2023 and 2022, break out as follows geographically:

There was one supplier that accounted for 12.7% of our total cost of revenue during the year ended December 31, 2023. There was one supplier that accounted for 12.3% of our total cost of revenue during the year ended December 31, 2022.

Each supplier organization may give us access to one or more of the following environments within their organization where specimens may be obtained:

Supply sites may provide specimens from one or all these environments, depending on their practices and capabilities. Each supply site can select how it will work with our Company.

In addition to obtaining specimens and data directly from healthcare organizations, we work with several commercial biobanks and biospecimen brokers who have their own network of healthcare provider supply partners and wish to make their samples available to our research clients as well. While these organizations are generally considered our competitors, they are willing to work with us because we provide value by acting as both a distribution channel for them and a supply partner to them to increase their revenues. Moreover, the inclusion of competitors’ specimens in our iSpecimen Marketplace platform further strengthens our competitive position and value to our customers by further de-fragmenting our customers’ buying experience.

Our Customers

Our customer base is primarily comprised of three main segments: biopharmaceutical companies, in vitro diagnostic companies, and government/academic institutions. As of December 31, 2023, we had distributed our specimens to approximately 709 customers, such as the Centers for Disease Control and Prevention. Since entering the regenerative medicine market late 2019, we have acquired 33 customers representing 4% of our total revenue in 2022, and 0.7% in 2023.

From our inception through December 31, 2023, we had distributed more than 210,000 specimens to 23 countries and our geographical revenues distribution for the years ended December 31, 2023 and 2022 were as follows:

During the year ended December 31, 2023, there was one customer that accounted for approximately 25% of our total revenue generated. During the year ended December 31, 2022, there were two customers that accounted for approximately 14% and 12% of our total revenue generated, respectively. We continuously engage with all customers when we receive inbound requests from them, whether they are within or outside of the Americas. Year-over-year, our top customers have been different because their specimen needs tend to be project-based and depending upon where they are in their research and development cycle, they may not need large numbers of specimens each year. Regardless, our customer retention rates are high, with 22 of our top 25 customers (88%) in the year ended December 31, 2022 also procuring specimens in the year ended December 31, 2023.

Biospecimens have broad utility within the healthcare and life science industries, as they are collected and used throughout nearly every stage of diagnostic and therapeutic product discovery and development. For diagnostic products, they are used consistently for preclinical discovery, clinical validation, and post-market validation, as well as surveillance. For therapeutic products, these samples are most often used during preclinical research involving drug target identification and validation, compound screening, lead optimization, predictive toxicology, and pharmacokinetic studies. They are also used for biomarker companion diagnostic discovery and development, which has been shown to reduce the costs of drug clinical trials by 30 to 60% according to Ark Research. In the case of regenerative medicine applications, hematologic samples are used for research and development of engineered cell therapies (e.g. CAR-T, CAR-NK), stem cell therapies (e.g. hematopoietic stem cells, mesenchymal stem cells), exosome therapies, identification of cell immunophenotypes for allogeneic therapies, and for developing and scaling-up cell therapy manufacturing processes.

Given recent advances in technology that now allow for the identification of molecular determinants of disease, the role of the patient’s biospecimen has become even more important in all these endeavors and is essential to the development of precision medicine. This pursuit of precision medicine by the healthcare and life science industries has further increased the already high demand for human biospecimens and the clinical data that describe them.

Our Competitors

We compete with a highly fragmented landscape of organizations who have access to human biospecimens. The competitive organizations, including:

In each of these cases, the landscape is extraordinarily fragmented, and our management estimates that most biospecimen providers have less than 5% market share each, and no single biospecimen provider has more than a 20% market share. Most competitors are smaller organizations with limited specimen procurement abilities. However, there are several larger biospecimen providers who are consolidating the industry by acquiring smaller specimen providers to enable them to provide broader access to specimens and research subjects. These organizations are well-capitalized by private equity and while they still lack a technology-based approach that enables them to search the inventories across their biospecimen provider network, because of their broad specimen access, banked inventory, and available cash, they currently represent our biggest competitive threat.

Specimen providers (e.g. Discovery Life Sciences and StemExpress) maintain internal biobanks and enable researchers to search online for specimens that reside within their own biobanks. Other research services marketplaces (e.g. Science Exchange) allow researchers to describe a specimen request which then gets broadcast to a network of specimen providers (i.e. no searching for specimens, but rather the identification of specimen providers who may or may not have matching specimens and the distribution of the specimen request to them). As such, we believe that there are no other online human biospecimen marketplaces that operate in a manner similar to our business. In addition, we believe that over the long term, the iSpecimen technology-based approach will allow us to scale faster than our competitors who rely upon manual efforts to procure specimens. Nonetheless, we believe we will continue to face competition from: healthcare providers that have their own inventory of biospecimens and thus offer lower prices by eliminating us and others as middlemen; commercial biobanks that have their own inventory of biospecimens and thus may deliver samples more quickly when a researcher’s needs align with their existing inventory; specimen brokers with a specific niche (e.g. infectious disease); and commercial specimen providers with their own donor centers who may more predictably collect and deliver specimens.

Our Intellectual Property

Intellectual property rights are an important component of our business. While we currently do not have any patents protecting our intellectual property, we rely on a combination of copyright, trademark, and trade secret laws in the United States and other jurisdictions, as well as confidentiality and non-disclosure agreements and other contractual protections with employees and third parties to protect our intellectual property rights, including our proprietary technology, brand, and know-how. We believe factors such as the technological and creative skills of our people; our existing and evolving partnerships; the creation of new features, functionality, and services; and the frequent enhancements to our platform have helped us to establish and will help us maintain our technology leadership position.

Regulations

iSpecimen works with the healthcare industry and with clinical researchers, both highly regulated environments in the United States and other countries. Government departments and agencies, at the federal, state, and local levels have regulations related to research activities

that involve human subject research as well as regulations about the collection, storage, and dissemination of personal and healthcare data related to individuals. To support compliance with regulations, we have both internal personnel and external resources who provide us with expertise in various areas of compliance including a Chief Information Security Officer, Chief Privacy Officer, contracts manager, biospecimen and data privacy counsel (external), general counsel (external), IRB (external), and other employees with expertise and oversight of site compliance, lab compliance, and operational compliance.

The following is a general overview of the major laws and regulations pertaining to our business in the United States:

Most countries have their own corresponding rules that we are also required to follow.

45 CFR Part 46 — Federal Policy for the Protection of Human Subjects — “The Common Rule”

The Common Rule refers to regulations issued by the U.S. Department of Health and Human Services (“HHS”) and other federal agencies that fund or participate in research, which regulations protect individuals participating in research. The Common Rule defines “Human Subjects Research” as research involving a living individual about whom an investigator is conducting research when information or biospecimens are obtained through intervention or interaction with the individual, or where the research uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens. For this type of research, the Common Rule stipulates: (i) when this research must be reviewed and approved by an IRB (as well as when it may be exempt from IRB review and approval); (ii) the requirements for an IRB’s membership, authority, review procedures, record keeping, and approval criteria; (iii) when informed consent must be obtained from a research subject for participation in research and the elements that must be communicated in an informed consent form (as well as when consent may be waived by an IRB); and (iv) rules related to special requirements for vulnerable populations (such as prisoners and pregnant women).

iSpecimen is involved with both Human Subject Research and non-Human Subject Research. The collection of Research Use Only (“RUO”) specimens (i.e., samples collected specifically for research via a direct intervention with the research subject and not collected as part of routine clinical care) is considered Human Subject Research. In those cases, iSpecimen and our suppliers are subject to the Common Rule. Therefore, all research use only specimens collected in the United States need to be collected under an IRB-approved protocol, with informed consent (unless an IRB waives consent under appropriate regulatory standards).

When iSpecimen is the study sponsor (i.e. specimens are collected under our IRB protocol), we work with a commercial IRB (currently Advarra) to approve our protocol, informed consent forms, subject recruitment material, and collection sites. These protocols and associated material are reviewed regularly by our IRB in accordance with the Common Rule. When iSpecimen is not the study sponsor (i.e., when research use only specimens are collected at participating healthcare providers under their own IRB-approved protocols), we audit the site before we start procuring specimens to ensure that appropriate IRB approvals are in place.

For international specimen collection sites, we rely on those sites to ensure they are collecting specimens in accordance with the laws in their own jurisdictions, in addition to following basic U.S. rules related to Human Subjects Research.

Finally, iSpecimen participates in Non-Human Subject Research, specifically when we collect clinical remnant samples (i.e., those specimens that were collected originally as part of clinical care). According to the Common Rule, as long as the physical sample and

any associated dataset is de-identified before being used for research, the use of clinical remnant samples is not considered Human Subject Research and therefore does not need IRB review and approval, nor does it require patient consent. For these samples, iSpecimen leaves it up to each supplier to determine whether the supplier seeks patients’ consent or whether the supplier will inform its patients about the supplier’s use of remnant samples, or allows its patients to opt-out of their use. In all cases, we track any use limitations that attached to a particular specimen. For researchers who only want samples from patients who have consented to allow use in research, we only distribute specimens meeting that criteria to those researchers.

Health Insurance Portability and Accountability Act, as amended by the Health Information Technology for Economic and Clinical Health ( “HITECH”) Act, all as implemented by 45 CFR Part 160, 162 and 164 (collectively, “HIPAA”).

HIPAA includes several applicable rules, including theStandards for Privacy of Individually Identifiable Health Information(“Privacy Rule”), theSecurity Standards for the Protection of Electronic Protected Health Information(“Security Rule”), and theBreach Notification Rule(“Breach Notification Rule”).

The Privacy Rule addresses the allowable uses and disclosures of an individual’s PHI by Covered Entities, defined by HHS as (1) health plans, (2) healthcare clearinghouses, and (3) healthcare providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards (such as electronic billing). The Privacy Rule also applies to Business Associates, which include persons or entities that performs certain functions or activities that involve the use or disclosure of PHI on behalf of, or provide certain services to, a Covered Entity. HIPAA requires Covered Entities to obtain HIPAA Business Associate Agreements with their Business Associates.

The Security Rule establishes a national security standard for protecting ePHI. The Security Rule requires Covered Entities and Business Associates to implement physical, administrative, and technical safeguards to protect ePHI.

The Breach Notification Rule pertains to Covered Entities and Business Associates that have access to PHI and requires them to provide notification following a use or disclosure of PHI that does not comply with the Privacy Rule that compromises the security or privacy of the PHI (a “Breach”).

Covered Entities and Business Associates that fail to comply with the HIPAA standards may be subject to civil money penalties or criminal prosecution.

iSpecimen has implemented many protocols and processes to comply with HIPAA and other data privacy and related laws and regulations. First, to reduce the likelihood of any Breach, iSpecimen removes all ePHI prior to storing information in our datacenter so that we do not possess PHI that is subject to HIPAA. Secondly, to the extent any PHI inadvertently remains in our datacenter, we have implemented physical, administrative, and technical safeguards to comply with the HIPAA Security Rule. We have implemented more than eighty HIPAA privacy and security policies at the Company to help ensure compliance with HIPAA Privacy, Security and Breach Notice rules. Thirdly, we regularly undergo HIPAA gap analyses and security testing using external, independent firms to find weaknesses and vulnerabilities in our technology and our data protection policies and procedures and remediate as needed. Finally, iSpecimen executes Business Associate Agreements or Data Use Agreements with our healthcare provider partners if they might share ePHI with us. To date, iSpecimen has never had a Breach of PHI and has never been investigated by HHS nor found to be out of compliance with HIPAA.

21 CFR — FDA Regulations

The Food and Drug Administration (“FDA”) is an HHS agency that regulates clinical investigations of products under its jurisdiction, such as drugs, biological products, and medical devices. The FDA has its own set of rules related to the protection of human subjects in research which may differ from the Common Rule. However, FDA does harmonize its regulations with the Common Rule whenever permitted by law (see section 1002 of the 21st Century Cures Act, Public Law 114-255). iSpecimen follows the FDA regulations related to the protection of research subjects, so that its customers may submit data to the FDA resulting from research performed using data and specimens provided to the researcher by iSpecimen.

21 CFR Part 11 Electronic Records; Electronic Signatures

21 CFR Part 11 is relevant when submissions to the FDA include records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted under any records requirements set forth in FDA regulations. At a high level, Part 11 requires organizations to implement good business practices by defining the criteria under which electronic records and signatures are considered to be accurate, authentic, trustworthy, reliable, confidential, and generally equivalent to paper records and handwritten signatures on paper. These rules stipulate a range of features that must be in place in computer systems that handle electronic data; standard operating procedures relating to information technology systems and processes; system validation processes and procedures to ensure that electronic systems operate as intended.

Although iSpecimen defines and implements many relevant policies, processes, and technical controls, the iSpecimen Marketplace has not been certified or audited for 21 CFR Part 11 compliance. In addition, we do not require the originating systems from whom we receive data to be 21 CFR Part 11 compliant. While we do not represent to customers or suppliers that our systems are 21 CFR Part 11 compliant, our clients may still submit data to the FDA that was received, stored, and transmitted in our systems.

The vast majority of the specimens used by our customers are for projects that do not require 21 CFR Part 11 compliance, and our customers are responsible for determining whether they require Part 11-compliant data for the particular use. For specimens that are collected with informed consent, we audit informed consent differently for supply sites that use their own IRB or ethics committee and those supply sites that use the IRB we contract. In the event we are required to contact a client about a shipped specimen that is not supported by informed consent, which had not happened as of December 31, 2023, the client would then determine whether it could use the specimen without informed consent. In addition, we contract with an outside IRB for IRB services, which agrees to perform the services in accordance with all applicable laws and regulations governing independent institutional review boards, and to indemnify us for its failure to comply with applicable laws, rules, and regulations. The failure of our Company or our supply sites to comply with international, federal, state, and local laws and regulations could subject us to denial of the right to conduct business, fines, criminal penalties, and/or other enforcement actions which could have a material adverse effect on our business.

21 CFR Part 50 — Protection of Human Subjects

21 CFR Part 50 contains the general standards for obtaining informed consent and for human participation in clinical investigations as well as additional safeguards for children involved in clinical investigations, when the investigations are regulated by the FDA. The regulations specify the requirements for informed consent, exceptions to these requirements, elements of informed consent, and documentation of informed consent. Additionally, the requirements detail additional regulations for investigations involving children. Informed consent is not required to use de-identified specimens and data for certain FDA-regulated research, as set forth in guidance documents issued by the FDA.

To the extent our suppliers seek informed consent from individuals to use specimens and data for research, we will provide our clients, upon request, with copies of our or our suppliers’ template informed consent forms and IRB approval prior to obtaining samples from us. However, gaps may exist in our or our suppliers’ protocols and informed consent forms that make them incompatible with this regulation and we may fail to properly audit and identify these gaps.

21 CFR 56 Institutional Review Boards

21 CFR Part 56 contains the general standards for the composition, operation, and responsibility of an IRB that reviews clinical investigations regulated by the FDA. These regulations are intended to protect the rights and welfare of human subjects involved in such investigations and indicate the required organization and membership of an IRB; the IRB’s function and operations; record-keeping and reporting; and administrative actions for non-compliance.

iSpecimen utilizes an outside IRB to review the iSpecimen specimen collection protocol. While we believe the IRB composition and operations to be 21 CFR Part 56 compliant, there may be gaps that make them incompatible with this regulation.

Other Information Laws and Regulations

Other information laws and regulations include all applicable laws concerning the privacy and/or security of personal information including, but not limited to, state data breach notification laws; personal data protection laws such as the California Consumer Privacy

Act of 2018, Nevada Senate Bill 220 (an amendment to the state’s existing online privacy policy statute) and Maine’s Act to Protect the Privacy of Online Consumer Information; and all applicable Payment Card Industry Security Standards with respect to account data protection.

Currently, iSpecimen collects personal data on customers, suppliers, investors, employees, research subjects, Marketplace registrants, and other individuals who interact with iSpecimen personnel or our websites. We believe we are in compliance with these data protection rules but there remains inherent risk of a data breach of iSpecimen’s systems or any of our technology service and SaaS providers (such as those organizations who provide us with customer relationship management software, marketing automation software, online file storage, web services, email systems, accounting systems, and data aggregation and visualization services).

Other Applicable Laws

In addition to the above-described regulation by United States federal and state government related to Human Subject Research and data privacy and security, there are many other U.S. and international rules that are applicable to iSpecimen. The following list contains some of the other federal and state laws and regulations that could directly or indirectly affect our ability to operate the business:

These laws cover areas where we may not have expertise and, in many areas, these laws are actively evolving. We, or our other third-party customers, suppliers and/or distribution partners, may not be able to maintain regulatory compliance in such countries or may incur significant costs in obtaining or maintaining our foreign regulatory compliance.

International Regulatory Environment

Because iSpecimen procures specimens from and distributes specimens to countries outside of the United States, we are subject to international rules related to the protection of human subjects in research, data privacy and security, import and export regulations, tariffs, and foreign rules similar to any of the aforementioned U.S. rules, as well as those of which we are unaware.

One of the more prominent international regulations is the General Data Protection Regulation (“GDPR’) which took effect in May 2018. The GDPR regulates the collection, use, disclosure, transfer, and/or other processing of personal data of identified or identifiable individuals located in the European Economic Areas, including the European Union (“EU”). This data specifically includes personal health data that generally is provided as part of biospecimen collection studies. The GDPR imposes numerous requirements on companies that process personal data, including requirements relating to processing health and other sensitive data, obtaining consent of the individuals to whom the personal data relates for processing (with some exceptions), allowing individuals to revoke consents granted, enabling individuals the right to have their data erased (with some exceptions), amended, or transferred to another data controller (known as “data portability”), providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of personal data, limiting the transfer of data to countries outside of the EU, providing notification of data breaches, and taking certain measures when engaging third-parties who may also use or process the data.

In addition, EU member states may make their own further laws and regulations limiting the processing of personal data, including biometric, genetic, or health data.

The GDPR increases our obligations with respect to data collected by our EU suppliers. We generally rely upon our contractual terms with these organizations as a means for obligating them to provide us data in accordance with the GDPR regulations. In addition to utilizing contractual terms to obligate specimen suppliers to conform with GDPR, we generally request the international supplier fills out a pre-contract questionnaire to understand their GDPR compliance before engaging in the contracting process and then perform a post-contract audit that also asks about GDPR applicability and the site’s conformance to the GDPR. Audit questionnaires are distributed every two years after the initial site audit.

Employees

As of December 31, 2023, we had fifty-three employees (not including co-ops or summer interns), ten of whom were engaged in research and development activities, eleven of whom were engaged in sales and marketing activities, eighteen of whom were engaged in operations and fulfillment activities, five of whom were engaged in supply development and management activities, and nine of whom were engaged in general and administrative functions. Our employees are primarily located in Lexington, Massachusetts with sixteen remote sales, marketing, and supply development personnel located elsewhere in the U.S.