Nutex Health Inc.

In addition to the other information set forth in this Quarterly Report, you should carefully consider the risk factors and other cautionary statements described under the heading “Risk Factors” included in our Form 10-K for the year ended December 31, 2025, the Quarterly Reports on Form 10-Q for the periods ended March 31, 2026 and June 30, 2026, and the risk factors and other cautionary statements contained in our other SEC filings, which could materially affect our businesses, financial condition or future results. Additional risks and uncertainties not currently known to us or that we currently deem to be immaterial also may materially adversely affect our business, financial condition or future results.

Our business and operations could suffer in the event of material information technology system failures, security incidents, or other deficiencies in cybersecurity.

We rely on on-site and cloud-based information technology systems, parts of which are managed by third-party vendors, to conduct our business. Despite our security measures, our systems have been and could in the future be subject to incidents or disruptions.

In the ordinary course of our business, we and our physician partners are required to collect and store sensitive data, including personally identifiable information, protected health information and proprietary business information relating to our patients, employees, providers and business. While we use third-party security services and seek to mitigate vendor risk through contractual measures, these measures cannot provide absolute protection, and potential failures by our vendors or subcontractors could expose us to service disruptions, unauthorized access to our information, liability and reputational damage.

Like many organizations, we have been, and may in the future be, the subject of cyber-attacks. As disclosed in our Current Reports on Form 8-K filed on August 24, 2026 and August 31, 2026 (Item 1.05), and our subsequent update in September 2026, an unauthorized third party accessed and exfiltrated certain data from our computer network, including patient, employee, provider, business and financial information.

Unauthorized access, breach or loss of personal information could disrupt our operations and result in legal claims, regulatory investigations and penalties, and/or liability under federal or state privacy laws. For example, several putative class actions have been filed against us in the U.S. District Court for the Southern District of Texas arising from the cybersecurity incident we first disclosed on August 24, 2026, alleging our failure to maintain adequate security measures. We could also be required to notify affected individuals, regulators, or State Attorneys General in order to comply with state and federal law. We could incur significant remediation costs and reputational harm. Our insurance may not be sufficient to cover all liability and does not address reputational damage. Like many organizations, we may be the subject of future cyber-attacks.

Actual or perceived failures to comply with applicable data protection, privacy and security laws, regulations, standards and other requirements, including contractual obligations, could adversely affect our business, financial condition and results of operations.

Numerous federal and state laws, regulations and other obligations govern the collection, use, security and processing of personal information, including health-related information, and apply to us, including HIPAA, the Texas Data Privacy and Security Act, the Texas Medical Records Privacy Act, Texas Senate Bill 1188 (governing electronic health records and AI use in healthcare), and SEC cybersecurity rules.

These requirements are constantly evolving and may conflict, and any actual or perceived failure by us or third parties acting on our behalf to comply, even if unfounded, could result in investigations, significant civil and criminal penalties, operational restrictions, additional costs and reputational harm, and adversely affect our business and results of operations.