Lexaria Bioscience Corp.

Risk Management and Strategy

We are an early stage biopharmaceutical company and we are focused on developing our patented DehydraTECH technology. We do not sell products and therefore do not maintain customer lists or similar personal information. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted a formal cybersecurity risk management program or process for assessing cybersecurity risk currently. We assess material risks from cybersecurity threats on an ongoing basis, including any potential unauthorized access to or occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. To this end, we utilize an outsourced information technology consultant, who we believe has sufficient experience and expertise with regard to cybersecurity matters, to implement systems and procedures designed to reduce, respond to and monitor for cybersecurity threats and vulnerabilities. Our outsourced information technology consultant conducts proactive patching and monitoring of all of our existing systems monthly and has implemented systems and procedures to mitigate cybersecurity risks that we believe are appropriate for a company of our size, stage of growth and financial condition.

As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition. However, as discussed under “Risk Factors” in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition. For additional information concerning risks related to cybersecurity,see Item 1.A. Risk Factors: Risks Associated with our Business and Industry.

Governance

Management is responsible for the day-to-day management of the risks we face, while our Board of Directors (“Board”) as a whole has responsibility for the oversight of risk management, including as to material risks from cybersecurity threats. In its risk oversight role, our Board has the responsibility to satisfy itself that the risk management processes designed and implemented by management are appropriate and functioning as designed. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.