Insight Molecular Diagnostics Inc.

Overview

We are a pioneering diagnostics technology company. Our mission is to expand access to novel molecular diagnostic testing, most immediately in the transplanted organ rejection testing category.

We are developing molecular diagnostic test kits designed to empower our customers to run their own tests in-house to participate in the patient-care value chain, which is counter-positioned with the send-out-testing central laboratory model. Our decentralized approach also puts testing in the hands of researchers to enable more studies, which we believe can improve standards of care while also creating demand for more testing. We believe that combining innovative science with a simple, but disruptive, business model can create substantial value. Our initial targeted customer institutions are hospitals, transplant centers and labs. The decisions to deploy our tests come from doctors, including surgeons, nephrologists and oncologists, as well as researchers, pathologists, lab directors, medical directors, department heads, lab managers and chief medical officers.

We are a science-driven organization that champions scientific integrity and inquiry. We employ scientists who generate intellectual property in our strategic target markets. We have built and acquired an intellectual property portfolio that we believe will enable us to gain share in well-established clinical and research markets.

Our current intellectual property portfolio comprises three general areas: 1) organ transplant, 2) oncology therapy selection, and 3) oncology therapy monitoring. Within these categories, we have developed or are in the process of developing laboratory developed tests (“LDTs”) that can be run at our Franklin, Tennessee laboratory, kitted research use only (“RUO”) tests, and in vitro diagnostic (“IVD”) kitted clinical tests that can be run by local labs.

Our primary near-term strategic market is organ transplant. We seek to deliver the industry-leading molecular diagnostic test kit for clinical use that decentralizes access to organ health testing for transplant patients. We expect that enabling in-house testing will deliver new value in the roughly $2 billion addressable market for kitted transplant rejection testing. We also believe that decentralizing access to transplanted organ rejection testing will bring care closer to the patient and help hospitals to operate more sustainably, as well as create a rapidly growing, high-margin, recurring business model.

iMDx’s flagship transplant testing technology quantifies a molecular biomarker known as donor-derived cell-free DNA (“dd-cfDNA”). Our scientists in Germany and the U.S. have played a critical role over the past decade in developing the science that helped establish dd-cfDNA as a trusted biomarker of transplanted organ rejection. Under the GraftAssure™ brand, iMDx’s transplant diagnostics include the following:

•

GraftAssureCore – The company’s LDT, currently reimbursed by Centers for Medicare & Medicaid Services (“CMS”) and performed at iMDx’s Clinical Laboratory Improvements Amendment (“CLIA”) certified laboratory in Franklin, Tennessee.

•

GraftAssureIQ – An RUO kit intended and labeled for non-clinical applications.

•

GraftAssureDx – The IVD kit currently in development for use in clinical decision-making.

Our GraftAssure family of assays are performed on a digital PCR instrument that is manufactured by Bio-Rad Laboratories, Inc. (“Bio-Rad”). Consequently, we have entered into a global strategic partnership agreement with Bio-Rad to collaborate in the development and the commercialization of kitted transplant products for clinical use (see Note 10, “Collaborative Arrangements,” to our consolidated financial statements included elsewhere in this Report for additional information). In May 2025, we sold our first GraftAssureIQ kits to a research laboratory customer (see Note 2, “Revenue Recognition – Kitted Products,” to our consolidated financial statements included elsewhere in this Report for additional information).

On February 20, 2026, we entered into a Specimen Collection Agreement with a national reference lab provider. Pursuant to the agreement, the lab provider will provide specimen collection-related services, which may include, among other things, the collection, handling, processing, and delivery of specimens upon which we will perform testing with our GraftAssureCore test. See Note 13, “Subsequent Events – Specimen Collection Agreement,” to our consolidated financial statements included elsewhere in this Report for additional information.

Under strict regulatory rules, our kitted tests may not be used in a clinical treatment setting until they have attained marketing authorization from the Food and Drug Administration (“FDA”) for U.S. sales, and In Vitro Diagnostic Medical Devices Regulation approval, for European Union (“EU”) sales. As such, we are working with these regulatory bodies to attain such clearance and approval, as applicable, supporting future distribution and higher sales of our products for clinical use. In 2025, we started a clinical trial in conjunction with our IVD submission for GraftAssureDx. On March 25, 2026, we submitted a data package to the FDA seeking marketing authorization for GraftAssureDx, which is the kitted version of our transplanted organ rejection monitoring assay. We believe that our assays will perform across multiple tissue, or organ, types, and we are pursuing regulatory authorization in kidneys first.

We also have a services lab, certified under the CLIA and accredited by the College of American Pathologists (“CAP”), in Franklin, Tennessee, and research and development labs in Nashville, Tennessee and Göttingen, Germany. Our innovation centers in Nashville and Germany employ research scientists whom we believe are leaders in their fields.

Our secondary strategic market is in the field of oncology. The inherent uncertainties of developing and commercializing new diagnostic tests for medical use make it impossible to predict the amount of time and expense that will be required to complete the development and commercialization of our oncology tests. We continue to dedicate a minimum amount of resources to our oncology assays, DetermaIO and DetermaCNI, although currently we do not intend to commercialize either in the next 12 months.

We also perform other assay development and clinical testing services for life sciences and biotechnology companies through our Laboratory Services operations.

We believe that the experience of our team with diverse technologies through our Laboratory Services activities, strong scientific integrity regarding evidence generation and innovation mentality, alongside our flexibility in operations and regulatory strategy, will drive our success, differentiate us from our competition, and are foundational to our future. We are focusing on executing the technology priorities discussed herein, which have evolved to reflect our operations and strategic vision.

Billing, Coverage, and Reimbursement for our Laboratory Tests

We are currently in the process of developing and commercializing GraftAssureCore, GraftAssureIQ and GraftAssureDx.

Medicare

For diagnostic tests, CMS reimbursement is critically important. CMS relies on a network of Medicare Administrative Contractors (“MACs”) to develop and implement local coverage determinations (“LCDs”), which are jurisdiction-specific coverage policies that define the clinical and technical criteria under which Medicare will reimburse for particular tests or services.

The MolDX Program was developed by the Palmetto GBA MAC to establish coverage and reimbursement for molecular diagnostic tests. MolDX has developed guidelines outlining the level of clinical evidence required to support positive coverage determinations under specific LCD policies. Its coverage and reimbursement decisions are followed by MACs overseeing healthcare reimbursement in 28 of 50 states.

MACs also serve as the primary operational contacts between the Medicare Fee-For-Service program, for paying Medicare claims, and the approximately 1.5 million healthcare providers enrolled in the program. Delays in obtaining MAC approval, or any changes made related to any favorable LCDs, could have a material adverse impact on our business. Any such decision could also cause affected clinicians treating Medicare-covered patients to reduce or discontinue the use of our tests. Further, third‑party payers often follow Medicare coverage policy and payment limitations in setting their own coverage and payment rates and therefore their coverage and payment determinations may likewise be affected by any such decisions. See Part I, Item 1A. “Risk Factors – Risks Related to Our Industry –Our ability to commercialize our products is dependent on availability and sufficiency of third-party payer coverage and our ability to ensure our tests remain reimbursed or attain reimbursement by Medicare, and the loss of, or a significant reduction in, reimbursement from Medicare or the CMS would have a material adverse impact on our business.”

CMS issued a positive coverage decision for GraftAssureCore in August 2023, and since then, expanded coverage to include the test for organ rejection surveillance in certain high-risk transplant patients. In May 2025, CMS increased its reimbursement price for the assay to $2,753 per result.

Private Third-Party Payers

In addition to seeking Medicare reimbursement approval, we will seek reimbursement approval from private payers such as health insurance companies and HMOs. Private payers generally will determine whether to approve a diagnostic test for reimbursement based on the published results of clinical validity and utility studies and may base their decision on whether to cover a test, and at what level to reimburse, on the MAC’s LCD. Obtaining private payer medical coverage generally takes twelve to twenty-four months from the time that sufficient evidence is demonstrated. In the interim, we will bill commercial payers and appeal any denials using the published clinical evidence supporting the utility of the test.

Reimbursement rates paid by private third-party payers can vary based on whether the laboratory is considered “in-network,” “participating,” “covered,” “out-of-network” or “non-participating.” Currently, we are out-of-network with all commercial payers. While these definitions can vary among payers, an in-network laboratory usually has a contract with the payer or benefits provider. Such contracts govern, among other things, service-level agreements and reimbursement rates. In certain instances, an insurance company may negotiate an in-network rate for our testing. An in-network laboratory may have per-test reimbursement rates that are lower than those that are out-of-network, and such rates can vary widely. Rates vary based on the payer, the testing type and often the specifics of the patient’s insurance plan. If a laboratory agrees to contract as an in-network provider, it generally expects to receive faster payment and access to a larger population of covered patients. However, until we are able to negotiate contracts with commercial payers, we expect to be considered “out-of-network” or “non-participating” by payers who cover the vast majority of commercially insured patients.

We cannot predict whether, or under what circumstances, payers will reimburse for our tests or if our efforts to appeal denied claims will be successful. While we have a rigorous process for prior authorization, appeals to overturn denials, and contract negotiation with commercial payers, full or partial denial of coverage by payers, or reimbursement at inadequate levels, would have a material adverse impact on our business and on market acceptance of our tests.

Billing and Collection

Where there is a private or governmental third-party payer coverage policy in place, we will bill in accordance with the established policy. Where there is no coverage policy in place, we will pursue reimbursement on a case-by-case basis. Our efforts in obtaining reimbursement based on individual claims, including pursuing appeals or reconsideration of claims denials, could take a substantial amount of time, and bills may not be paid for many months, if at all. Furthermore, if a third-party payer denies coverage after final appeal, payment may not be received at all.

Corporate Information

We were incorporated in September 2009 in the state of California. Our principal executive offices are located at 2 International Plaza Dr., Suite 510, Nashville, Tennessee, 37217. Our telephone number is (615) 255-8880. Our website iswww.imdxinc.com. Information contained on, or that can be accessed through, our website, is not, and shall not be deemed to be, incorporated into or be considered a part of this Report.

Competition

Our industry is highly competitive and characterized by rapid technological change, including the rapid expansion of the use of artificial intelligence (“AI”) and machine learning. Key competitive factors in our industry include, among others, the ability to successfully complete clinical studies, the ability to obtain any required regulatory approval, average selling prices of competing tests, CLIA laboratory capacity and costs, intellectual property and patent rights, and sales and marketing capabilities. We are an early-stage company with limited resources and many of our competitors have substantially more resources than we do, including financial, technical and sales resources. In addition, many of our competitors have more experience than we have in the development and commercialization of diagnostic tests. We are also competing with academic institutions, governmental agencies and private organizations that conduct research in our field. Our competition will be determined in part by the potential indications for which our lead test candidates are developed and ultimately marketed. Additionally, the timing of market introduction of our diagnostic tests or of competitors’ tests may be an important competitive factor.

Our organ transplant rejection monitoring tests compete with other methods of assessing graft organ health, such as performing a manual biopsy, as well as liquid biopsy tests from competitors that measure dd-cfDNA, including CareDx, Inc., Natera, Inc., Transplant Genomics, Omixon Inc. and Devyser. Three of our competitors (CareDx, Inc., Natera, Inc. and Transplant Genomics) have an established customer base. We aim to compete by selling test kits that enable labs to run patient samples locally. We believe that by leveraging digital PCR technology, our tests have attractive sample economics even at low volumes, offer fast turnaround times and offer native absolute quantification, which we expect may be differentiators in the marketplace. Based on our research of customer needs, we believe that turnaround time matters to practitioners and that sample economics are important to local labs.

Our oncology assets compete with multiple biomarkers already in clinical use or in development. We continue to dedicate a minimum amount of resources to our oncology assays, DetermaIO and DetermaCNI, however, we currently do not intend to begin commercializing our oncology assets in the next 12 months.

Facilities

We operate a CLIA-certified laboratory and maintain office space located in the Nashville, Tennessee area under multiple lease arrangements. Since June 2025, our Nashville location serves as our principal executive and administrative offices. We also operate a research and development laboratory and maintain office space in Göttingen, Germany under multiple lease arrangements. Our Germany lab serves as the center of excellence for our blood-based monitoring program.

Materials

There is a limited number of manufacturers of molecular testing equipment and related chemical reagents necessary for the provision of our tests. Additionally, the chemical reagents used with the testing equipment we choose are available only from the equipment manufacturer. This situation poses a risk to us. If we were to encounter inconsistent results using testing equipment and reagents from one manufacturer, we would need to switch to testing equipment from a different manufacturer. If issues were to arise with the testing equipment or with the reagents we are using, causing us to acquire different testing equipment again, we would need to conduct additional laboratory studies to determine whether our previous test results can be reproduced using the new equipment. If similar issues were to arise after commercialization of a test, we could experience a disruption in providing the tests to patients and we would lose revenue and potentially market share as a result. See Part I, Item 1A. “Risk Factors – Risks Related to Our Business Operations –There is a limited number of manufacturers of molecular diagnostic testing equipment and related chemical reagents necessary for the provision of our diagnostic tests.”

Patents and Trade Secrets

We rely primarily on patents and contractual obligations with employees and third parties to protect our proprietary rights. We have sought, and intend to continue to seek, appropriate patent protection for important and strategic components of our proprietary technologies by filing patent applications in the United States and certain foreign countries. There can be no assurance that any of our patents will guarantee protection or market exclusivity for our diagnostic tests and diagnostic test candidates. We may also use license agreements both to access technologies developed by other companies and universities and to convey certain intellectual property rights to others. Our financial success will be dependent, in part, on our ability to obtain commercially valuable patent claims, to protect our intellectual property rights, and to operate without infringing upon the proprietary rights of others.

Through our acquisition of Insight Genetics, Inc. (“IGI”) in January 2020 and Chronix Biomedical, Inc. (“Chronix”) in April 2021, we obtained exclusive rights to additional intellectual property, including trade secrets, registered trademarks, domain names, copyrights, issued and reissued patents and pending applications, and software material, and have, since our acquisition of IGI, filed our own patents applications to protect DetermaIO in Australia, Canada, China, Europe, Japan, Korea, and the U.S.

Through our acquisition of Chronix in April 2021, we obtained intellectual property rights to nine patent families in the field of detection of cell-free tumor DNA and quantification of dd-cfDNA, with numerous already issued patents in the U.S. and EU, expiring between April 2031 and September 2035. In addition, we obtained trade secrets, registered trademarks, domain names, copyrights and proprietary software material.

On July 15, 2025, we were awarded U.S. Patent No. 12,359,252, which covers our method for detecting and treating colorectal cancer using circulating nucleic acid biomarkers. This patent reinforces our intellectual property around noninvasive cancer detection and supports our strategy to expand into blood-based cancer diagnostics. Protecting a method to identify and treat colorectal cancer using cell-free DNA from a simple blood draw opens the door for us for future screening tools that could broaden our clinical offerings and create new oncology market opportunities.

In addition to relying on patents, we rely on trade secrets, know-how, continuing technological advancement, and licensing opportunities to maintain our competitive position. The molecular diagnostics that we are developing use gene expression classifiers or algorithms, which are mathematical models that weigh the biomarkers to produce a score. We treat the mathematical models as trade secrets. We have entered into intellectual property, invention, and non-disclosure agreements with our employees, and it is our practice to enter into confidentiality agreements with our consultants. There can be no assurance, however, that these measures will prevent the unauthorized disclosure or use of our trade secrets and know-how, or that others may not independently develop similar trade secrets and know-how or obtain access to our trade secrets, know-how, or proprietary technology.

General Risks Related to Obtaining and Enforcing Patent Protection

Our patents and patent applications are directed to compositions of matter, formulations, methods of use and/or methods of manufacturing. The patent positions of pharmaceutical and biotechnology companies, including ours, are generally uncertain and involve complex legal and factual questions. Our business could be negatively impacted by any of the following:

•

The claims of any patents that are issued may not provide meaningful protection, may not provide a basis for commercially viable diagnostic tests or may not provide us with any competitive advantages;

•

Our patents may be challenged by competitors or other third parties and, if the third parties are successful in their challenge, the patents could be invalidated, permitting third parties to use the patented inventions to compete with us;

•

Others may have patents that relate to our technology or business that may prevent us from marketing our diagnostic test candidates unless we are able to obtain a license to those patents;

•

Patent applications to which we have rights may not result in issued patents and the information disclosed in those applications could be used by our competitors;

•

Changes in government regulations or patent laws; and

•

We may not be successful in developing additional proprietary technologies that are patentable.

In addition, others may independently develop similar or alternative technologies, duplicate any of our technologies and, if patents are licensed or issued to us, design around the patented technologies licensed to or developed by us. Moreover, we could incur substantial costs in litigation if we have to defend ourselves in patent lawsuits brought by third parties or if we initiate such lawsuits. For additional information regarding the risks related to obtaining and enforcing patent protection, see Part I, Item 1A. “Risk Factors – Risks Related to Intellectual Property.”

The United States Supreme Court’s decisions in Mayo Collaborative Services v. Prometheus Laboratories, Inc. and Association for Molecular Pathology v. Myriad Genetics may limit our ability to obtain patent protection on diagnostic methods that merely recite a correlation between a naturally occurring event and a diagnostic outcome associated with that event. For example, in Mayo Collaborative Services v. Prometheus Laboratories, Inc., the Supreme Court ruled that patent protection is not available for the simple use of a mathematical correlation of the presence of a well-known naturally occurring metabolite (a body chemical) as a means of determining proper drug dosage, which may be relevant to our oncology assays under development. This ruling may limit the patentability of diagnostic methods relying on natural biological processes.

In Association for Molecular Pathology v. Myriad Genetics, the Supreme Court ruled that claims to isolated DNA are not patent eligible because the claims cover a product of nature. This may enable companies to develop and offer copycat-type DNA isolates and diagnostic tests for patented genes without fear of infringement because such previously existing patents are likely now invalid. In contrast, the Court held that a modified version of DNA is patent-eligible because it is not naturally occurring. This ruling may limit the patentability of composition claims on certain gene sequences.

The United States Patent and Trademark Office (the “USPTO”) has said that diagnostic processes based on natural principles can still be patentable if they include meaningful additional steps that go beyond the natural principle itself. For example, adding a specific limitation other than what is well-understood, routine, conventional activity in the field, or adding unconventional steps that confine the claim to a particular useful application can prove to be meaningful. Because our tests use new methods as well as newly discovered materials, we believe patent protection is still possible, but there is no guarantee that pending patent applications will be granted or that our existing patents would hold up if challenged.

The USPTO has also issued multiple Subject Matter Eligibility Updates, including new examples in the life sciences, to provide further guidance in determining subject matter eligibility. In one example related to diagnosing and/or treating julitis in a patient, claims that recited specific and unconventional reagents and/or treatments were determined to be patent eligible. Similarly, in another example related to screening for gene alterations, claims were considered patent eligible because they recited specific and unconventional ways of gathering data. These examples provide favorable exemplary subject matter eligibility analysis of hypothetical claims covering diagnostic tests and claims drawn from case law. This update from the USPTO does not change our opinion on our ability to obtain meaningful patent protection.

There is a risk that any patent applications that we file and any patents that we hold or later obtain could be challenged by third parties and declared invalid or infringing of third-party claims. A patent interference proceeding may be instituted with the USPTO when more than one person files a patent application covering the same technology, or if someone wishes to challenge the validity of an issued patent filed before March 16, 2013. At the completion of the interference proceeding, the USPTO will determine which competing applicant is entitled to the patent, or whether an issued patent is valid. Patent interference proceedings are complex, highly contested legal proceedings, and the USPTO’s decision is subject to appeal. This means that if an interference proceeding arises with respect to any of our patent applications, we may experience significant expenses and delay in obtaining a patent, and, if the outcome of the proceeding is unfavorable to us, the patent could be issued to a competitor rather than to us. In addition to interference proceedings, the USPTO can review issued patents at the request of a third party seeking to have the patent invalidated. Currently an inter partes review proceeding will allow third parties to challenge the validity, based on issues of novelty and non-obviousness, in view of patents and printed publications, of an issued patent where there is a reasonable likelihood of invalidity. This means that patents owned or licensed by us may be lost if the outcome of the review is unfavorable to us.

Post Grant Review under the America Invents Act makes available opposition-like proceedings in the United States. As with the USPTO interference proceedings, Post Grant Review proceedings will be very expensive to contest and can result in invalidation of a recently issued patent. To invoke a post-grant review, a challenge must be filed within nine months of a patent’s issuance or reissuance. Post-grant review can be sought based on any grounds that can be used to challenge the validity of a patent claim, with the exception of failure to disclose the best mode. Also, a derivation proceeding may be instituted by the USPTO based on a petition filed by an applicant alleging that an earlier patent or application was derived from the work of the applicant.

Oppositions to the issuance of patents may be filed under European patent law and the patent laws of certain other countries. As with the USPTO interference proceedings, these foreign proceedings can be very expensive to contest and can result in significant delays in obtaining a patent or can result in a denial of a patent application.

The enforcement of patent rights often requires litigation against third party infringers, and such litigation can be costly to pursue. Even if we succeed in having new patents issued or in defending any challenge to issued patents, there is no assurance that our patents will be comprehensive enough to provide us with meaningful patent protection against our competitors. Further, should we sue a third-party infringer for patent infringement, the infringer may assert counter claims and attempt to invalidate some or all of the asserted patent claims. There is always some risk that such a counter claim could result in invalidation of one or more claims of an asserted patent.

Government Regulation

CLIA—Clinical Laboratory Improvement Amendments of 1988 and State Regulation

We expect that GraftAssureCore, GraftAssureIQ, GraftAssureDx, DetermaIO and DetermaCNI will continue to be regulated under the CLIA as LDTs. In 1988, Congress enacted CLIA, which established quality standards for all laboratories that provide testing services to ensure the accuracy, reliability and timeliness of patient test results regardless of where the test is performed.

Under CLIA, a laboratory is defined as any facility that performs laboratory testing on specimens derived from humans for the purpose of providing information for the diagnosis, prevention or treatment of disease, or the impairment of, or assessment of health of human beings. Since our laboratory in Franklin, Tennessee meets this definition, CLIA requires that we hold a certificate applicable to the complexity of the categories of testing we perform and that we comply with certain standards. Laboratories performing high complexity testing are required to meet more stringent requirements than laboratories performing less complex tests. CLIA regulations require clinical laboratories like ours to comply with various operational, personnel, facilities administration, quality, and proficiency testing requirements intended to ensure that testing services are accurate, reliable and timely. CLIA certification is a prerequisite for reimbursement eligibility for services provided to state and federal health care program beneficiaries. CLIA is user-fee funded. Therefore, all costs of administering the program must be covered by the regulated facilities, including certification and survey costs. CMS enforces CLIA compliance. CMS granted the CAP Laboratory Accreditation Program deeming authority, which allows CAP inspection in lieu of a CMS inspection. Our laboratory in Franklin, Tennessee is CLIA-certified and CAP-accredited.

FDA Regulation of Diagnostic Tests

We believe we have designed, developed, and are validating our tests as LDTs and within the scope of the FDA’s enforcement discretion policy, and therefore not required to comply with FDA requirements for medical devices, such as registration, device listing, quality systems regulations, premarket clearance or premarket approval, and post-market controls.

However, there have been initiatives to end FDA’s policy of enforcement discretion and subject IVDs to regulation as medical devices. Such initiatives have been unsuccessful, but we cannot predict whether there will be additional initiatives in the future and whether they will be successful in increasing the regulatory requirements for IVDs. For example, in May 2024, the FDA finalized a rule, amending its definition of “in vitro diagnostic products” in FDA regulations to state that IVDs are devices under the Federal Food, Drug, and Cosmetic Act “including when the manufacturer of these products is a laboratory” and announced that the general enforcement discretion approach should be phased out. Before the rule took effect, a federal district court vacated the rule, reinstating the FDA’s policy of enforcement discretion.

In addition, Congress has previously considered, and may consider in the future, legislative proposals that would amend the regulatory framework for LDTs, including, among other requirements, FDA premarket review of certain LDTs. We cannot predict the outcome of any future legislation relating to the FDA’s regulation of LDTs.

International Regulations

The EU has adopted the EU in vitro Diagnostics Regulation (the “EU IVDR”), which imposes stricter requirements for the marketing and sale of in vitro diagnostics products (as compared to the predecessor in vitro Diagnostics Directive), including in the areas of clinical evaluation requirements, quality systems, economic operators and post-market surveillance. Manufacturers of currently marketed in vitro diagnostics products had until May 2022 to meet the requirements of the EU IVDR, though the EU Council and Parliament signed an amendment that delays certain previously mandated deadlines to allow more time for Notified Body of EU countries to manage the entire portfolio of IVD products on the European market.

In addition, Russia has enacted more stringent medical product registration and labeling regulations, China has enacted stricter labeling requirements, and we expect other countries, such as Brazil and India, to impose more regulations that impact our product registrations. The United Kingdom’s (“UK”) withdrawal from the EU is resulting in additional regulatory requirements associated with goods manufactured and sold in the UK and additional complexities and delays with respect to goods, raw materials and personnel moving between the UK and the EU. In addition, new government administrations may interpret existing regulations or practices differently. Due to these evolving and diverse requirements, we face uncertain product approval timelines, additional time and effort to comply, as well as the potential for reduced sales and/or fines for noncompliance.

State Laboratory Licensing

In addition to federal certification requirements of laboratories under CLIA, we are required to maintain licensure under Tennessee law for our laboratory in Franklin, Tennessee. State laws generally include standards for the day-to-day operation of a clinical reference laboratory, including the training and skills required of personnel and quality control. In addition, those laws often mandate proficiency testing, which involves testing of specimens that have been specifically prepared for the laboratory.

Some states require licensure of out-of-state laboratories that accept specimens from those states (e.g., Pennsylvania, Rhode Island, Maryland and California). Our laboratories will need to pass various state inspections in order to get licensed to provide LDTs in each of state that requires licensure. CLIA provides that a state may adopt laboratory regulations that are more stringent than those under federal law, and two states, New York and Washington, have met that standard and therefore substitute for the federal CLIA program. In addition, some, but not all, states require a separate state license or permit, which must be obtained in addition to a CLIA certificate, and some states require a laboratory doing business in that state to be licensed even if the laboratory is located in another state.

Our laboratory in Franklin, Tennessee is licensed by the appropriate state agencies in the states in which we do business, if such licensure is required. We may become aware from time to time of certain states that require out-of-state laboratories to obtain licensure to accept specimens from patients within the state. If we identify any other state with such requirements, or if we are contacted by any other state advising us of such requirements, we intend to follow all instructions from the state regulators regarding compliance with such requirements. If our laboratory is out of compliance with state laws or regulations governing licensed laboratories, a state may impose penalties, which vary from state to state but may include suspension, limitation, revocation or annulment of the license, assessment of financial penalties or fines, or imprisonment. We believe that we are in material compliance with all applicable licensing laws and regulations applicable to us.

International Laboratory Licensing

We also maintain laboratory operations in Germany and could expand our laboratory operations to other foreign jurisdictions. Therefore, we are subject to laboratory quality regulations and accreditation standards in Germany, and will be subject to such regulations and standards in any other jurisdictions where we may operate or accept samples from. These requirements may vary by jurisdiction and differ from those in the United States, and may require us to implement additional compliance measures. We believe that we are in material compliance with all applicable licensing laws and regulations applicable to us.

Regulation of Research Use Only Products

Some of our product development projects are intended to be sold for research purposes in the U.S., and labeled “For Research Use Only” or “for molecular biology applications.” RUO refers to devices that are in the laboratory phase of development, while investigational use only, or IUO, refers to devices that are in the product testing phase of development. These types of devices are exempt from most regulatory controls pursuant to long-standing FDA guidance on RUO/IUO products. These products are exempt from FDA’s premarket review and other requirements as long as they are not promoted for clinical diagnostic use, and iMDx does not provide technical assistance to clinical laboratories with respect to these tests. If FDA were to disagree with our designation of any of these products, we could be forced to obtain the appropriate regulatory clearances or approval prior to commercialization and could face enforcement action.

Regulation of In Vitro Diagnostics

Unless subject to an exemption, such as being labeled for research use only, IVDs are regulated by the FDA as medical devices and subject to the regulatory controls under CLIA and the Federal Food, Drug, and Cosmetic Act and the FDA’s implementing regulations, including both premarket and post market regulatory controls.

The particular premarket requirements that must be met to market a medical device in the United States will depend on the classification of the device under FDA regulations based on the degree of risk it presents. Class I devices (lowest risk) are generally subject to “general controls”; Class II devices (moderate risk) are subject to general and “special controls”; and Class III devices (highest risk) typically require Premarket Approval (“PMA”).

Most Class I and some Class II devices are exempt from premarket submission requirements, while most Class II devices and some Class I require a 510(k) premarket notification. while a more extensive PMA is required to market Class III devices. Class III devices typically require a PMA prior to commercialization, which is a more extensive and resource intensive process.

If we elect to develop additional IVDs or LDTs, commercialization of our future screenings diagnostics may require a 510(k) submission, authorization via the de novo pathway, or approval of a PMA, depending on classification and technology. In a 510(k) submission, the device sponsor must demonstrate that the new device is “substantially equivalent” to another device that is legally marketed in the United States, known as a predicate device. A device may be established as substantially equivalent if, in comparison to a predicate it (a) has the same intended use as the predicate and has the same technological characteristics, and safety and efficacy testing; or (b) has the same intended use as the predicate, has different technological characteristics, and the information submitted to the FDA does not raise new questions of safety and effectiveness. A claim of substantial equivalence does not mean the new and predicate devices must be identical. Substantial equivalence is established with respect to intended use, design, energy used or delivered, materials, chemical composition, manufacturing process, performance, safety, effectiveness, labeling, biocompatibility, standards, and other characteristics.

A device may not be marketed in the United States until the submitter receives a letter from the FDA declaring the device substantially equivalent. If the FDA determines that a device is not substantially equivalent, the applicant may resubmit another 510(k) with new data, or request a Class I or II designation through the FDA’s de novo process that allows a new device without a valid predicate to be classified into Class I or II if it meets certain criteria, or file a reclassification petition, or submit a PMA.

A new 510(k) submission is required for changes or modifications to an existing approved device, where the modifications could significantly affect the safety or effectiveness of the device or the device is to be marketed for a new or different indication for use.

A PMA for Class III devices is the most stringent type of premarket submission. Before the FDA approves a PMA, the sponsor must provide valid scientific evidence demonstrating reasonable assurance of safety and effectiveness for the device’s intended use.

Health Insurance Portability and Accountability Act and Other Data Privacy and Security Laws

We are subject to an extensive and evolving framework of federal, state, and foreign laws and regulations governing the collection, use, disclosure, transfer, retention, and security of personal and sensitive information including those described further below. In the ordinary course of our operations, we collect and process health and other confidential data, which subjects us to certain federal, state, and foreign data privacy and security laws. These laws and regulations vary by jurisdiction, are frequently updated, and are interpreted and enforced differently over time. We expect to remain subject to heightened regulatory scrutiny, and any actual or perceived noncompliance with any applicable data privacy, security, or breach-notification requirements could result in significant penalties, litigation exposure, and adverse effects on our business.

Health Insurance Portability and Accountability Act

Under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”), HHS has issued regulations to protect the privacy and security of protected health information (“PHI”) and to address breach notification requirements. HIPAA also regulates standardization of data content, codes and formats used in health care transactions and standardization of identifiers for health plans and providers. Penalties for violations of HIPAA regulations include civil and criminal penalties.

The HIPAA privacy regulations cover the use and disclosure of PHI by covered entities as well as business associates, which are persons or entities that perform certain functions for or on behalf of a covered entity that involve the creation, receipt, maintenance, or transmittal of PHI. Business associates are defined to include a subcontractor to whom a business associate delegates a function, activity, or service, other than in the capacity of the business associate’s workforce. As a general rule, a covered entity or business associate may not use or disclose PHI except as permitted or required under the privacy regulations. The privacy regulations also set forth certain rights that an individual has with respect to his or her PHI, including rights to access or amend certain records, to request restrictions on the use or disclosure of PHI, or to request an accounting of disclosures of his or her PHI.

Covered entities and business associates must also comply with the HIPAA’s security regulations, which establish minimum requirements for safeguarding the confidentiality, integrity, and availability of PHI that is electronically transmitted or electronically stored. In addition, HITECH established, among other things, certain breach notification requirements with which covered entities and business associates must comply. In particular, a covered entity must notify any individual whose unsecured PHI is breached according to the specifications set forth in the breach notification rule. A covered entity must also notify the Secretary of the HHS and, under certain circumstances, the media of a breach of unsecured PHI.

CMS and the Office of Civil Rights issued a final rule in February 2014 to amend both the HIPAA and CLIA regulations. The final rule amended the HIPAA Privacy Rule to remove the CLIA laboratory exceptions, and as a result, HIPAA-covered laboratories are now required to provide individuals, upon request, with access to their completed test reports. Under the 2014 rule, CLIA laboratories and CLIA-exempt laboratories may provide copies of a patient’s completed test reports that, using the laboratory’s authentication process, can be identified as belonging to that patient. These changes to the CLIA regulations and the HIPAA Privacy Rule were intended to provide individuals with a greater ability to access their health information. CLIA laboratories must create and maintain policies, procedures, and other documentation necessary to inform patients of the right to access laboratory test reports and how to exercise that right.

HHS has pursued initiatives to update the HIPAA Privacy and Security Rules, resulting in a series of proposed and finalized changes over recent years. For example, in December 2020, HHS proposed further changes to the HIPAA Privacy Rule aiming to remove regulations that impede communication and data exchange between providers and health plans and expand individuals’ rights to access their own digital health information. The public comment period for the proposed updates to the HIPAA Privacy Rule has closed, but it remains unclear how HHS has addressed those comments or when a final rule will be issued. On April 22, 2024, HHS issued a final rulemaking containing modifications to the HIPAA Privacy Rule to address the use or disclosure of PHI in relation to the provision of reproductive health care, which were later vacated in June 2025, and certain changes to Notices of Privacy Practices related to Substance Use Disorder patient records. In January 2025, HHS proposed to modify the HIPAA Security Rule to address prescriptive requirements for administrative, physical, and technical safeguards in response to increased cybersecurity incidents in the health care industry. The public comment period for the proposed updates to the HIPAA Security Rule has closed, but it remains unclear how HHS has addressed those comments or when a final rule will be issued. While final rules have not yet been issued for certain proposed updates to HIPAA Privacy and Security rules, any proposed changes, if adopted, would potentially require significant operational adjustments and costs to comply.

In addition, under the 21st Century Cures Act, the Office of the National Coordinator for Health Information Technology prohibits “information blocking,” defined as practices likely to interfere with the access, exchange, or use of electronic health information (“EHI”). As a healthcare provider, our laboratory operations must comply with these regulations or face “appropriate disincentives” from HHS, which became effective in 2024 and 2025. Additionally, the HHS Office of Inspector General has the authority to impose civil monetary penalties of up to $1.0 million per violation on health information networks and developers of certified health IT. We continue to monitor our compliance with the evolving EHI exceptions and enforcement frameworks to mitigate potential regulatory and financial exposure.

State Privacy and Security Laws

The HIPAA privacy, security, and breach notification regulations establish a uniform federal “floor” for healthcare privacy and security and do not supersede state laws that are more stringent or provide individuals with greater rights with respect to the privacy or security of, and access to, their records containing PHI or, insofar as such state laws apply, categories of personal information that are broader in scope than PHI as defined under HIPAA. Thus, there are a number of state laws regarding the privacy and security of health information and personal data that are applicable to clinical laboratories, and, the compliance requirements and associated penalties for violating such requirements under these state laws vary widely, with more states continuing to consider similar legislation.

For example, California has implemented comprehensive privacy laws and regulations, including the California Confidentiality of Medical Information Act (“CMIA”), which imposes restrictive requirements regulating the use and disclosure of health. In addition to fines and penalties imposed upon violators, some state laws, including the CMIA, provide private rights of action to individuals who believe their personal information has been misused.

California also enacted the California Consumer Privacy Act of 2018 (“CCPA”). The CCPA established a comprehensive privacy framework for covered businesses in the State of California, by creating an expanded definition of personal information, establishing new data privacy rights for consumers imposing special rules on the collection of consumer data from minors, and creating a new and potentially severe statutory damages framework for violations of the CCPA and for businesses that fail to implement reasonable security procedures and practices to prevent data breaches. While data subject to HIPAA and federal regulations governing the conduct of clinical trials is exempt from CCPA, certain of our business activities may be subject to CCPA. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that result from a business’ failure to implement and maintain reasonable data security procedures.

State laws regarding the privacy and security of personal information are also evolving. For example, in November 2020, California passed the California Privacy Rights Act (“CPRA”) through a ballot initiative. The CPRA created a new California Privacy Protection Agency, an “independent watchdog” whose mission is both to “vigorously enforce” the CPRA and “ensure that businesses and consumers are well-informed about their rights and obligations.” Among other things, the CPRA created a new category of “sensitive personal information” and offers consumers the right to limit processing of such information, impose purpose limitation, data minimization, data retention, and security compliance obligations on regulated businesses, and add or modify the rights available to consumers, including by providing a right to correct the information a business holds about them. The CPRA’s amendments to the CCPA took effect on January 1, 2023, and generally apply to personal information collected by businesses on or after January 1, 2022. Similarly, Colorado, Connecticut, Utah and Virginia enacted comprehensive state privacy laws that took effect in 2023. Additional states including Delaware, Indiana, Iowa, Montana, New Jersey, Oregon, Tennessee and Texas have enacted similar comprehensive state privacy laws that have either taken effect or will take effect at various points between 2025 and 2026. In addition, every U.S. state has a data breach notification law that requires entities to report certain security breaches to affected consumers and, in some instances, state regulators and consumer reporting agencies. Failure to comply with applicable state laws that impose privacy, security, or breach notification requirements could result in significant civil or criminal penalties, administrative actions, or private causes of action by individuals, and adversely affect our business, results of operations and reputation.

Foreign Privacy and Security Laws

Similar health care and data privacy laws and regulations exist in Europe and other jurisdictions, including reporting requirements detailing interactions with and payments to healthcare providers and requirements regarding the collection, distribution, use, security, and storage of personally identifiable information and other data relating to individuals, including the General Data Protection Regulation (“GDPR”), which went into effect in May 2018. The GDPR applies to any company established in the European Economic Area (“EEA”), as well as to those outside the EEA, if they collect and use personal data in connection with the offering of goods or services to individuals in the EEA or the monitoring of their behavior. Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements and potential fines for noncompliance of up to €20.0 million or 4% of the annual global revenues of the noncompliant company, whichever is greater. The GDPR provides that EU and EEA member states may introduce further conditions, including limitations, to the processing of genetic, biometric or health data, which could limit our ability to collect, use and share personal data, or could cause our compliance costs to increase, ultimately having an adverse impact on our business. Among other requirements, the GDPR regulates transfers of personal data subject to the GDPR to third countries that have not been found to provide adequate protection to such personal data, including the United States, and the efficacy and longevity of current transfer mechanisms between the EU and the United States remains uncertain. For example, in 2016, the EU and United States agreed to a transfer framework for data transferred from the EU to the United States, called the Privacy Shield, but the Privacy Shield was invalidated in July 2020 by the Court of Justice of the EU.

Further, from January 2021, companies have to comply with the GDPR and also the UK GDPR, which, together with the amended UK Data Protection Act 2018, retains the GDPR in UK national law. The UK GDPR mirrors the fines under the GDPR, e.g. fines up to the greater of €20.0 million (£17.5 million) or 4% of global turnover. In June 2021, the European Commission implemented an adequacy decision enabling data transfers from EU member states to the UK without additional security measures. However, this adequacy decision includes a so-called “sunset-clause” stipulating that it will expire after four years, and providing that the European Commission will monitor the UK’s legal situation and could intervene at any point if it determines the UK has deviated from the level of protections in place at the time of the decision. The revocation or expiration of the European Commission’s adequacy decision for the UK could require additional measures to ensure adequate protection and GDPR compliance and may lead to additional costs and increases our overall risk exposure.

Physician Referral Prohibitions

Under a federal law directed at “self-referral,” commonly known as the Stark Law, there are prohibitions, with certain exceptions, on Medicare and Medicaid payments for laboratory tests referred by physicians who personally, or through a family member, have a “financial relationship”—including an investment or ownership interest or a compensation arrangement—with the clinical laboratory performing the tests. Several Stark Law exceptions are relevant to arrangements involving clinical laboratories, including: (i) fair market value compensation for the provision of items or services; (ii) payments by physicians to a laboratory for clinical laboratory services; (iii) certain space and equipment rental arrangements that satisfy certain requirements, and (iv) personal services arrangements that satisfy certain requirements. The laboratory cannot submit claims to the Medicare Part B program for services furnished in violation of the Stark Law, and Medicaid reimbursements may be at risk as well. Penalties for violating the Stark Law include the return of funds received for all prohibited referrals, fines, civil monetary penalties and possible exclusion from the federal health care programs. Many states have comparable laws that are not limited to Medicare and Medicaid referrals.

In November 2020, CMS issued a final rule to modernize and clarify the regulations that interpret self-referral law. The final rule was issued in conjunction with the CMS Patients over Paperwork initiative and the HHS Regulatory Sprint to Coordinated Care and establishes exceptions to the physician self-referral law for certain value-based compensation arrangements between or among physicians, providers, and suppliers. It also established a new exception for certain arrangements under which a physician receives limited remuneration for items or services actually provided by the physician; established a new exception for donations of cybersecurity technology and related services; and amended the existing exception for electronic health records items and services.

Corporate Practice of Medicine

A number of states, including California, do not allow business corporations to employ physicians to provide professional services. This prohibition against the “corporate practice of medicine” is aimed at preventing corporations such as us from exercising control over the medical judgments or decisions of physicians. The state licensure statutes and regulations and agency and court decisions that enumerate the specific corporate practice rules vary considerably from state to state and are enforced by both the courts and regulatory authorities, each with broad discretion. If regulatory authorities or other parties in any jurisdiction successfully assert that we are engaged in the unauthorized corporate practice of medicine, we could be required to restructure our contractual and other arrangements. In addition, violation of these laws may result in sanctions imposed against us and/or the professional through licensure proceedings, and we could be subject to civil and criminal penalties that could result in exclusion from state and federal health care programs.

Federal and State Fraud and Abuse Laws

A variety of federal and state laws prohibit fraud and abuse. These laws are interpreted broadly and enforced aggressively by various state and federal agencies, including CMS, the Department of Justice, the Office of Inspector General for HHS, and various state agencies. In addition, the Medicare and Medicaid programs increasingly use a variety of contractors to review claims data and to identify improper payments as well as fraud and abuse. These contractors include Recovery Audit Contractors, Medicaid Integrity Contractors and Zone Program Integrity Contractors. In addition, CMS conducts Comprehensive Error Rate Testing audits, the purpose of which is to detect improper Medicare payments. Any overpayments identified must be repaid unless a favorable decision is obtained on appeal. In some cases, these overpayments can be used as the basis for an extrapolation, by which the error rate is applied to a larger universe of claims, and which can result in even higher repayments.

The federal Anti-Kickback Statute prohibits, among other things, knowingly and willfully offering, paying, soliciting, receiving, or providing remuneration, directly or indirectly, to induce or in return for either the referral of an individual, or the furnishing, recommending, or arranging for the purchase, lease or order of any health care item or service reimbursable, in whole or in part, under a federal health care program. The definition of “remuneration” has been broadly interpreted to include anything of value, including gifts, discounts, credit arrangements, payments of cash, ownership interests and providing anything at less than its fair market value. Recognizing that the Anti-Kickback Statute is broad and may technically prohibit many innocuous or beneficial arrangements within the health care industry, the Office of Inspector General for HHS has issued a series of regulatory “safe harbors.” These safe harbor regulations set forth certain requirements that, if met, will assure immunity from prosecution under the federal Anti-Kickback Statute. Although full compliance with these provisions ensures against prosecution under the federal Anti-Kickback Statute, the failure of a transaction or arrangement to fit within a specific safe harbor does not necessarily mean that the transaction or arrangement is illegal or that prosecution under the federal Anti-Kickback Statute will be pursued.

Federal civil and criminal false claims laws, including the False Claims Act, prohibit any person from knowingly presenting, or causing to be presented, a false claim for payment to the federal government or knowingly making, or causing to be made, a false statement to get a false claim paid. Violations of the False Claims Act can result in very significant monetary penalties and treble damages. Over the past few years, several healthcare companies have been prosecuted under these laws for a variety of alleged promotional and marketing activities, including without limitation, allegedly providing free trips, free goods, sham consulting fees and grants and other monetary benefits to prescribers. In addition, the government may assert that a claim including items or services resulting from a violation of the federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the federal False Claims Act. Most states also have statutes or regulations similar to the federal anti-kickback law and false claims laws, which apply to items and services reimbursed under Medicaid and other state programs, or, in several states, apply regardless of the payer.

Federal civil monetary penalties laws impose civil fines for, among other things, the offering or transfer of remuneration to a Medicare or state healthcare program beneficiary if the person knows or should know it is likely to influence the beneficiary’s selection of a particular provider, practitioner, or supplier of services reimbursable by Medicare or a state healthcare program, unless an exception applies.

The Eliminating Kickbacks in Recovery Act (“EKRA”) specifically targets laboratories, clinics, recovery centers, and other clinical treatment centers from accepting or paying kickbacks for referrals. EKRA is broader than the federal Anti-Kickback Statute because it applies to private health insurance plans in addition to the federal health care programs, and it prohibits arrangements that may otherwise be exempt from liability under the Anti-Kickback Statute’s safe harbors, including certain compensation arrangements with laboratory sales and marketing personnel.

HIPAA also created federal crimes, including health care fraud and false statements relating to health care matters. The health care fraud statute prohibits knowingly and willfully executing a scheme to defraud any health care benefit program, including private third-party payers. A violation of this statute is a felony and may result in fines, imprisonment or exclusion from federal health care programs, such as the Medicare and Medicaid programs. The false statements statute prohibits knowingly and willfully falsifying, concealing or covering up a material fact or making any materially false, fictitious or fraudulent statement in connection with the delivery of or payment for health care benefits, items or services. A violation of this statute is a felony and may result in fines, imprisonment or exclusion from federal health care programs.

Many states have laws similar to the federal laws described above, and state laws may be broader in scope and may apply regardless of payer.

Additionally, the U.S. Foreign Corrupt Practices Act (“FCPA”) prohibits U.S. corporations and their representatives from offering, promising, authorizing or making payments to any foreign government official, government staff member, political party or political candidate in an attempt to obtain or retain business abroad. The scope of the FCPA includes interactions with certain healthcare professionals in many countries. Other countries have enacted similar anti-corruption laws and/or regulations.

Other Regulatory Requirements

Our laboratory is subject to federal, state and local regulations relating to the handling and disposal of regulated medical waste, hazardous waste and biohazardous waste, including chemical, biological agents and compounds, blood samples and other human tissue. Typically, we use outside vendors who are contractually obligated to comply with applicable laws and regulations to dispose of such waste. These vendors will be licensed or otherwise qualified to handle and dispose of such waste.

The Occupational Safety and Health Administration has established extensive requirements relating to workplace safety for health care employers, including requirements to develop and implement programs to protect workers from exposure to blood-borne pathogens by preventing or minimizing any exposure through needle stick or similar penetrating injuries.

Human Capital

As of December 31, 2025, we employed 58 persons, of which 55 were on a full-time basis and 3 were on a part-time basis.