Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Cybersecurity Risk Management and Strategy

Cybersecurity risk management is an integral part of our risk management framework. Our approach aligns with industry standards, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), to effectively manage cybersecurity threats and incidents, including those related to third-party applications and services.

Our framework includes:

●

Assessing the severity of cybersecurity threats

●

Identifying the sources of cybersecurity threats

●

Implementing countermeasures and mitigation strategies

●

Reporting material cybersecurity threats and incidents to management

Processes for Assessing, Identifying, and Managing Material Risks from Cybersecurity Threats

(i)

Integration into Overall Risk Management:

Cybersecurity risk management is integrated into our broader risk management system. Regular risk assessments and business impact analyses are conducted to identify critical systems, applications, and data, as well as potential disruptions and their consequences. The Information Security Officer (ISO) conducts these assessments, which inform the development of contingency plans including redundancy, backup and recovery, alternate site operations, and data restoration.

(ii)

Engagement & Oversight of Third Parties:

We engage third-party assessors, consultants, auditors, and experts to strengthen our cybersecurity processes. For example, we utilize third-party services for continuous vulnerability scanning, perimeter testing, Dynamic Application Security Testing (DAST), and penetration testing to identify and address potential security weaknesses in our systems. Additionally, we engage expert architects to help design and maintain secure cloud infrastructures.

Our third-party engagement and oversight process includes conducting thorough due diligence, performing vendor risk assessments, and maintaining continuous monitoring to ensure that service providers adhere to our security standards and comply with contractual obligations.

Material Effects of Cybersecurity Threats

In the past year, we did not encounter any cybersecurity threats that materially affected or are likely to materially affect our business strategy, results of operations, or financial condition. Nonetheless, we continuously enhance our cybersecurity posture to mitigate potential material impacts. Our risk management program outlines procedures for regular log reviews, incident detection, and remediation to ensure ongoing protection of our information systems.

Cybersecurity Governance

Board of Directors’ Oversight

Our Board of Directors plays a critical role in overseeing cybersecurity risks as part of its broader risk oversight responsibilities. The Information Security Officer (ISO) provides the board with updates on cybersecurity risks and incidents. Significant cybersecurity incidents are reported to the board to ensure appropriate and timely responses.

Management’s Role in Assessing and Managing Cybersecurity Risks

(i)

Management Positions and Committees:

The ISO is responsible for developing and maintaining our cybersecurity and contingency plans, coordinating risk assessments, and managing incident responses. The ISO has extensive experience in building secure web applications for healthcare. In addition to the ISO, we engage consultants and DevOps engineers with relevant degrees and certifications to support our cybersecurity efforts. System Owners are responsible for identifying critical systems, assessing risks, and implementing appropriate security controls.

(ii)

Processes for Information and Monitoring:

We have established comprehensive processes for continuous monitoring and information sharing. These include regular reviews of audit logs, system activity analysis, and the deployment of Security Information and Event Management (SIEM) tools for centralized monitoring. These processes facilitate the timely detection and response to potential security incidents.

(iii)

Reporting to the Board:

The ISO regularly reports to executive management and the Board of Directors. These reports include findings from risk assessments, incident reports, and updates on the status of ongoing security initiatives, ensuring that the board is well-informed about our cybersecurity posture.

Cybersecurity Risk Management Processes Integrated [Text Block]

Cybersecurity risk management is integrated into our broader risk management system. Regular risk assessments and business impact analyses are conducted to identify critical systems, applications, and data, as well as potential disruptions and their consequences.

Cybersecurity Risk Management Third Party Engaged [Flag]

true

Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block]

In the past year, we did not encounter any cybersecurity threats that materially affected or are likely to materially affect our business strategy, results of operations, or financial condition. Nonetheless, we continuously enhance our cybersecurity posture to mitigate potential material impacts. Our risk management program outlines procedures for regular log reviews, incident detection, and remediation to ensure ongoing protection of our information systems.

Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]

The ISO is responsible for developing and maintaining our cybersecurity and contingency plans, coordinating risk assessments, and managing incident responses. The ISO has extensive experience in building secure web applications for healthcare. In addition to the ISO, we engage consultants and DevOps engineers with relevant degrees and certifications to support our cybersecurity efforts. System Owners are responsible for identifying critical systems, assessing risks, and implementing appropriate security controls.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]

The ISO is responsible for developing and maintaining our cybersecurity and contingency plans, coordinating risk assessments, and managing incident responses. The ISO has extensive experience in building secure web applications for healthcare. In addition to the ISO, we engage consultants and DevOps engineers with relevant degrees and certifications to support our cybersecurity efforts. System Owners are responsible for identifying critical systems, assessing risks, and implementing appropriate security controls.

Cybersecurity Risk Management Positions or Committees Responsible [Text Block]

The ISO is responsible for developing and maintaining our cybersecurity and contingency plans, coordinating risk assessments, and managing incident responses. The ISO has extensive experience in building secure web applications for healthcare. In addition to the ISO, we engage consultants and DevOps engineers with relevant degrees and certifications to support our cybersecurity efforts. System Owners are responsible for identifying critical systems, assessing risks, and implementing appropriate security controls.

Cybersecurity Risk Management Expertise of Management Responsible [Text Block]

The ISO has extensive experience in building secure web applications for healthcare. In addition to the ISO, we engage consultants and DevOps engineers with relevant degrees and certifications to support our cybersecurity efforts.