A. History and Development of the Company SOPHiA GENETICS SA was incorporated as a Swiss stock corporation (société anonyme) under the laws of Switzerland on March 18, 2011. Our principal executive office is located at La Pièce 12, CH-1180 Rolle, Switzerland and our telephone number is +41 21 694 10 60. Our agent for service of process in the United States is SOPHiA GENETICS, Inc., 401 Park Drive, Suite 505, Boston, MA 02215, and its telephone number is (617) 982-1210. Our website is www.sophiagenetics.com. The reference to our website is an inactive textual reference only and information contained therein or connected thereto are not incorporated into this Annual Report. We file reports and other information with the SEC, including annual reports on Form 20-F and reports on Form 6-K. The SEC maintains an internet site at www.sec.gov that contains reports, proxy and information statements and other information we have filed electronically with the SEC. In July 2021, we completed our initial public offering on the Nasdaq Global Select Market (“Nasdaq”) and our ordinary shares are listed under the ticker symbol “SOPH”. B. Business Overview Our Mission SOPHiA GENETICS was founded to generate clinically actionable insights from data to improve patient outcomes. Our mission is to provide equal access to knowledge and capabilities by democratizing data-driven medicine. We observed that across the healthcare ecosystem, a vast amount of digital healthcare data was being generated, fueled by technologies such as NGS, and which held promise to accelerate the understanding of biology and disease. However, this data has been generated primarily using non-standardized methods and by clinicians and researchers across many healthcare institutions. As a result, the data remained siloed and complex and was not fully leveraged for the benefit of patients. We founded SOPHiA GENETICS to address this issue. We are unlocking data silos, leveraging AI to generate actionable insights from data and helping healthcare professionals work together as a community and deploy their collective expertise for the benefit of patients around the world. We refer to data-driven medicine as the practice of drawing insights from complex data sets to improve diagnosis, treatment and drug development. Using data-driven medicine, healthcare professionals supplement their own experience and intuition with data insights and shared knowledge from their peers to inform the best course of action for their patients or research. Our goal is to empower clinicians and researchers around the world to practice data-driven medicine and improve clinical and scientific outcomes. Overview We are a cloud-native software technology company in the healthcare space dedicated to establishing the practice of data-driven medicine as the standard of care and for life sciences research. We purposefully built a cloud-native software platform capable of analyzing data and generating insights from complex multimodal data sets and different diagnostic modalities. Our platform, SOPHiA DDMTM, standardizes, computes and analyzes digital health data and is used across decentralized locations to break down data silos. This enables healthcare institutions to share knowledge and experiences and to build a collective intelligence. We envision a future in which all clinical diagnostic test data is channeled through a decentralized analytics platform that will provide insights powered by large real-world data sets and AI. We believe that a decentralized platform is the most powerful and effective solution to create the largest network, leverage data and bring the benefits of data-driven medicine to customers and patients globally. In doing so, we can both support and benefit from growth across the healthcare ecosystem. In 2014, we launched the first application of our platform to analyze NGS data for cancer diagnosis. We offer a broad range of applications used by healthcare providers, clinical and life sciences research laboratories and 53 Table of Contents biopharmaceutical companies for precision medicine across oncology, rare diseases, infectious diseases, cardiology, neurology, metabolism and other disease areas. In 2019, we launched our solution for radiomics data that enables longitudinal monitoring of cancer patients and tumor progression throughout their disease journey. In 2022, we unveiled SOPHiA CarePath, a multimodal module on SOPHiA DDM powered by proprietary artificial intelligence and machine learning algorithms, which also incorporates our original radiomics offering. The module allows healthcare practitioners to visualize data across multiple modalities (including genomic, radiomic, clinical, and biological) for individual patients in a longitudinal manner and derive additional insights through cohort design and comparison. SOPHiA CarePath has already been deployed as part of our Digital Twins tool, a breakthrough research technology that creates dynamic, virtual representations of individual patients to simulate potential outcomes and help oncologists make better treatment decisions. Today, we believe that our SOPHiA DDM Platform, commercialized under the name “SOPHiA DDM”, is one of the most widely used decentralized analytics platforms globally for clinical genomics. As of December 31, 2025, we served more than 993 hospital, laboratory and biopharma customers globally through our SOPHiA DDM Platform and related solutions, applications, products, and services, and our SOPHiA DDM Platform has supported the analysis of approximately 2,300,000 genomic profiles and has been utilized in clinical trials and research projects discussed in more than 2,712 peer-reviewed publications. As of December 31, 2025, we had approximately 528 core genomics SOPHiA DDM Platform customers (defined as the number of customers who generated revenue through usage of our bundle access, dry lab, and integrated access models during the specified time period, which, in this case, is the twelve months ended December 31, 2025). In addition to our core genomics customers we have many customers utilizing the Alamut product on a stand alone basis. We commercialize our SOPHiA DDM Platform and related solutions, applications, products, and services as RUO and CE-IVD products. In the United States, our products are labeled and sold for research use only. Because such applications and products are not intended for use in clinical practice and diagnostics and cannot make clinical or diagnostic claims, the FDA regulations require that RUO applications and products be labeled “For Research Use Only. Not for use in diagnostic procedures.” In the EU, we have self-certified our applications and products without the intervention of a notified body in order to affix the CE marking. Data-driven medicine has become possible through technological breakthroughs, like NGS, that have driven creation of digital healthcare data and an accelerated understanding of biology and disease. While genomics has played a large role in these advances, emerging technologies such as radiomics, digital pathology and proteomics are creating new data sets that add phenotypic context to genomic information. Additionally, the adoption of EHRs has enabled the matching of clinical outcome data to these data sets. The digital format of these data sets makes them ideal candidates for data exploration, analysis and interpretation by advanced algorithmic computing solutions. We believe that analytics approaches have traditionally primarily focused on analyzing data from a single modality and not on combining structured data from multiple modalities. Although some institutions and laboratories have created service-based business models designed to capture multimodal data, these approaches are typically centralized at a single institution, which we believe limits their ability to scale globally. With our SOPHiA DDM Platform, we have the potential to serve and collaborate with all types of institutions in the global life sciences ecosystem, including healthcare providers, clinical and life sciences research laboratories and biopharmaceutical companies. Our platform is built on a decentralized model in which we push data analytics solutions to our customers’ sites, rather than a centralized model that requires samples to be sent to a central location. Our customers therefore generally perform testing on their own samples, retain custody of both their sample and data, and use our SOPHiA DDM Platform to analyze the pseudonymized and de-identified data and share insights with other sites in our network. Through this process, we create and grow a global collective intelligence. Our platform is designed to improve as we analyze more data over time, leveraging AI and then sharing the benefits of this growing collective intelligence with our customers. We believe that our global platform empowers better patient care through data-driven medicine by offering the following benefits for customers: •high accuracy genomic analysis to support clinical diagnosis and life sciences research; •rapid turnaround time for data analysis and insights; •ability to lower cost of data analysis through higher efficiency; 54 Table of Contents •capacity to develop their own in-house precision medicine expertise and operations, retain custody of their samples and data and use their preferred instrument setup; and •option to rapidly launch new precision medicine applications on our SOPHiA DDM Platform. We believe that our strategic positioning as a universal healthcare analytics platform for multimodal data analytics offers us a broad range of application, product, and service expansion opportunities and significant long-term growth in our total addressable market opportunity. We estimate the total addressable global market opportunities in 2025 for our current commercial clinical applications and for our current biopharma applications were approximately $25 billion and $15 billion, respectively. We offer a range of platform access models to meet our customers’ needs. Our primary pricing strategy for our clinical customers is a pay-per-use model, in which customers can access our platform free of charge but pay for each analysis performed using our platform. To commercialize our applications and products, we employ our direct sales force, use local distributors and form collaborations with other global product and service providers in the healthcare ecosystem to assemble solutions to address customer needs. For example, we combine our solutions and applications with other products used in the genomic testing process to provide customers integrated products in the testing workflow. We offer our SOPHiA DDM Platform and related solutions, applications, products, and services across 75 countries through our direct sales force and our distributor partners. As of December 31, 2025, our direct sales team consisted of more than 105 field-based commercial representatives with a direct presence in 60 countries. To supplement our direct sales force, we also offer our SOPHiA DDM Platform and related solutions, applications, products, and services in 50 countries through our distributor partners. The Importance of Data-Driven Medicine Over the last decade, there has been an explosion in the amount of healthcare data. This growth has been fueled by technologies that enable high throughput analysis and data generation at large scale, as well as the collection and digitization of real-world health data in EHRs. The ability to draw insights from this data has led to an acceleration in the understanding of biology and disease and paved the way for data-driven medicine. Data-driven medicine aims to produce better clinical and scientific outcomes by drawing insights from complex data sets to improve diagnosis, treatment and drug development. Using data-driven medicine, healthcare professionals are able to supplement their own experience and intuition with shared knowledge and data insights from their peers and have the potential to select the best course of action for their patients or research. Genomics is propelling data-driven medicine. The development of large-scale genomics data is advancing data-driven medicine. With broad access to NGS technologies, the life sciences field is beginning to successfully document the relationship between the genome and various diseases and is deploying this information to improve clinical and scientific outcomes. This has given rise to the field of precision medicine, which is having an increasing impact on a range of life sciences areas. In oncology, for example, advancements in genomics and the understanding of cancer have fueled the growth of a large precision oncology ecosystem, in which genomic information is critical to informing diagnostic, treatment and drug development decisions. In other areas such as rare diseases, cardiology, neurology, metabolism and infectious diseases, the adoption of data-driven medicine is just beginning and represents a significant opportunity for growth. For instance, in cardiology, clinical genomics is becoming more common for screening, diagnostic and therapy selection for certain inherited conditions, while in neurology, clinical genomics is helping direct treatment decisions for therapeutic intervention. Multimodal data provides novel and deep insights to assess health and disease states. While the growing understanding of genomics has dramatically advanced the life sciences field and data-driven medicine, it is only one piece of the biological equation. Phenotypic information is also needed to put genomic information into context and provide a more complete picture of biology and disease. Driven by this need, innovation is accelerating across new health technologies, such as radiomics, digital pathology and proteomics, providing this phenotypic context. We believe that combining data from different instrument modalities, or a multimodal approach, will transform clinical and scientific outcomes by generating clinically actionable insights from combined relevant healthcare data sets. If leveraged properly, these data sets have the potential to provide a stronger “signal,” or window into biology and disease, than any single modality alone. In oncology, for example, oncologists can characterize the genetic determinants of a tumor at the time of diagnosis and complement this 55 Table of Contents with phenotypic information through radiomics analysis of CT, MRI, SPECT and PET imaging, digital pathology analysis of histology slides and proteomics analysis of the tumor stroma and blood samples. Then, throughout a patient’s disease journey, the oncologist can collect longitudinal insights through imaging, liquid biopsies and proteomics assessment of repeat blood sampling. This information can be aggregated and linked to clinical outcome data to find associations between disease evolution and response to therapy. In addition, deep-learning algorithms applied to multimodal data sets now make it possible to predict the evolution of a disease or the response to a specific treatment with high accuracy, in order to inform the best treatment decisions for the patient. These unique insights are driving the opportunity and demand for analytics platforms that can draw clinically actionable insights from this information. AI/ML produce novel insights from large and complex data sets. The output of these new health technologies is generated in a digital format, making data highly amenable to advanced algorithmic computing solutions for exploration, analysis and interpretation. AI approaches have enabled the ability to standardize, classify, analyze and interpret massive volumes of data, and separate the signal from the noise. Large volumes of digital information across modalities can then be mined using AI approaches to generate novel insights, enabling truly data-driven medicine. Challenges to the Adoption of Data-Driven Medicine Today While we believe that data-driven medicine has the potential to transform healthcare, currently, there are significant challenges that limit its democratization and adoption at scale. These challenges include: •Lack of data harmonization and standardization across the healthcare ecosystem. Data is often produced with different approaches and methodologies, which can result in dramatic variability in data quality. In the clinical genomics field, for example, every experimental step, from using different technologies for nucleic acid extraction and DNA or RNA amplification to using different models of NGS instruments, could lead to inconsistent data across sites and experiments, or “noise” in the data. As a result, obtaining a comparable set of clinical genomics data can be challenging, particularly in decentralized settings in which inter-laboratory variability can be considerable. •Data silos and lack of knowledge sharing. Most healthcare data is produced by different healthcare institutions and by centralized laboratories that use different instrument modalities. As a result, data is created and remains in silos. In hospitals, for example, clinicians may struggle to collect and piece together data sets from clinical genomics to pathology to medical imaging for patients that have been produced in different, non-standardized ways. Pharmaceutical companies face similar challenges when reconciling their clinical trial data with disparate real-world data sources, resulting in highly variable quality of insights. •Barriers to collaboration. Healthcare professionals and researchers may be limited in their ability to share their patients’ healthcare data for various reasons, such as privacy or concerns over losing control of their data. In addition, they have difficulties collaborating with peers from different sites or different fields. As a result, collaborations among healthcare professionals and researchers across different sites and fields is suboptimal. •Healthcare infrastructure is designed to facilitate healthcare delivery at a local or regional level, rather than on a global scale. Healthcare infrastructure is generally designed around centralized institutions, such as hospitals and laboratories, that generate data within their own facilities. This centralized design is not built to scale or to provide equal access to data-driven medicine globally. •Existing software analytics approaches are limited in their ability to generate insights from multimodal data. Traditional approaches to software analytics solutions have primarily focused on analyzing data from a single modality and not on combining structured data from multiple modalities. Existing analytical software solutions thus have limited utility to generate insights from multimodal information. 56 Table of Contents Our SOPHiA DDM Platform We believe that a decentralized platform is necessary to create the largest network that will bring the benefits of big data to customers and to both support, and benefit from, growth across the healthcare ecosystem. We purposefully built a cloud-native software platform capable of being used in decentralized locations and of analyzing data from multiple modalities and that can be scaled globally. With our SOPHiA DDM Platform, we have the potential to serve and collaborate with a variety of types of institutions in the healthcare ecosystem, including healthcare providers, centralized laboratories and biopharmaceutical companies. Our SOPHiA DDM Platform is a global, cloud-native software platform that we began building in 2011. It is powered by our SOPHiA AI that standardizes, computes and analyzes digital health data, generating insights from complex multimodal data sets that have the potential to improve diagnosis, therapy selection and drug development. Our customers generally perform testing on their own samples, retain custody of both their sample and data, and use our SOPHiA DDM Platform to analyze the pseudonymized and de-identified data and share insights with each other. Through this process, we create and grow a collective intelligence. We offer multiple platform access models that enable customers to choose how they want to use our platform and customer network. These range from models in which customers produce their own data independently through their own testing operations to those in which customers produce the data through testing operations provided by our network of customer institutions. In all cases, customers access their data and our analytics through our SOPHiA DDM Platform. Our platform is designed to continually improve as we analyze more data over time, leveraging AI and then sharing the benefits of this growing collective intelligence with our customers. We believe that our SOPHiA DDM Platform addresses key challenges to the adoption and democratization of data-driven medicine by: •Enabling data harmonization and standardization across the healthcare ecosystem. The accuracy of our pattern-recognition AI/ML-based algorithms enables our platform to separate the signal from the noise and standardize data at high-quality levels. •Breaking down data silos. We empower our customers to practice data-driven medicine through a decentralized model and support clinicians, laboratories and researchers across the healthcare ecosystem to improve clinical and scientific outcomes. •Empowering clinicians and researchers to collaborate with peers from different sites or different fields. Our customers use our platform to share insights with each other across sites in our network. Our platform is designed to improve as we analyze more data over time, leveraging AI and then sharing the benefits of this growing collective intelligence with our customers. •Offering a highly scalable platform. We designed our cloud-native software platform to be capable of scaling globally and to use AI to leverage the data that this scale provides. •Generating insights from complex multimodal data sets. We believe our platform is uniquely positioned to combine high-quality data at the patient level to generate multimodal insights, leveraging the power of advanced AI/ML models. 57 Table of Contents The following figure shows how our SOPHiA DDM Platform functions within the healthcare ecosystem. Our SOPHiA DDM Platform within the Healthcare Ecosystem We launched the first commercial application of our platform in 2014 to analyze NGS data for cancer diagnosis. We now offer a broad range of applications focused on precision medicine across oncology, rare diseases, infectious diseases, cardiology, neurology, metabolism and other disease areas. In 2019, we launched our solution for radiomics data that enables longitudinal monitoring of cancer patients and tumor progression throughout their disease journey. In 2022, we unveiled SOPHiA CarePath, a new module that will further enhance our solution for longitudinal monitoring of cancer patients and tumor progression by integrating data across multiple modalities including genomic, radiomic, clinical, and biological). CarePath serves as the successor to our radiomic solution, which we plan to integrate into the module. Our Network and Data Today, we believe that our SOPHiA DDM Platform, commercialized under the name “SOPHiA DDM,” is one of the most widely used decentralized analytics platforms globally for clinical genomics. As of December 31, 2025, we served more than 993 hospitals and laboratory customers globally through our SOPHiA DDM Platform who are part of our clinical genomics network. The establishment and creation of this network of customers has enabled us to capture and compute approximately 2.3 million raw clinical genomics profiles in oncology and other genetic-related disorders as of December 31, 2025, which is now growing by approximately 33,000 new profiles on a monthly basis. Our SOPHiA DDM Platform Architecture We believe that our platform architecture allows our platform to be highly flexible and scalable in terms of analyzing larger volumes of data, supporting additional data modalities, expanding to new geographies and deploying new applications and functionalities. This flexibility and scalability comes from our platform’s underlying architecture that is developed based on a deep understanding of our users’ needs and a thorough domain model, allowing us to build re-useable User Interface (“UI”) components and services to interact with the data. Our SOPHiA DDM Platform includes multiple tailored analytics engines, each tuned to specific domains and use cases. Each domain is responsible for its own data with a common shared data model that allows powerful Extract-Transform-Load (“ETL”) pipelines to process specific data sets, integrating data into a series of regional data warehouses that enable comprehensive and performant multimodal queries to be run across the entire global data set. We have nine regional data centers in Switzerland, France, the Netherlands, the United States, Canada, Brazil, Australia, and the UAE. 58 Table of Contents As of December 31, 2025, this platform architecture was deployed in 75 countries through our cloud-based solution. We have developed significant operational experience by running such a large-scale cloud-based platform, which we believe enables us to deploy rapidly in new geographies. We have demonstrated that we can deploy in a new geography in approximately one to four weeks if appropriate cloud infrastructure exists in Microsoft Azure, twelve weeks if such cloud infrastructure does not exist. We regularly release platform updates. Through these updates, we offer our customers either new content, in the form of new applications, or improvements to existing applications, such as new functionalities. We believe the frequency of our updates is a competitive advantage in a rapidly evolving precision medicine ecosystem and allows our customers to benefit from new biological discoveries, such as genomic associations, that are reflected on the platform. Cybersecurity As part of our business, we collect, transmit, receive, process, use and store pseudonymized and de-identified data provided by our customers. Our customers are required to obtain their patients’ consent to our use of the data. We use security techniques designed to safeguard data received from our customers using a combination of data architecture, pseudonymization, anonymization, minimization and segregation, and process and store this data only in accordance with our agreements with customers and applicable data protection laws and regulations. This data is aggregated and analyzed by our proprietary algorithms and models in our SOPHiA DDM Platform to generate insights. These insights, which show aggregated and general trends without identifying specific patients and without providing personally identifiable information, form the growing collective intelligence that we provide to our customers. Cybersecurity and data protection are core tenets of our company. We have processed over 2.3 million genomic profiles and continue to process more than 70 terabytes of data each month for our customers around the world, subject to applicable data protection laws and regulations, including HIPAA and the GDPR. We accomplish this through our global compliance framework that integrates specialized and dedicated personnel, procedures and controls and ISO/IEC 27001:2022, ISO/IEC 27017:2015 and ISO/IEC 27018:2019 security infrastructure and cloud service processing, to protect data against damage, loss and unauthorized access, use, modification, disclosure or other misuse. Applications of Our Platform We currently have commercial applications targeting both clinical and biopharma markets. We serve our clinical market customers through two offerings of our SOPHiA DDM Platform. Our first offering is our SOPHiA DDM Platform for clinical genomics, spanning a broad range of applications that we market for analyzing genomic data across oncology, rare diseases, infectious diseases, cardiology, neurology, metabolism and other disease areas. Our SOPHiA DDM Platform empowers customers to build their own precision medicine operations, including testing, and then use our platform to generate insights from their data. Our second offering is our Alamut suite of genomics mutation interpretation software, which is connected to our SOPHiA DDM Platform and gives our customers advanced analytics capabilities for a deeper and more informed genomic data interpretation. For revenues generated from applications for which the disease end market is known, approximately 73% of our revenue from clinical customers in the year ended December 31, 2025 was attributable to oncology applications, including hereditary cancer, while approximately 27% was attributable to other disease areas such as rare diseases, cardiology, neurology and metabolism, with applications ranging from targeted gene panels to whole-exome solutions. In the future, we intend to pursue additional IVD status and FDA approval for specific solutions. We also intend to support external collaborators in deploying their own IVD or FDA-approved solutions on our SOPHiA DDM Platform. We serve our biopharma customers by leveraging the capabilities and Data of our SOPHiA DDM Platform to help customers solve bottlenecks across the biopharma value chain, including throughout the Discovery, Development and Deployment stages. We currently have four branded applications for biopharma customers: SOPHiA Insights for generating insights pre- and post-approval of a drug based on our own proprietary SOPHiA DDM Platform data sets or on the biopharma customers’ own data sets; SOPHiA Trial Match for clinical trial 59 Table of Contents recruitment of biomarker-defined patient populations; SOPHiA CDx for companion diagnostics development and deployment in our decentralized network of customer institutions; and SOPHiA Awareness for providing real-world insights into NGS testing to inform market-shaping and commercialization strategies. We launched our initial applications for the biopharma market in 2019. The following figure shows our applications that we currently commercialize across both clinical and biopharma markets. Our SOPHiA DDM Platform’s Applications Currently in Market Clinical Applications In the clinical market, we currently serve three main customer segments: academic and non-academic hospitals (including comprehensive cancer centers and children’s hospitals), reference laboratories and specialty laboratories. We currently serve our clinical market customers through two offerings of our SOPHiA DDM Platform: our SOPHiA DDM Platform for clinical genomics and our Alamut suite of genomics mutation interpretation software. We have also unveiled SOPHiA CarePath, a multimodal module on our SOPHiA DDM Platform, encompassing the capabilities of our radiomic solution, which we plan to commercialize across our clinical customer base in the future. Oncology Applications Our oncology applications support both germline and somatic oncology testing across both solid and liquid tumors. Our commercial oncology applications support diagnosis, therapy selection and disease monitoring. Our SOPHiA DDM Platform also supports the deployment of novel oncology testing applications. In genomics, this includes liquid biopsy-based early cancer screening as well as treatment response monitoring and minimal residual disease monitoring. In multimodal, we are able to complement and enhance our genomics capabilities with other data modalities, such as radiomic and clinical data, to include diagnosis, prediction of disease evolution and response to specific therapies, as well as longitudinal follow-up of the tumor for treatment response monitoring. The following figure shows our current applications in oncology. 60 Table of Contents Our SOPHiA DDM Platforms’ Oncology Applications Non-Oncology Applications Our non-oncology applications currently focus on disease areas such as rare diseases, cardiology, neurology and metabolism, with applications ranging from targeted gene panels to whole-exome solutions. While clinical genomics applications are still emerging in these disease areas, we expect significant opportunity as the life sciences field continues to establish the genetic determinants of high-profile diseases such as hereditary cardiovascular conditions, multiple sclerosis, Alzheimer’s disease, autism and metabolic syndrome. We also see significant promise of multimodality in these other disease areas, for example, in cardiology by generating novel multimodal insights stemming from the joint analysis of genomics data, radiomic analysis of ultrasound images and analysis of electrocardiograms. Our SOPHiA DDM Platform in Genomics We believe that our technical capabilities are cutting-edge in the genomics space. Our platform can process data from any type of biological sample, including fresh frozen tissue, formalin-fixed paraffin-embedded samples as well as liquid circulating tumor DNA samples. It can also process data from any nucleic acid source across DNA and RNA. We can identify with confidence any type of genomic alteration, including single nucleotide variants (“SNVs”), insertions-deletions (“indels”), copy-number variations (“CNVs”) and gene fusions, as well as more complex mutational signatures such as microsatellite instability (“MSI”), tumor mutational burden (“TMB”), homologous recombination deficiency or minimal residual disease. Our smart algorithms allow us to reach high accuracy on the detection and identification of challenging genomic alterations, such as mutations in CEBPA or FLT3-ITD, MET exon14 skipping mutations, or rare gene fusions. The following figure shows our SOPHiA DDM Platform’s capabilities in genomics. 61 Table of Contents Our SOPHiA DDM Platform’s Capabilities in Genomics Our SOPHiA DDM Platform clinical genomics workflow involves CLIA-CAP and equivalent laboratories in academic hospitals, comprehensive cancer centers, children’s hospitals and reference and specialty laboratories collecting patient samples and conducting the genetic sequencing on their premises. In doing so, they can use different NGS solutions on different NGS sequencing instruments. For somatic oncology applications, for example, the laboratory technician logs into our SOPHiA DDM Platform and loads the raw, pseudonymized, NGS data of multiple patients from the sequencing run, indicating the oncology indication to be investigated. The genomics data is securely transferred to our platform that operates globally in eight different regional data centers, keeping the data closest to the customer and complying with all local data handling requirements. The data is automatically recognized by our AI-based smart algorithms that check data quality. All types of genomic variants and signatures are then detected and identified with high accuracy, including SNVs, indels, CNVs, fusions, MSI and TMB. This molecular information is then annotated and pre-classified using AI/ML techniques. The principal investigator, usually a pathologist or geneticist (for germline applications), accesses the results and completes the interpretation. The principal investigator may flag or store the genomic variants that he or she has recognized as being associated with a certain disease on our platform. Because of the decentralized nature of our network, other users in different sites can see the aggregated flagging of a specific variant from the community to further assist their own interpretation. The more interpretations being conducted in our platform, the more novel knowledge is generated and made available to our community. Our platform is particularly easy to use as it does not require an additional technician and provides a user-friendly interface to upload data and navigate data analytics. We believe that this ease-of-use, coupled with the scale of our decentralized platform, will empower our users to continue to rapidly uncover new variants. This workflow is technology-agnostic in terms of sequencer type and sample preparation technology and supports a broad range of different commercial NGS solutions. The following figure shows our SOPHiA DDM Platform’s genomics workflow. 62 Table of Contents Our SOPHiA DDM Platform’s End-to-End Genomics Workflow Our SOPHiA DDM Platform in Multimodal Data Analytics Through our SOPHiA CarePath module on our SOPHiA DDM Platform, we can support the multimodal analysis of any source of digital health data, developing machine learning predictive models of aggregated multimodal data stacks for the same patient. We can support the analysis of clinical, biological, genomics, radiomics data today and intend to support additional data modalities such as digital pathology, proteomics, spatial genomics and metabolomics in the future. We offer a range of predictive modeling applications ranging from disease screening, disease early detection, disease diagnosis and subtype discrimination, prediction of disease evolution, prediction of response to therapy, therapy selection and monitoring. We develop these multimodal predictive models in close collaboration with leading academic institutions together with cross-functional teams consisting of treating physicians (such as oncologists), radiologists and pathologists. Illustrative examples of advanced clinical research projects in which we have proof-of-concept data include prediction of response to anti-PD-1 immunotherapy for patients with metastatic non-small cell lung cancer, and prediction of pathological complete response after neoadjuvant therapy for patients with triple-negative breast cancer. For example, we sponsored a retrospective 57-patient analysis of the use of nivolumab for the treatment of relapsed or refractory non-small cell lung cancer to identify predictive markers of immune-oncology response based on multiple sources of data through machine learning analysis. We found that machine learning could help predict a patient’s response using baseline data and can help identify markers that are predictive of the patient’s response. We are sponsoring multimodal clinical studies to refine and assess the clinical significance of some of these multimodal signatures, which we believe will enable us to further improve our SOPHiA DDM Platform and develop new predictive algorithmic models that we can then deploy on our platform to serve a wide range of stakeholders, including oncologists and other treating physicians. The following figure shows our SOPHiA DDM Platform’s capabilities in multimodal data analytics. 63 Table of Contents Our SOPHiA DDM Platform’s Capabilities in Multimodal Data Analytics Among our multimodal capabilities, besides our initial core competency in genomics, we have built out technical capabilities that we believe are cutting-edge in the radiomics space. These capabilities are integrated into and offered through our SOPHiA CarePath module. We can process and analyze data from any type of three-dimensional medical imaging technology, including CT, PET, MRI and SPECT scanners. We have developed AI/ML-powered segmentation algorithms that detect tumors in the scans and that segment and reconstruct tumors in three dimensions on our SOPHiA DDM Platform. Our current segmentation applications cover a wide range of major tumor types, including lung, breast, liver, kidney and brain cancer, supporting the analysis of primary and secondary (i.e., metastatic disease of another organ origin) tumors. In addition, we are developing new applications in areas such as colorectal, prostate, ovarian or neuroendocrine cancers. Radiomics features extraction is conducted on segmented tumors, generating hundreds of data points across volumetric, morphological, first order (i.e., heterogeneity), second order (i.e., texture), and deep-learning generated features. Our features extraction process is compliant with the Image Biomarker Standardization Initiative (“IBSI”) recommendations, such that results from our radiomics analyses are standardized and can be readily compared with similar analyses globally. Through our segmentation and radiomics features extraction steps, we turn existing medical images into hundreds of novel data points. We offer radiomics applications ranging from disease detection, discrimination of disease histological subtypes, prediction of tumor evolution and prediction of disease progression. In the future, we intend to develop additional radiomics applications for existing and new tumor types, as well as for disease areas outside of oncology, such as cardiology, neurology and metabolism. Additionally, we may expand applications to other imaging modalities such as two-dimensional modalities (e.g., ultrasound, traditional x-rays) as well as testing modalities that can be processed through imaging-based approaches (e.g., electrocardiograms). The following figure shows our SOPHiA DDM Platform’s capabilities in radiomics. 64 Table of Contents Our SOPHiA DDM Platform’s Capabilities in Radiomics While the data modality is different for radiomics compared to genomics, the same overall workflow and principles apply. The user, typically a radiologist, identifies the relevant medical images for a specific patient in the local picture archiving and communication system. The user then uploads the images into our SOPHiA DDM Platform. For a metastatic lung cancer case, for example, deep learning and other machine learning proprietary algorithms automatically detect the imaging modality, recognize the organ, segment the tumor and extract more than 200 radiomics features from the tumor image. These radiomics features can then be aggregated with genomics, clinical and biological data from the same patient. The following figure shows our SOPHiA DDM Platform workflow for radiomics. Our SOPHiA DDM Platform’s End-to-End Radiomics Workflow Biopharma Applications In the biopharma market, we currently serve three types of customers: pharmaceutical companies, biotechnology companies, and CROs. Leveraging both our SOPHiA DDM Platform genomic applications and our customers’ own proprietary data through our AI/ML-powered multimodal analytics capabilities, we help customers solve development complexities and bottlenecks across the biopharma value chain. We categorize our applications based on a framework to address specific needs across the Discovery, Development, and Deployment stages of the drug and therapeutic life cycle both pre- and post-commercialization supported by the underlying data generated on our Platform. Across our application portfolio, we offer four branded applications: SOPHiA Insights, SOPHiA Trial Match, SOPHiA Awareness and SOPHiA CDx, to address the needs of our biopharmaceutical and biotechnology customers, including diagnostic assay development, clinical trial matching and application, drug and therapeutic design optimization, and diagnostic assay deployment. The following figure shows our capabilities across the biopharma value chain. 65 Table of Contents SOPHiA GENETICS’ Offerings across Biopharma Value Chain We began commercializing biopharma applications in 2019. Our biopharma applications are competitively positioned as insights programs, which utilize data already uploaded to the SOPHiA DDM Platform or proprietary data provided directly by a biopharma customer. We believe that our customers value our biopharma applications for their ability to identify unique patient populations in clinical research and asset commercialization efforts. We signed our first biopharma customer in 2019. We served four biopharma customers accross multiple programs during the fiscal year ended December 31, 2025. Discovery Applications. While Moore’s law has generally played out accordingly in the computation and software space with significantly greater efficiency for lower cost being achieved over time, Eroom’s law has been used to explain an observed trend in the drug discovery space as the inflation-adjusted costs to bring a drug to market continue to rise over time. Despite the improvements in technology over time, drug discovery has remained very complex with many critical decisions that need to be made along the way at which point could ultimately lead to an unviable path forward. To address the growing costs of drug discovery, biopharma and biotechnology companies are increasingly turning to technology solutions, particularly artificial intelligence and machine learning, to apply the benefits of Moore’s law to reverse the observed costs according to Eroom’s law. With our SOPHiA DDM Platform, we can help our biopharma and biotechnology customers make more informed decisions in the drug discovery process by leveraging the data we generate on our SOPHiA DDM Platform across our global network and applying our proprietary artificial intelligence and machine learning algorithms to the data across our network and the proprietary data of our customers. Within the Discovery segment, our current primary focus is on the later sub-stages post target identification and prior to Development, such as assay development and lead optimization. Development Applications The drug and therapeutic development process can be very long and capital intensive. There are both significant financial and opportunity costs that are incurred but never recouped should a drug or therapeutic fail in development stage. To increase the likelihood of success, biopharmaceutical and biotechnology companies are increasingly turning to algorithm based approaches powered by machine learning and artificial intelligence to better predict drug properties and aid in drug and therapeutic design and clinical trial testing and applications. We are supporting our biopharma and biotechnology customers in the drug and therapeutic development process through our decentralized, technology agnostic SOPHiA DDM Platform powered by our machine learning and artificial intelligence algorithms. Our SOPHiA DDM Platform’s unique ability to harmonize data derived from diverse genomic instruments and deploy as a robust, standardized solution enables a new model for clinical trial testing through a decentralized approach, allowing our biopharma and biotechnology customers to optimize patient selection and clinical trial design. Leveraging our SOPHiA DDM’s capabilities and multimodal data, we can also support our customers in developing companion diagnostics (“CDx”) to improve testing across the target patient populations and help them in optimizing their drug and therapeutic designs. Through 66 Table of Contents our SOPHiA CarePath module, we will also enable our customers to track patients longitudinally across multiple data modalities to support their clinical trials. Deployment Applications As biopharmaceutical companies begin deploying their drugs and therapies, they can face challenges associated with the identification and enrollment of eligible patients. To increase adoption, biopharma companies have partnered with clinical institutions to expand access to diagnostic testing that could help identify new patients eligible for and who can benefit from the new drugs and therapies. We can help our biopharma customers with their deployment-related challenges in multiple ways. In the absence of an applicable diagnostic assay, the versatility of our SOPHiA DDM Platform allows us to support our customers by helping them develop new targeted assays, including companion diagnostics, to diagnose and identify eligible patients. We can then help our customers expand access to diagnostic testing by deploying a SOPHiA GENETICS developed diagnostic assay or a third-party developed diagnostic assay across our broad global network of hospital and laboratory customers. SOPHiA Insights Faced with a complex and fragmented precision medicine environment, we believe biopharmaceutical companies need access to high quality real-world data sets and advanced data analytics capabilities to generate insights from these data sets to inform their decision-making. However, currently, these data sets are often fragmented, siloed and of variable quality, while data analytics capabilities are typically more focused on single-modality applications. We offer solutions to support biopharma customers by generating insights pre- and post-approval of a drug throughout the entire pharma value chain, including the research, development and commercialization stages. We can generate these insights both based on our SOPHiA DDM Platform real-world data sets and by leveraging our AI/ML-powered multimodal analytics capabilities on the biopharma customer’s own data sets, including data from their clinical trials. For example, a biopharmaceutical company may ask us to generate insights from our platform regarding the real-life molecular epidemiology of rare genomic variants in a specific cancer type, including NGS sequencing install base and testing practices across geographies. A biopharmaceutical company may also ask us to support it in the AI/ML-powered multimodal analysis of its own data sets, which could include genomics, clinical, biological and medical imaging data from its clinical trials, for example to identify new biomarkers associated with patient subgroups that may have a higher likelihood of response to an investigational therapy. As we generate increasingly more multimodal patient-level data stacks in our SOPHiA DDM Platform, in the future, we may support biopharmaceutical companies on novel use cases, including real-world virtual control arms for clinical trials. SOPHiA Trial Match Challenges of clinical trial patient enrollment is a major bottleneck for clinical trial sponsors, which leads to delays, increased costs and clinical trial failures. This challenge is magnified in the case of biomarker-targeted investigational therapies associated with rare genomic variants due to the difficulty of finding and recruiting patients with the desired genomic traits. With SOPHiA Trial Match, sponsors can place “molecular alerts” in our SOPHiA DDM Platform for specific genomic variants or signature that may indicate eligibility for a clinical trial. When a genomic profile matching the recruitment criteria is detected in our platform, the participating local healthcare Institutions or research centers are notified in real-time and given the opportunity to connect with the clinical trial sponsor. We provide the real-time trial matching services for our participating customers. SOPHiA CDx We are witnessing a steady growth in the number of regulatory approvals for therapies linked to companion diagnostic assays in oncology and other disease areas. Today, these CDx assays are typically used in a centralized model in which healthcare institutions lose access to their samples and data and which can suffer from poor turnaround times due to logistical issues. We believe that in the future CDx assays will become increasingly decentralized which will drive further testing uptake at scale and enable faster turnaround times. 67 Table of Contents We offer strategic and operational support for biopharma CDx programs. Biopharma customers can leverage our capabilities to develop genomic variant detection and identification solutions with high accuracy and precision, as well as our ability to decentralize such CDx solutions at scale through our global footprint. We believe that, in the future, CDx programs may become multimodal in nature, which we would be in a position to support through our multimodal analytics capabilities. SOPHiA Awareness As biopharmaceutical companies commercially launch new biomarker-targeted therapies (e.g., linked to a specific companion diagnostic assay), they face significant challenges in driving broad adoption and testing rates of specific biomarkers of interest. For example, the genomics testing landscape is currently fragmented with important regional and local variations. In that context, we believe it is imperative for biopharmaceutical companies to adequately manage parallel and interdependent adoption curves across the biomarker testing and therapy prescription dimensions. While biopharmaceutical companies tend to have insights into prescription patterns by health practitioners, they typically lack insights into real-life genomics testing practices across geographies. We support biopharma customers with real-world insights on NGS testing trends to support their market-shaping and commercial strategies. For example, when novel therapies enter the market, a biopharmaceutical company may ask us to provide regular aggregated statistical reports on NGS testing results in specific geographies to optimize resource allocation for its go-to-market strategy. A biopharmaceutical company may also collaborate with us to increase the NGS testing rate of specific biomarkers in our network, thus supporting the identification of relevant genomic variants for targeted therapies, for example by sponsoring increased testing volumes and NGS panel upgrades. As more data modalities are computed in our SOPHiA DDM Platform, we envision additional market opportunities for SOPHiA Awareness. Alamut Suite of Genomics Analysis Software Our offering in the clinical genomics space also includes the Alamut suite of genomics mutations interpretation software. This add-on software is connected to our SOPHiA DDM Platform through an API and provides our customers with advanced analytics capabilities for a deeper and more informed genomic data interpretation. It simplifies and accelerates variant interpretation workflows by providing an exploration and visualization application powered by an extensive collection of top-ranked external databases and proprietary prediction tools, which has the potential to be particularly impactful in deepening genomic investigations in rare diseases. In the future, we plan to offer other add-on software solutions that are integrated with our SOPHiA DDM Platform, including software solutions from external collaborators, and that provide additional analytics capabilities. Such offerings have the potential to further increase the value of our SOPHiA DDM Platform through indirect network effects, attracting new types of customers and solutions to our network. Clinical Publications Our technology and its broad applications have been utilized in clinical trials and research projects discussed in more than 2,712 peer-reviewed publications as of December 31, 2025. These publications support scientists in new discoveries and applications across oncology, immunology, cardiology, neurology, rare diseases and other disease categories. Access Models We currently have three models through which customers access our SOPHiA DDM Platform. In the dry lab access model and the bundle access model, we empower customers to produce their own data. In the integrated access model, we help customers produce data through our existing network of institutions. In all cases, clinical customers access their data through our SOPHiA DDM Platform. Our biopharma customers can access our SOPHiA DDM Platform through the same three models, but they may also have access to data generated through our SOPHiA DDM Platform in the form of custom reports and analytics. The dry lab access model involves customers using the testing instruments and consumables of their choice and our SOPHiA DDM Platform and algorithms for variant detection and identification. In this model, we provide clinical genomics analytics capabilities without influencing the tools that customers use to generate the data. For 68 Table of Contents example, in genomics, a laboratory might order an NGS kit directly from the manufacturer, conduct the sequencing using its installed sequencer and then use our smart algorithms in our SOPHiA DDM Platform for data analytics. The bundle access model enables us to support our customers end-to-end across the data generation, analytics and reporting steps. In this model, we bundle third-party instruments and consumable products with our analytics solution to provide customers the ability to perform end-to-end workflows. By bundling our algorithmic capabilities with specific high-performance instruments and consumables from third parties, we can further increase the accuracy of our genomics solutions. The integrated access model provides customers with the ability to access high-quality data on our platform even when they cannot generate data themselves. Customers that are not able or do not wish to locally conduct the sequencing steps, for example, due to a lack of appropriate resources, can have their samples processed and sequenced within our SOPHiA clinical network. We route their samples to selected SOPHiA DDM Platform collaborators who conduct the sequencing process for the customer and upload the resulting data into our SOPHiA DDM Platform. The customer is then able to access the data through our SOPHiA DDM Platform. Through this model, the selected SOPHiA DDM Platform collaborators can increase their sequencing volumes, while our SOPHiA DDM Platform is further enriched by the data produced. The same conceptual access models apply to our multimodal solution SOPHiA CarePath. For multimodal, including our integrated radiomics solution, we are currently offering a dry lab access model, in which we provide the algorithmic analytics solutions while leaving the data generation at the discretion of our customers. We have developed, and intend to continue to develop, smart algorithms for specific radiomics applications, such as deep learning-enabled algorithms that can automatically recognize a lung CT scan image, detect an advanced lung cancer tumor, segment the tumor and extract radiomics features for further analysis. In the future, we may also offer a bundle access model, in which we offer solutions linked to specific imaging contrasting agents or imaging procedure modalities to optimize the performance of the final signal analysis. We intend to apply the same conceptual access models to additional data modalities that we may support in our SOPHiA DDM Platform in the future, such as digital pathology, proteomics, spatial genomics and metabolomics. Benefits to Customers Our platform has the potential to offer the following benefits for customers, empowering them to adopt data-driven medicine to improve clinical and scientific outcomes: •Accuracy. Our platform design and data analytics capabilities provide high accuracy analytics for our customers, who have access to high quality, standardized data through our SOPHiA DDM Platform. •Turnaround time. We empower our customers to generate data themselves locally, which avoids delays associated with shipment, logistics and processing of samples through an external collaborator. We therefore significantly reduce the turnaround time, which is a critical factor in driving toward timely diagnosis and treatment of disease. •Cost-control through increased efficiency. Customers can compute, detect and annotate any type of genomic alterations through our SOPHiA DDM Platform without the need for specific orthogonal assays, thus reducing additional testing costs. •Maintenance and development of in-house expertise. By empowering our customers to retain ownership and access to their biological samples and data, we enable them to build in-house expertise while benefiting from world-class analytics accuracy through our SOPHiA DDM Platform’s network effects. •Accelerated launch of new precision medicine applications. The universal nature of our SOPHiA DDM Platform facilitates adding new applications to the same workflow once an institution adopts our platform. Our customers can avoid having to set up parallel and sometimes redundant workflows for different assays and technologies. 69 Table of Contents Markets We estimate that our clinical and biopharma applications targeted a $40 billion global total addressable market opportunity in 2025, approximately $9 billion of which was in the United States based on our addressable clinical market. These estimates are primarily based on epidemiological data, including incidence and prevalence estimates of addressable populations for each application, as well as a range of price assumptions for our applications and products taking into account differences in panel sizes. Further, these estimates do not depend on obtaining regulatory clearances or approvals to market our applications and products as in vitro diagnostics (“IVD”) and / or software as a medical device (“SaMD”) in the United States. Over time, we believe that our platform and insights enable market opportunity expansion through new application and product development. The following figure shows our estimated total addressable market in 2025. Our Total Addressable Market Clinical Market Opportunity We estimate our total addressable global clinical market opportunity for our current offerings was $25 billion in 2025, with the largest market opportunity being in oncology. Oncology. While the majority of commercial business today in the clinical market comprises diagnosis and advanced therapy selection, our capabilities enable us to serve the oncology testing market across the full patient journey. We can also support healthcare practitioners across tumor and sample types at any stage of the patient journey as long as genomic information or 3D medical imaging is applicable. Our clinical oncology market opportunity consists of five market segments: screening, early detection, diagnosis, therapy selection and monitoring. Rare diseases. In rare diseases, we believe the adoption of data-driven medicine is just beginning and represents a significant opportunity for growth. In the rare disease market, there has been growing preference among clinical institutions for larger genetic testing panels, including whole-exome and whole genome panels, to test for a more comprehensive array of rare diseases in contrast to the smaller, more targeted panels that are common in the market today. We believe we are well adapted to address this market opportunity with the exome solutions offered through our SOPHiA DDM Platform. In addition to our SOPHiA DDM Platform, our Alamut suite of genomics mutation interpretation software could be particularly impactful in deepening genomic investigations in rare diseases. Other disease areas and conditions. We believe that the aggregate market opportunity linked to other disease areas beyond oncology and rare diseases could ultimately be larger than our current opportunity in 70 Table of Contents oncology and rare diseases given their higher prevalence compared to cancer. Our SOPHiA DDM Platform has applications in areas such as cardiology, neurology and metabolism, through applications ranging from targeted gene panels to whole-exome solutions. While genomics applications are still emerging in these disease areas, we expect significant opportunity in the coming years as novel findings establish the genetic determinants of high-profile diseases such as inherited cardiovascular conditions, multiple sclerosis, Alzheimer’s disease, autism and metabolic syndrome. We provide applications in each of these disease areas today, and plan to further penetrate the testing landscape in these disease areas through genomics and other data modalities in the future. Other data modalities beyond genomics. We designed our platform architecture to be able to scale with new digital healthcare data modalities beyond genomics. We have already taken the next step in that direction by developing and deploying our proprietary radiomics analytics capabilities onto our SOPHiA DDM Platform. In radiomics, we offer analytics solutions for three-dimensional medical imaging technologies, including CT, MRI, SPECT and PET scanners, regardless of manufacturers. Additionally, we may expand applications to other imaging modalities such as two-dimensional modalities (e.g., ultrasound, traditional x-rays) as well as testing modalities that can be processed through imaging-based approaches (e.g., electrocardiograms). Beyond radiomics, we intend to support additional data modalities in the future, for example digital pathology, proteomics, spatial genomics and metabolomics. We believe that supporting additional data modalities in our SOPHiA DDM Platform, both as stand-alone modalities and in a multimodal approach, has the potential to open significant new market opportunities and increase our total addressable market in the future. Biopharma Opportunity Oncology and rare diseases. We estimate our total addressable biopharma opportunity for our current offerings was $15 billion in 2025 based on three market segments: Discovery, Development, and Deployment. We believe also that our strategic positioning as a healthcare data analytics platform will enable other business opportunities to become available in the future, in, for example, global public health solutions. Other Market Opportunities Accessible with our Business Model We believe that our strategic positioning as a healthcare data analytics platform has the potential to enable other business opportunities to become available in the future. Universal analytics platform for digital health data. Leveraging our global network and customer base, we may enter into collaboration agreements with third-party providers of solutions and services that can be deployed through our SOPHiA DDM Platform and to our customer network, thereby generating new indirect network effects. We believe that we could provide a single, unified analytical workflow through our SOPHiA DDM Platform for instruments generating many kinds of digital health data, such as digital pathology, proteomics, single-cell sequencing and other similar applications. Global public health solutions. Our SOPHiA DDM Platform could provide a fast and reliable ecosystem to gather data on a global scale and inform public health agencies on significant health-related events, such as pandemics. The COVID-19 pandemic has demonstrated the need for solutions able to harmonize and analyze vast data sets on a global scale, for example, to track the evolution of new variants of the SARS-CoV-2 virus over time and across geographies. This may apply to other infectious diseases, and to human host factors such as detecting specific susceptibility characteristics through genomics and other phenotypic information across populations. Value-based medicine. As data-driven medicine and multimodality diagnostic approaches are further adopted in the future, we may collaborate with healthcare stakeholders such as payors, providers and integrated healthcare systems to increase the overall affordability of healthcare. We may develop outcomes-based business models in which we enter into risk-sharing agreements with these stakeholders to support the optimal care management of specific patient populations with the goal of achieving better health and economic outcomes. Our Platform’s Advantages We believe our SOPHiA DDM Platform has several advantages over alternative genomics analytics platforms as well as other business models aimed at providing data-driven medicine. 71 Table of Contents Unique Value Proposition as a Genomics Analytics Platform Our SOPHiA DDM Platform enables highly sensitive and specific testing and rapid turnaround time, enabling customers to compute, detect and annotate genomic alterations with high confidence. Our platform and its many applications also allow customers to rapidly build and scale precision medicine operations with different applications. We believe that a crucial characteristic for customers and a key differentiator of our platform is accuracy, leading to quality of insight. The accuracy of our pattern-recognition, AI/ML-based algorithms enable our platform to separate the signal from the noise and standardize data at high-quality levels. Our smart algorithms have high accuracy across applications, from oncology to rare diseases and cardiology, and reduce testing costs by obviating the need for orthogonal assays. The accuracy of our algorithms is a result of the scale and diversity of data within our database. The following table shows how our SOPHiA DDM Platform performs on genomic variant detection from NGS data across a range of selected genomics applications versus the analytical performance of widely used orthogonal assays such as Sanger Sequencing, MLPA, array CGH and digital PCR. Our SOPHiA DDM Platform’s Analytical Performance in Selected Current Genomics Applications 1.Results of the CE-IVD study based on our Solid Tumor Solution (STS) that included data from 6 different sequencing centers and a total of 155 clinical and commercial FFPE samples in which 192 confirmed variants were used as the standard. 2.Results of the CE-IVD study based on our Hereditary Cancer Solution (HCS) that included data from 7 different sequencing centers and a total of 159 clinical and commercial samples in which 1,252 confirmed variants were used as the standard. 3.Results based on the clinical exome analysis of the Ashkenazim trio (mother, father and son’s DNA) from the Genome In a Bottle consortium that included data from 2 different sequencing centers and a total of 9 samples (including replicates) in which an average of 6,241.2 confirmed variants per sample were used as the standard. 4.Results based on two similar studies that included data from 2 different sequencing centers and a total of 113 clinical and commercial samples in which 833 confirmed variants were used as the standard. Sensitivity measures how often a test correctly generates a positive result for samples in which a certain genomic variant is present (“true positive” rate). Specificity measures how often a test correctly generates a negative result for samples in which a certain genomic variant is not present (“true negative” rate). Accuracy measures the proportion of tested samples that are correctly classified (“true positives” plus “true negatives”). Precision measures the ability for repeated analyses on the same samples to give similar results. Broad and Growing Multimodal Application Offering The breadth of our applications and multimodal capabilities enables our customers to deploy and scale their data-driven medicine operations rapidly and to incorporate additional clinically relevant data sets over time. We believe our platform is uniquely positioned to combine high-quality data at the patient level to generate multimodal insights, leveraging the power of advanced AI/ML models. We have developed proprietary capabilities in AI/ML-enabled exploration of multimodal signatures. Through these, we can unlock the synergistic power of next-generation healthcare data to advance predictive capabilities. We believe that over time, multimodal data will provide a superior means to diagnose and treat disease relative to the current approach focusing on just a single modality. 72 Table of Contents Software-based Platform Facilitates Rapid Global Scaling and Data Collection We designed our cloud-native software platform to be capable of scaling globally and to use AI to leverage the data that this scale provides. As of December 31, 2025, we served more than 993 hospital, laboratory and biopharma customers globally through our SOPHiA DDM Platform and related solutions, applications, products, and services. We believe that this global footprint is unique and enables us to capture a wide variety of real-world clinical data around the world. The following figure shows our customer base by region as of December 31, 2025. Our Customer Base by Region We have been expanding our customer base as well as the volume of data that we analyze. From December 31, 2016 to December 31, 2025, our number of active customers grew from 182 to more than 993. During the same period, the aggregate number of genomic profiles analyzed using our SOPHiA DDM Platform grew from approximately 80,000 profiles to approximately 2,300,000 profiles, recently growing by approximately 33,000 new profiles on a monthly basis. We regularly release platform updates, currently at a pace of once every three weeks. Through these updates, we offer our customers either new content, in the form of new applications or improvements to existing applications, such as new functionalities. We believe this update frequency is a competitive advantage in a rapidly evolving precision medicine ecosystem and allows our customers to benefit from new biological discoveries, such as genomic associations, that are reflected on the platform. Ability to Work with All Stakeholders in the Healthcare Ecosystem We are empowering our customers through a decentralized model and are able to support clinicians, laboratories and researchers across the healthcare ecosystem. This enables us to benefit from growth across the industry and provide the benefits of our network to different stakeholders. We are also able to collaborate with other product providers in the ecosystem to bundle our solutions to provide differentiated end-to-end solutions. For example, we collaborate with testing kit companies, testing hardware providers, software analytics companies, and diagnostic companies operating with a centralized model. We collaborate with companies including Twist, IDT and Agilent to create an integrated solution using our analytics platform and their library preparation products, including DNA enrichment kits, and with hardware and lab automation providers such as Hamilton and PerkinElmer. We believe that we can support and collaborate with any industry 73 Table of Contents player for their data analytics needs and are therefore not dependent on any specific business model or industry segment. We believe that this unique ecosystem positioning strategy, coupled with our industry-leading analytics capabilities and our global footprint, position us as a global leading healthcare data analytics company. The following figure shows our unique position in the healthcare ecosystem. SOPHiA GENETICS’ Unique Position as an “Operating System” Real-time Visibility into the Healthcare Ecosystem Provides Product and Application Expansion Opportunities Our strategic positioning as a universal healthcare data analytics platform gives us real-time visibility into data and events in the healthcare ecosystem, including diagnosis, clinical data, customer behavior, performance of third-party technology solutions and other data important to stakeholders. We believe that we are well positioned to provide value to stakeholders across the healthcare ecosystem and to benefit from product and application expansion opportunities. High Visibility and Predictability into Our Business Once onboarded onto our SOPHiA DDM Platform, our customers tend to steadily increase their use of our SOPHiA DDM Platform, which offers a level of predictability that helps us project and manage our growth. In addition, customers rarely leave our SOPHiA DDM Platform given that we are generally integrated into their processes. These observed trends hold particularly well for our dry lab and bundle access model customers. We have a revenue churn rate, which we define as the annualized revenues we estimate to have lost from customers who access our platform through our dry lab access and bundle access models and have not generated revenue over the past 12 months in that period based on their average quarterly revenue contributions from point of onboarding as a percentage of total recurring platform revenue, of 0.1% across our customer base over the year ending December 31, 2025. Furthermore, our customers generally increase their use and adopt new applications of our SOPHiA DDM Platform as our relationship with them grows. Our Growth Strategy Our mission is to empower clinicians and researchers around the world to practice data-driven medicine and improve clinical and scientific outcomes. Our growth strategy is to: •Drive innovation and advancement of our SOPHiA DDM Platform to increase its capabilities and broaden its applications. We plan to continue to invest in scientific innovation to bring new, high-impact content to our customers through regular updates to our platform. This may include new features, new applications, new data modalities and new services. Furthermore, we intend to augment our offering across a multimodality framework, generating novel insights enabled by our expanding data assets, including genomics data, radiomics analysis of medical imaging, clinical data and future additional data modalities such as digital pathology, proteomics, spatial genomics and metabolomics. •Drive new customer adoption with clinical customers worldwide. We intend to continue to raise awareness of the benefits of data-driven medicine and drive adoption of our platform around the world through our direct sales force, our distributors and our collaborator network. We plan to further penetrate the U.S. market, which we see as our largest opportunity, by significantly investing in our direct sales force to further scale the size of our network, both in 74 Table of Contents terms of the number and types of customers. In addition, we also plan to focus on commercializing our solutions by forming additional collaborations with reference and specialty laboratories. Outside the United States, we believe there is significant growth opportunity across EMEA and Latin America markets, as well as untapped potential in APAC, including in China, India, Korea and Japan. In selected geographies outside the United States, we intend to utilize a hybrid commercial model including direct sales force or direct collaborations and distributors. •Increase utilization within our clinical customer base. We employ a “land and expand” commercial model that is focused on winning new customers and then driving utilization of our solution by those customers. Once we secure a customer, we use our direct sales force to build further engagement and help that customer profitably increase its testing operations. For example, we may initially support a customer in setting up its NGS testing operations for hereditary cancer screening, including operational support through our set-up programs. Once the customer is fully onboarded onto our SOPHiA DDM Platform, it is then comparatively easier to deploy additional germline testing solutions as well as somatic oncology testing solutions, creating synergies across the offerings and a unified workflow. We also target incremental users within each institution, for example, additional clinicians within a provider across expanded departments such as radiology or pathology. •Leverage our platform and database to drive adoption by biopharmaceutical companies. We have a distinct sales force focused on biopharma opportunities across the discovery, clinical development and commercialization value chain. We continue to promote our current applications, products, and services, which we believe will strengthen existing collaborations with biopharmaceutical companies as well as lead to new relationships. For example, we may collaborate with a biopharmaceutical company to generate insights on the real-world molecular epidemiology of specific genomic variants relevant for an investigational targeted therapy, including insights on testing trends across our network of customers. This may lead to additional collaborations on a multimodal program to investigate new biomarkers of response to the investigational therapy, a tailored companion diagnostic program, clinical trial recruitment efforts, and market-shaping activities on biomarker testing to support the asset go-to-market strategy. Additionally, we plan to develop new offerings for biopharma as we expand the number and type of new applications and data modalities on our platform. Our biopharma strategy is also highly synergistic to our virtuous cycle. •Establish and grow industry collaborations across the healthcare ecosystem. We intend to establish new industry collaborations with other companies providing applications, products, and services to our customers. We intend to collaborate with a diverse array of industry participants, including instruments, reagent and software companies in genomics and in other fields such as digital pathology and proteomics. We intend to collaborate with service providers such as centralized laboratory players and interpretation services providers to expand the breadth of our capabilities. We believe that each new collaboration we develop helps facilitate further adoption of our platform, the evolution of the solution we provide to customers and the growth of our network and application and product capabilities. A larger network enables us to continue to collaborate with customers to develop new solutions and to commercialize these solutions, benefiting all users across the healthcare ecosystem. Commercial We sell our SOPHiA DDM Platform and related solutions, applications, products, and services to healthcare providers, centralized laboratories and biopharmaceutical companies through our own sales force as well as through distributors and industry collaborators. As of December 31, 2025, our direct sales team consisted of approximately 105 field-based commercial representatives, including sales and business development managers, key account managers and biopharma alliance managers who are engaged in sales efforts and promotional activities towards our customers. We also employ subject matter experts, clinical genomic experts and biopharma operations specialists who provide customer-facing technical and scientific support. As of December 31, 2025, we had a sales presence in 75 countries, including a direct sales presence in 60 countries and 50 countries in which we offer our SOPHiA DDM Platform and related solutions, applications, products, and 75 Table of Contents services through distributors. The following figure shows our global commercial footprint as of December 31, 2025. SOPHiA GENETICS’ Global Footprint – Countries and Sales Force Our initial focus has been on winning clinical customers in order to drive data capture and building our reputation for accuracy and quality in the clinical community. We estimate that there are more than 10,000 laboratories globally that are using NGS instrumentation. We believe that there is significant opportunity to expand our customer base as well as grow utilization of our SOPHiA DDM Platform by our existing customers. Our sales strategy is focused on both attracting new customers to our platform and driving their utilization and adoption of our applications. Once we win a new customer, our direct sales team provides set-up programs to accelerate the adoption of our SOPHiA DDM Platform and facilitates our customers to adopt our platform into their routines. [In 2024, we refocused resources from our more established and penetrated markets in EMEA to higher-growth and under-penetrated regions in NORAM and APAC, as well as specific markets in EMEA, such as the U.K., Germany, and the Middle East, and implemented a more strategic approach towards winning and managing key, high-volume accounts in the clinical market. We started commercializing our biopharma services in 2019. [In 2024, we refocused our sales efforts to target smaller, more repeatable business that we can execute in high volume to expedite our sales cycle. Suppliers and Manufacturers Our platform is a cloud-native software platform. To deploy our platform, we rely on cloud-based service providers. We also collaborate with consumables and hardware suppliers for the bundle access model and with platform customers for the integrated access model. Platform Suppliers. Our platform production environment currently runs on Microsoft Azure. As our platform architecture is vendor-agnostic, we could readily deploy our solutions onto any cloud infrastructure, as well as on-premise if necessary. We have ongoing research and development projects on all major cloud solution providers, including Microsoft Azure, Amazon Web Services and Google Cloud Platform. This allows us a strong degree of flexibility and helps manage vendor risks. Consumables and Hardware Suppliers. In the bundle access model, we work with Integrated DNA Technologies (“IDT”), Qiagen, New England Biolabs (“NEB”), Watchmaker Genomics, Inc. and others for consumables and hardware equipment. Platform Customers. In the integrated access model, we route a customer’s samples to selected SOPHiA DDM Platform collaborators who conduct the sequencing process for the customer and upload the resulting 76 Table of Contents data into our SOPHiA DDM Platform. As of December 31, 2025, we collaborated with seven laboratories across seven countries to provide this service. We continually assess our dependence on our suppliers and manufacturers and evaluate alternative solutions. We have built our business such that we do not rely on any single supplier or manufacturer, such that we are able to switch suppliers and manufacturers as necessary. We believe that this mitigates risks to our business and provides us the opportunity to drive down costs. Competition We operate in a market characterized by rapidly advancing technologies and a strong emphasis on intellectual property. Our main competitors are institutions that collect multimodal data that have developed in-house analytics solutions, such as Tempus Labs, F. Hoffmann-La Roche and Caris Life Sciences, but we believe these competitors also represent our potential customers. In addition, other companies such as Siemens, Koninklijke Philips and Konika Minolta are also positioning themselves in the market with data analytics platform capabilities to build a multimodal world. We also face competition from companies that have developed software analytics platforms for genomics data, such as Agilent, Fabric Genomics, Illumina, Qiagen Digital Insights, Velsera Inc., Congenica Ltd and Thermo Fisher. We believe that our proprietary technology and the agility and the scalability of our platform distinguishes us from other players. We believe that our position as a “universal operating system” enables us to empower and sell to many different players in the ecosystem, including competitors. See “Item 3. Key Information—D. Risk Factors—Risks Related to Our Business and Industry—We face competition from many sources and we may be unable to compete successfully.” Intellectual Property Intellectual property is of vital importance in the biotechnology field. Our success depends in part on our ability to obtain and maintain intellectual property and proprietary protection for our technology, defend and enforce our intellectual property rights, preserve the confidentiality of our trade secrets, and operate without infringing, misappropriating or otherwise violating valid and enforceable intellectual property and proprietary rights of others. We are actively involved in research and development and therefore seek to protect the investments made into the development of our technology by relying on a combination of patents, trademarks, copyrights, trade secrets, including know-how, and license agreements. We also seek to protect our proprietary technology, in part, by requiring our employees, consultants, contractors and other third parties to execute confidentiality agreements and invention assignment agreements and by implementing technological measures and other methods. Our ability to stop third parties from making, using, selling, offering to sell or importing our platform, applications, services, and products depends on the extent to which we have rights under valid and enforceable patents, trade secrets or other intellectual property and proprietary rights that cover these activities. We pursue intellectual property protection to the extent we believe it would advance our business objectives. Notwithstanding these efforts, there can be no assurance that we will adequately protect our intellectual property or provide any competitive advantage. For more information regarding risks relating to intellectual property, see “Item 3. Key Information—D. Risk Factors—Risks Related to Intellectual Property.” Patents Our intellectual property strategy is focused on protecting our ongoing research and development through patents and other intellectual property rights. As of December 31, 2025, we solely owned 10 issued U.S. patents, 21 pending U.S. patent applications, 67 issued patents in foreign jurisdictions and approximately 42 pending patent applications in foreign jurisdictions, including Europe, Canada, Australia, Brazil, China, and India, wherein 4 are pending Patent Cooperation Treaty applications relating to laboratory methods and/or software to provide molecular diagnosis in germline diseases. These include filings for 29 families of utility patents and 22 families of design patents relating to graphical user interfaces. Such issued utility patents and any patents derived from such applications or applications that claim priority from such applications, if granted, would be expected to expire between (2036 and 2045), excluding any additional term for patent term adjustments. 77 Table of Contents As of December 31, 2025, our most material patents and patent applications consisted of (i) one issued patent in Israel, one issued patent in Australia, one issued patent in Brazil, one issued patent in Europe, one issued patent in India, three pending U.S. patent applications and two pending foreign patent applications in Canada and China relating to our algorithm for next generation sequencing data which is used in our SOPHiA DDM Platform, (ii) one issued European Patent, one issued U.S. patent, and one pending U.S. patent application relating to a method for processing certain genomic data which is used in our SOPHiA DDM Platform, (iii) one issued European Patent, one issued U.S. patent, and one pending U.S. patent application for a method to improve the accuracy of the estimated length of homopolymer and heteropolymer regions, which is used in our SOPHiA DDM Platform, (iv) three pending U.S. patent applications, one issued European patent, and five pending foreign patent applications in Australia, Brazil, Canada, Japan, and South Korea relating to a unique molecular identifier and related analytics workflow which is incorporated in our software applications and products and into our SOPHiA DDM Platform, (v) one issued European patent, one issued U.S. patent, and one U.S. pending patent application for a method to detect microsatellite instability that is used in our SOPHiA DDM Platform, (vi) two pending European patent applications, three U.S. pending patent application, and seven pending foreign patent applications in Hong Kong, Australia, Brazil, Canada, China, Japan, and South Korea relating to a method to detect homologous recombination deficiency (“HRD”), which is used in our SOPHiA DDM Platform and SOPHiA DDM HRD solution, (vii) one pending European patent application and one pending U.S. patent application relating to a Limit of Detection aware variant calling method which is not currently used in our software applications and products, (viii) one issued European patent, one issued U.S. patent, one pending European patent application and one pending U.S. patent application and five pending foreign patent applications in Australia, Brazil, Canada, Japan, and South Korea relating to a unique molecular identifier and related analytics workflow which is incorporated in our probes for detecting gene fusion events in our SOPHiA DDM Platform RNAtarget Technology. Any patents derived from such applications or applications that claim priority from such applications, if granted, would be expected to expire between 2036 and 2045, excluding any additional term for patent term adjustments. The term of individual patents depends upon the legal term of the patents in the countries in which they are obtained. In most countries in which we file or intend to file, including the United States, the patent term is 20 years from the earliest date of filing a non-provisional patent application. In the United States, a patent’s term may be lengthened by patent term adjustment, which compensates a patentee for administrative delays by the USPTO in examining and granting a patent, or may be shortened if a patent is terminally disclaimed over an earlier filed patent. We cannot be sure that patents will be granted with respect to any current pending patent application or with respect to any patent applications filed by us in the future, and we cannot be sure that any current or future patents will be commercially useful in protecting our platform, applications, products, services, technologies and processes. In addition, any patents that we may hold, whether owned or licensed, may be challenged, circumvented or invalidated by third parties. Trademarks The success of our business strategy depends on our continued ability to use our existing intellectual property in order to increase brand awareness and develop our branded services. As of December 31, 2025, we owned 13 registered U.S. trademarks, 1 pending U.S. trademarks, approximately 138 registered foreign trademarks and 3 pending foreign trademark applications. Our trademark portfolio is designed to protect the brands of our current and future applications and products and includes U.S. trademark registrations for our company name, “SOPHIA GENETICS”, and application and product names, such as “SOPHIA DDM” and “ALAMUT”. We have granted licenses to certain of our trademarks to our domestic and international collaborators. Trade Secrets We also rely on trade secrets, including know-how, unpatented technology and other proprietary information, to strengthen our competitive position. We have determined that certain technologies that are not amenable to, or that we do not presently consider appropriate for, patent protection, such as our analysis techniques and analysis generated using our proprietary algorithms in the context of our SOPHiA DDM Platform, are better kept as trade secrets in order to protect and maintain our competitive position and aspects of our business and prevent competitors from reverse-engineering or copying our technologies. We seek to protect trade secrets and confidential and unpatented know-how, in part, by entering into non-disclosure and confidentiality agreements with parties who have access to such knowledge, such as our 78 Table of Contents employees, corporate collaborators, outside scientific collaborators, CROs, or manufacturers, consultants, advisors and other third parties. We also seek to enter into confidentiality and invention or patent assignment agreements with our employees and consultants that obligate them to maintain confidentiality and assign their inventions to us. We cannot guarantee that we have entered into such agreements with each party that may have or have had access to our trade secrets or proprietary technology and processes or that the assignment agreements that have been entered into are self-executing. Despite these efforts, any of these parties may breach the agreements and disclose our proprietary information, including our trade secrets, or claim ownership in intellectual property that we believe is owned by us. In addition, we take other appropriate precautions, such as physical and technological security measures, to guard against misappropriation of our proprietary information by third parties. Government Regulation Laboratory Developed Tests CLIA and State Laboratory Licensing CLIA is a U.S. federal law that regulates clinical laboratories that perform testing on specimens derived from humans for the purpose of providing information for the diagnosis, prevention, or treatment of disease, or impairment of, or the assessment of the health of, human beings. CLIA regulations require, among other things, clinical laboratories to obtain a certificate and mandate specific standards in the areas of personnel qualifications, administration, participation in proficiency testing, test management, and quality assurance. CLIA certification is also required for us to be eligible to bill state and federal healthcare programs, if such reimbursement is otherwise available, as well as many private third-party payors, for our applications and products. In addition to federal certification requirements of laboratories under CLIA, CLIA provides that states may adopt laboratory regulations and licensure requirements that are more stringent than those under federal law. A number of states have implemented their own more stringent laboratory regulatory requirements. Such laws, among other things, establish standards for the day-to-day operation of a clinical laboratory, including the training and skills required of personnel and quality control. For example, New York state laws and regulations establish standards for day-to-day operation of a clinical laboratory, including training and skill levels. We do not currently operate a CLIA-certified laboratory. Our customers are responsible for obtaining and maintaining their own CLIA certification. Federal Oversight of Laboratory Developed Tests The laws and regulations governing the marketing of clinical laboratory testing and diagnostic products are evolving and extremely complex and, in many instances, there are no significant regulatory or judicial interpretations of these laws and regulations. Clinical laboratory tests are regulated under CLIA, as administered by CMS, as well as by applicable state laws. In addition, the FDCA defines a medical device to include any instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article, including a component part, or accessory, intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in man or other animals. Among other things, pursuant to the FDCA and its implementing regulations, the FDA regulates the research, testing, manufacturing, safety, labeling, storage, recordkeeping, pre-market clearance or approval, marketing and promotion, and sales and distribution of medical devices in the United States to ensure that medical products distributed domestically are safe and effective for their intended uses. In addition, the FDA regulates the export of medical devices manufactured in the United States to international markets. Although the FDA has statutory authority to assure that medical devices are safe and effective for their intended uses, the FDA has generally exercised enforcement discretion and not enforced applicable regulations with respect to in vitro diagnostics that are designed, manufactured and used within a single laboratory for use only in that laboratory. These tests are referred to as LDTs. 79 Table of Contents AI/ML-Based Medical Software The FDA recognizes that the traditional paradigm of medical device regulation was not designed for adaptive AI/ML technologies. The FDA has cleared or approved several AI/ML-based software as medical devices (“SaMD”). Typically, these have only included algorithms that are “locked” prior to marketing, where algorithm changes likely require FDA premarket review for changes beyond the original market authorization. However, not all AI/ML-based SaMD are locked; some algorithms can adapt over time. Following distribution, these types of continuously learning and adaptive AI/ML algorithms may provide a different output in comparison to the output initially cleared for a given set of inputs. The FDA’s Center for Devices and Radiological Health is building a total product lifecycle-based regulatory framework for AI/ML technologies. On January 12, 2021, the FDA released its Artificial Intelligence/Machine Learning-Based Software as a Medical Device Action Plan, which outlines five actions that the FDA intends to take, including: •further developing the proposed regulatory framework, including through issuance of draft guidance on a predetermined change control plan (for software’s learning over time); •supporting the development of good machine learning practices to evaluate and improve machine learning algorithms; •fostering a patient-centered approach, including device transparency to users; •developing methods to evaluate and improve machine learning algorithms; and •advancing real-world performance monitoring pilots. In April 2023, the FDA further advanced its regulatory efforts by publishing detailed recommendations for Marketing Submissions that incorporate Predetermined Change Control Plans (“PCCPs”), emphasizing a structured approach to managing post-market modifications for AI/ML-based medical devices. It requires manufacturers to outline anticipated AI/ML modifications in their initial marketing submission, detailing a structured approach for implementing and validating these updates. The impact of the modifications should be assessed in advance to ensure they maintain safety and performance. It also highlights the need for transparency and traceability, requiring clear documentation of AI/ML updates. Risk mitigation strategies must be in place to address potential issues like model drift or performance degradation. The recommendations have been drafted to ensure continuous compliance of AI-driven medical devices. U.S. Medical Device Regulatory Framework Pursuant to its authority under the FDCA, the FDA has jurisdiction over medical devices, which are defined to include, among other things, IVDs and SaMD. The FDA regulates the research, design, development, preclinical and clinical testing, manufacturing, safety, effectiveness, packaging, labeling, storage, recordkeeping, pre-market clearance or approval, adverse event reporting, marketing, promotion, sales, distribution and import and export of medical devices. Device Classification Under the FDCA, medical devices are classified into one of three classes (Class I, Class II, or Class III) depending on the degree of risk associated with each medical device and the extent of control needed to provide reasonable assurances with respect to safety and effectiveness. Class I includes devices with the lowest risk to the patient and are those for which safety and effectiveness can be reasonably assured by adherence to General Controls for Medical Devices, which require compliance with the applicable portions of the FDA’s Quality Management System Regulation, facility registration and product listing, reporting of adverse events and malfunctions, and appropriate, truthful and non-misleading labeling and promotional materials. While some Class I devices also require premarket clearance by the FDA through the 510(k) premarket notification process described below, most Class I products are exempt from the premarket notification requirements. 80 Table of Contents Class II devices are those that are subject to the General Controls, as well as Special Controls as deemed necessary by the FDA to ensure the safety and effectiveness of the device. These Special Controls can include performance standards, patient registries, FDA guidance documents and post-market surveillance. Most Class II devices are subject to premarket review and clearance by the FDA. Premarket review and clearance by the FDA for Class II devices is accomplished through the 510(k) premarket notification process. Class III devices include devices deemed by the FDA to pose the greatest risk, such as life-supporting, life-sustaining devices or implantable devices, in addition to those deemed novel and not substantially equivalent following the 510(k) process. The safety and effectiveness of Class III devices cannot be reasonably assured solely by the General Controls and Special Controls described above. Therefore, these devices are subject to the PMA process, which is generally more costly and time-consuming than the 510(k) process. Through the PMA process, the applicant must submit data and information demonstrating reasonable assurance of the safety and effectiveness of the device for its intended use to the FDA’s satisfaction. Accordingly, a PMA typically includes, but is not limited to, extensive technical information regarding device design and development, preclinical and clinical trial data, manufacturing information and labeling and financial disclosure information for the clinical investigators in device studies. The PMA application must provide valid scientific evidence that demonstrates to the FDA’s satisfaction a reasonable assurance of the safety and effectiveness of the device for its intended use. The 510(k) Clearance Process Under the 510(k) clearance process, the manufacturer must submit to the FDA a premarket notification, demonstrating that the device is “substantially equivalent” to a legally marketed predicate device. A predicate device is a legally marketed device that is not subject to a PMA, i.e., a device that was legally marketed prior to May 28, 1976 (pre-amendments device) and for which a PMA is not required, a device that has been reclassified from Class III to Class II or I, or a device that was previously found substantially equivalent through the 510(k) process. To be “substantially equivalent,” the proposed device must have the same intended use as the predicate device, and either have the same technological characteristics as the predicate device or have different technological characteristics and not raise different questions of safety or effectiveness than the predicate device. Clinical data is sometimes required to support substantial equivalence. After a 510(k) premarket notification is submitted, the FDA determines whether to accept it for substantive review. If it lacks necessary information for substantive review, the FDA will refuse to accept the 510(k) premarket notification. If it is accepted for filing, the FDA begins a substantive review. By statute, the FDA is required to complete its review of a 510(k) notification within 90 days of receiving the 510(k) notification. As a practical matter, clearance often takes longer, and clearance is never assured. Although many 510(k) premarket notifications are cleared without clinical data, the FDA may require further information, including data from samples collected in a clinical setting, to make a determination regarding substantial equivalence which may significantly prolong the review process. If the FDA agrees that the device is substantially equivalent, it will grant clearance to commercially market the device. If the FDA determines that the device is not “substantially equivalent” to a predicate device, or if the device is automatically classified into Class III, the device sponsor must then fulfill the much more rigorous premarketing requirements of the PMA approval process or seek reclassification of the device through the De Novo classification process. After a device receives 510(k) clearance, any modification that could significantly affect its safety or effectiveness, or that would constitute a new or major change in its intended use, under current regulations, will require a new 510(k) clearance or, depending on the modification, could require a PMA application. The FDA requires each manufacturer to determine whether the proposed change requires a new submission in the first instance, but the FDA can review any such decision and disagree with a manufacturer’s determination. Many minor modifications are accomplished by an internal letter-to-file in which the manufacture documents its reasoning for why a change does not require premarket submission to the FDA. The letter-to-file is in lieu of submitting a new 510(k) to obtain clearance for such change. The FDA can always review these letters-to-file in an inspection. If the FDA disagrees with a manufacturer’s determination regarding whether a new premarket submission is required for the modification of an existing 510(k)-cleared device, the FDA can require the manufacturer to cease marketing and/or recall the modified device until 510(k) clearance or approval of a PMA application is obtained. In addition, in these circumstances, the FDA can impose significant regulatory fines or penalties for failure to submit the requisite application(s). 81 Table of Contents The De Novo Process The De Novo classification process is an alternate pathway to classify medical devices that are automatically classified into Class II where no predicate currently exists. While rare, Class I devices can also fall under the De Novo classification process when an existing classification does not exist. A manufacturer can submit a petition for direct De Novo review if the manufacturer is unable to identify an appropriate predicate device and the new device or new use of the device presents a moderate or low risk. De Novo classification may also be available after receipt of a “not substantially equivalent” letter following submission of a 510(k) to the FDA. The PMA Approval Process Following receipt of a PMA application, the FDA conducts an administrative review to determine whether the application is sufficiently complete to permit a substantive review. If it is not, the agency will refuse to file the PMA. If it is, the FDA will accept the application for filing and begin the review. The FDA has 180 days to review a filed PMA application, although the review of an application more often occurs over a significantly longer period of time. During this review period, the FDA may request additional information or clarification of information already provided, and the FDA may issue a major deficiency letter to the applicant, requesting the applicant’s response to deficiencies communicated by the FDA. Before approving or denying a PMA, an FDA advisory committee may review the PMA at a public meeting and provide the FDA with the committee’s recommendation on whether the FDA should approve the submission, approve it with specific conditions, or not approve it. The FDA is not bound by the recommendations of an advisory committee, but it considers such recommendations carefully when making decisions. Prior to approval of a PMA, the FDA may conduct inspections of the clinical trial data and clinical trial sites, as well as inspections of the manufacturing facility and processes. Overall, the FDA review of a PMA application generally takes between one and three years, but may take significantly longer. The FDA can delay, limit or deny approval of a PMA application for many reasons, including: •The device may not be shown safe or effective to the FDA’s satisfaction; •The data from pre-clinical studies and/or clinical trials may be found unreliable or insufficient to support approval; •The manufacturing process or facilities may not meet applicable requirements; and •Changes in FDA clearance or approval policies or adoption of new regulations may require additional data. If the FDA evaluation of a PMA is favorable, the FDA will issue either an approval letter or an approvable letter, the latter of which usually contains a number of conditions that must be met in order to secure final approval of the PMA. When and if those conditions have been fulfilled to the satisfaction of the FDA, the agency will issue a PMA approval letter authorizing commercial marketing of the device, subject to the conditions of approval and the limitations established in the approval letter. If the FDA’s evaluation of a PMA application or manufacturing facilities is not favorable, the FDA will deny approval of the PMA or issue a not-approvable letter. The FDA also may determine that additional tests or clinical trials are necessary, in which case the PMA approval may be delayed for several months or years while the trials are conducted and data is submitted in an amendment to the PMA, or the PMA is withdrawn and resubmitted when the data are available. The PMA process can be expensive, uncertain and lengthy, and a number of devices for which FDA approval has been sought by other companies have never been approved by the FDA for marketing. New PMA applications or PMA supplements are required for modification to the manufacturing process, equipment or facility, quality control procedures, sterilization, packaging, expiration date, labeling, device specifications, ingredients, materials or design of a device that has been approved through the PMA process. PMA supplements often require submission of the same type of information as an initial PMA application, except that the supplement is limited to information needed to support any changes from the device covered by the approved PMA application and may or may not require as extensive technical or clinical data or the convening of an advisory panel, depending on the nature of the proposed change. 82 Table of Contents In approving a PMA application, as a condition of approval, the FDA may also require some form of post-approval study or post-market surveillance, whereby the applicant conducts a follow-up study or follows certain patient groups for a number of years and makes periodic reports to the FDA on the clinical status of those patients when necessary to protect the public health or to provide additional or longer-term safety and effectiveness data for the device. The FDA may also approve a PMA application with other post-approval conditions intended to ensure the safety and effectiveness of the device, such as, among other things, restrictions on labeling, promotion, sale, distribution and use. New PMA applications or PMA supplements may also be required for modifications to any approved diagnostic tests, including modifications to manufacturing processes, device labeling and device design, based on the findings of post-approval studies. Clinical Trials In the United States, absent certain limited exceptions, human clinical trials intended to support medical device clearance or approval require an investigational device exemption (“IDE”) application. Some types of studies deemed to present “non-significant risk” are deemed to have an approved IDE–without affirmative submission of an IDE application to the FDA–once certain requirements are addressed and IRB approval is obtained. If the device presents a “significant risk” to human health, as defined by the FDA, the sponsor must submit an IDE application to the FDA and obtain IDE approval prior to commencing the human clinical trials. The IDE application must be supported by appropriate data, such as animal and laboratory testing results, showing that it is safe to test the device in humans and that the testing protocol is scientifically sound. Generally, clinical trials for a significant risk device may begin once the IDE application is approved by the FDA and the study protocol and informed consent are approved by appropriate IRBs at the clinical trial sites. Submission of an IDE will not necessarily result in the ability to commence clinical trials, and although the FDA’s approval of an IDE allows clinical testing to go forward for a specified number of subjects, it does not bind the FDA to accept the results of the trial as sufficient to prove the product’s safety and efficacy, even if the trial meets its intended success criteria. Such clinical trials must be conducted in accordance with the FDA’s IDE regulations that govern investigational device labeling, prohibit promotion and specify an array of recordkeeping, reporting and monitoring responsibilities of study sponsors and study investigators. Clinical trials must further comply with good clinical practice regulations for IRB approval and for informed consent and other human subject protections. Required records and reports are subject to inspection by the FDA for any clinical trials subject to FDA oversight. The results of clinical testing may be unfavorable, or, even if the intended safety and efficacy success criteria are achieved, may not be considered sufficient for the FDA to grant marketing approval or clearance of a product. The commencement or completion of any clinical trial may be delayed or halted, or be inadequate to support approval of a PMA application or clearance of a 510(k) premarket notification, for numerous reasons. The Breakthrough Devices Program is a voluntary program intended to expedite the development, assessment and review of certain medical devices that provide for more effective treatment or diagnosis of life-threatening or irreversibly debilitating human diseases or conditions for which no approved or cleared treatment exists or that offer significant advantages over existing approved or cleared alternatives. All submissions for devices designated as Breakthrough Devices will receive priority review, meaning that the review of the submission is placed at the top of the appropriate review queue and receives additional review resources, as needed. Although Breakthrough Device designation or access to any other expedited program may expedite the development or approval process, it does not change the standards for approval. Access to an expedited program may also be withdrawn by the FDA if it believes that the designation is no longer supported by data from our clinical development program. Additionally, qualification for any expedited review procedure does not ensure that we will ultimately obtain regulatory clearance or approval for such product. Research Use Only In the United States, SOPHiA applications and products labeled and sold for research use only, and not for the diagnosis or treatment of disease, are sold to a variety of parties, including biopharmaceutical companies, academic institutions and molecular laboratories. Because such applications and products are not intended for use in clinical practice in diagnostics, and the applications and products cannot include clinical or diagnostic claims, they are exempt from many regulatory requirements otherwise applicable to medical devices. In particular, while the FDA regulations require that RUO applications and products be labeled “For Research Use Only. Not for use in diagnostic procedures,” the regulations do not otherwise subject such applications and products to the FDA’s pre- and post-market controls for medical devices. 83 Table of Contents A significant change in the laws governing RUO products or how they are enforced may require a change to our business model in order to maintain compliance. For instance, in November 2013 the FDA issued the RUO Guidance, which highlights the FDA’s interpretation that distribution of RUO products with any labeling, advertising or promotion that suggests that clinical laboratories can validate the test through their own procedures and subsequently offer it for clinical diagnostic use as a laboratory, developed test is in conflict with RUO status. The RUO Guidance further articulates the FDA’s position that any assistance offered in performing clinical validation or verification, or similar specialized technical support, to clinical laboratories conflicts with RUO status. If we engage in any activities that the FDA deems to be in conflict with the RUO status held by the applications and products that we sell, we may be subject to immediate, severe and broad FDA enforcement action that would adversely affect our ability to continue operations. Accordingly, if the FDA finds that we are distributing our RUO applications and products in a manner that is inconsistent with its regulations or guidance, we may be forced to stop distribution of our RUO tests until we are in compliance, which would reduce our revenues, increase our costs and adversely affect our business, prospects, results of operations and financial condition. If the FDA requires marketing authorization of our RUO applications and products in the future, there can be no assurance that the FDA will ultimately grant any clearance or approval requested by us in a timely manner, or at all. Post-Market Regulation After a device is cleared or approved for marketing, numerous and pervasive regulatory requirements continue to apply. These include: •establishment registration and device listing with the FDA; •QSR requirements, which require manufacturers, including third-party manufacturers, to follow stringent design, testing, control, documentation and other quality assurance procedures during all aspects of the design and manufacturing process; •labeling regulations and FDA prohibitions against the promotion of investigational products or the promotion of “off-label” uses of cleared or approved products; •requirements related to promotional activities; •clearance or approval of product modifications to 510(k)-cleared devices that could significantly affect safety or effectiveness or that would constitute a major change in intended use of one of our cleared devices, or approval of certain modifications to PMA-approved devices; •medical device reporting regulations, which require that a manufacturer report to the FDA if a device it markets may have caused or contributed to a death or serious injury, or has malfunctioned and the device or a similar device that it markets would be likely to cause or contribute to a death or serious injury if the malfunction were to recur; •correction, removal and recall reporting regulations, which require that manufacturers report to the FDA field corrections and product recalls or removals if undertaken to reduce a risk to health posed by the device or to remedy a violation of the FDCA that may present a risk to health; •the FDA’s recall authority, whereby the agency can order device manufacturers to recall from the market a product that is in violation of governing laws and regulations; and •post-market surveillance activities and regulations, which apply when deemed by the FDA to be necessary to protect the public health or to provide additional safety and effectiveness data for the device. Device manufacturing processes are required to comply with the applicable portions of the QSR, which cover the methods and the facilities and controls for the design, manufacture, testing, production, processes, controls, quality assurance, labeling, packaging, distribution, installation and servicing of finished devices intended for 84 Table of Contents human use. The QSR also requires, among other things, maintenance of a device master file, device history file and complaint files. In January 2024, the FDA published a final rule to amend the QSR to align the regulations more closely with the international consensus standard for devices by converging with the quality management system (QMS) requirements used by other regulatory authorities from other countries. Manufacturers had until February 2, 2026, to modify their quality systems to meet QMS Regulations (QMSR). Manufacturers are subject to periodic scheduled or unscheduled inspections by the FDA. A failure to maintain compliance with the regulatory requirements could result in the shut-down of, or restrictions on, manufacturing operations and the recall or seizure of products. The discovery of previously unknown problems with products, including unanticipated adverse events or adverse events of increasing severity or frequency, whether resulting from the use of the device within the scope of its clearance or off-label by a physician in the practice of medicine, could result in restrictions on the device, including the removal of the product from the market or voluntary or mandatory device recalls. The FDA has broad regulatory compliance and enforcement powers. If the FDA determines that a manufacturer has failed to comply with applicable regulatory requirements, it can take a variety of compliance or enforcement actions, including the following: •issuance of warning letters, untitled letters, fines, injunctions, consent decrees and civil penalties; •requesting or requiring recalls, withdrawals or administrative detention, or seizure of our products; •imposing operating restrictions or partial suspension or total shutdown of production; •refusing or delaying requests for 510(k) marketing clearance or PMA approvals of new products or modified products; •withdrawing 510(k) clearances or PMA approvals that have already been granted; •refusal to grant export approvals for our products; or •criminal prosecution. Authorization to Market In Vitro Medical Devices in the European Economic Area In the EEA, in vitro medical devices that are in transition to the new regulations are required to conform with the essential requirements of the EU In Vitro Diagnostic Directive (IVDD Directive No 98/79/EC, as amended, the “IVDD”). The scope of 98/79/EC applies to IVD medical devices and accessories, which can include not just reagents and kits but also instruments and software. To demonstrate compliance, ISO 13485 is recognized as the harmonized standard for regulatory quality system compliance. Companies are required to meet the essential requirements of the IVDD. EU IVD Regulatory Classification Under the IVDD, the risk presented by a device determines the classification and therefore the level of control and regulatory review required. Annex II of the IVDD identifies specific device types that are categorized as either high risk (List A) or moderate risk (List B). General IVDs may self-certify without the intervention of a Notified Body in order to affix the CE Marking. Self-test IVDs, because of the greater risk associated with being used by untrained lay users, have special requirements, while all other devices not classified as either List A, List B or self-test are regarded as general IVDs. SOPHiA currently has self-certified applications and products in the EU market through SwissMedic. On April 5, 2017, the EU adopted the new In Vitro Device Regulation (EU) 2017/746 (the “IVDR”), which repeals and replaces Directive No 98/79/EC effective May 2022. Unlike directives, which must be implemented into the national laws of the EU member states, a regulation is directly applicable, i.e., without the need for adoption of EU member state laws implementing them, in all EEA member states. The IVDR, among other things, is intended to establish a uniform, transparent, predictable and sustainable regulatory framework across the EU for in vitro diagnostic medical devices and ensure a high level of safety and health while supporting innovation. 85 Table of Contents The IVDR will not become fully applicable until five years following its entry into force. Once applicable, the IVDR will, among other things: •strengthen the rules on placing devices on the market and reinforce surveillance once they are available; •establish explicit provisions on manufacturers’ responsibilities for the follow-up of the quality, performance and safety of devices placed on the market; •improve the traceability of medical devices throughout the supply chain to the end-user or patient through a unique identification number; and •set up a central database to provide patients, healthcare professionals and the public with comprehensive information on products available in the EU. On July 9, 2024, the Regulation (EU) 2024/1860 was published in the Official Journal of the European Union, which includes new transitional periods for IVDs. When following certain conditions i.e. QMS requirements and Notified Body agreements the transition deadlines are extended as follows; December 2027 for class D devices that are transitioning from IVDD self declared, December 2028 for class C devices that are transitioning from IVDD self declared, and December 2029 for class B that are transitioning from IVDD self declared and A sterile devices. Moreover, the application of certain requirements of Article 5(5) of the IVDR for devices manufactured and used in the same health institution (so-called ‘in-house devices') came into force in May 2024 with full compliance to Article 5(5) required in May 2030. Any products currently on the market with a CE-IVD label before May 2022 may remain on the market until the new deadline or until the product undergoes a significant change, at which point, it must comply with all the requirements of the IVDR. Brexit and the Regulatory Framework in the U.K. On June 23, 2016, the electorate in the U.K. voted in favor of leaving the EU, commonly referred to as Brexit. On December 24, 2020, the U.K. and the EU entered into a Trade and Cooperation Agreement. The agreement sets out certain procedures for approval and recognition of medical products in each jurisdiction. Since the regulatory framework for medical products in the U.K. covering quality, safety and efficacy of medical products, clinical trials, marketing authorization, commercial sales and distribution of pharmaceutical medical is derived from EU directives and regulations, Brexit could materially impact the future regulatory regime which applies to medical products in the U.K., as the U.K. legislation now has the potential to diverge from EU legislation. It remains to be seen how Brexit will impact regulatory requirements for medical products in the U.K. in the long-term. The Medicines and Healthcare products Regulatory Agency published detailed guidance for industry and organizations to follow from January 1, 2021, which will be updated as the U.K.’s regulatory position on medicinal products evolves over time. A new UKCA mark will replace the CE mark in Great Britain (CE marks or UKNI marks will be required in Northern Ireland). However, all medical devices and IVD's must be registered with the Medicine and Healthcare products Regulatory Agency to be placed on the Great Britain market, CE marked devices can be placed on the Great Britain market until, at least, 30 June 2030, depending on the device type and classification. EU-Swiss Institutional Framework Agreement In May 2022, Switzerland adopted the new Ordinance on In vitro Diagnostic Medical Devices (“IvDO”), which replaced the former agreement. Under the new regulation, in order to market products in Switzerland, companies that manufacture diagnostic and medical devices are required to register the products with the Swiss Agency for Therapeutic Products (“Swissmedic”) and label the products accordingly. Additionally, products manufactured in the Swiss facilities of companies are subject to additional registration and representation requirements in order to be marketed within the European Economic Area (“EEA”), including but not limited to the appointment of an Authorized Representative. Other Jurisdictions Outside the United States, the EU, the U.K. and Switzerland, regulatory pathways for the marketing of medical devices vary greatly from country to country. In many countries, local regulatory agencies conduct an 86 Table of Contents independent review of medical devices prior to granting marketing approval and may require specific disclosure or localization to access the local market. For instance, in Brazil all medical devices imported into or distributed within Brazil must first be registered with the Agência Nacional de Vigilância Sanitária (“ANVISA”) or the National Health Surveillance Agency. ANVISA is an autonomous regulatory agency responsible for the regulation and oversight of medical devices and other medical products in Brazil, including the registration of medical devices and the maintenance of a registered products database. The medical device company must be located in Brazil or arrange for a licensed third-party company to be the Brazilian registration certificate title holder. Resolution RDC 36/2015 is the central regulation applicable to registration of in vitro diagnostic devices and Resolution RDC 751/2022, which became effective on March 1, 2023, covers software as medical devices in Brazil, describing the protocol and documents required, including localization into Brazilian Portuguese. Chapter II set forth of RDC 36/2015 the classification scheme, assigning devices to one of four risk classes, based upon various rules enumerated therein. This classification structure is aligned with the EU’s one. If a device fits into more than one risk classification, its final risk class is the one associated with the highest risk level. Class I and Class II registrations do not expire. Class III and IV registrations are valid for ten years. Registration renewals must be initiated no earlier than one year and no later than six months prior to expiration. Manufacturers are also subject to audits to ensure compliance with the Brazilian Good Manufacturing Practices (“BGMP”) prior to receiving authorization to sell from ANVISA. BGMP audits may be fulfilled through other audits by recognized entities through the Medical Device Single Audit Program. RUO products are labeled accordingly and are not subject to these registration requirements. While we are currently able to market our SOPHiA DDM Platform and related solutions, products and services in Brazil, including through our Brazilian subsidiary, any changes to the regulatory framework for RUO products could result in additional costs to us, including expenses related to additional audits, translations and registration fees, or delays in accessing the Brazilian market, including due to the time required to obtain necessary ANVISA approvals. In Turkey, medical devices are regulated by the Medicines and Medical Devices Agency within Ministry of Health and pursuant to the Medical Device Regulation, the Regulation on Active Implantable Medical Devices and the Regulation on In Vitro Diagnostic Medical Devices. These regulations generally resemble analogous EU directives and regulations. To be sold in Turkey, medical devices must bear a CE mark and must subsequently be registered in the Turkish Ministry’s online database (Turkish Drug and Medical Device National Databank, or TITUBB) in order to be marketed in Turkey. Manufacturers without local presence in Turkey must appoint a Local Authorized Representative. A product will generally be considered a medical device if it is marketed as a medical device in the EU. In recent years, software and mobile application medical devices have been increasing and the Medicines and Medical Devices Agency has considered certain software and mobile applications as medical devices, taking into consideration their intended use. In March 2021, the Product Safety and Technical Regulations Law No. 7223 (the “Product Safety Law”) became effective. The Product Safety Law reconciled some outstanding differences between Turkish and EU product safety standards, providing in part for manufacturer and importer liability in the event that a noncompliant or unsafe product causes harm or damage and mandating recall of such products. Because the current regulatory framework in Turkey closely parallels the EU’s framework, we do not currently experience material difficulties in marketing our SOPHiA DDM Platform and related solutions, applications, products, and services in Turkey that are unique to that jurisdiction. In Japan the Ministry of Health, Labour and Welfare (“MHLW”) uses a classification system based on risk for IVDs, there are three types of registration procedures; Pre-market notification for Class I (lowest) risk devices, Pre-market certification (“PMC”) for Class II devices, and Pre-Market Approval (“PMA”) for Class III (highest) risk devices. Companies must comply with the Pharmaceuticals Medical Device Act (“PMDA”), manufacturers must also comply with MHLW Ordinance No. 169 relating to quality management systems in addition to appointing an in country representative and registration of design and manufacturing facilities. The Japanese regulatory space requires interactions with authorities in Japanese and therefore partnership or local expertise is required for engagement in the country. The Therapeutic Goods Administration (“TGA”) regulates IVDs in Australia which classifies IVDs into four categories based on risk; Class 1 No public health risk or low personal risk, Class II Low public health risk or moderate personal risk, Class III Moderate public health risk or high personal risk, Class 4 High public health risk. Similar to the EU, the TGA allows In-House manufacture of IVDs, this includes assembly of commercially available components which may not be regarded as IVDs because they are marked for RUO. The TGA separates IVDs into two categories the first being in house IVDs in Classes 1-3, the second being in house IVDs 87 Table of Contents in Class 4. Both categories require the involvement of Australia’s National Association of Testing Authorities in conjunction with the Royal College of Pathologists in that in house manufacturers must be accredited to ISO 15189 for medical testing labs. Federal and State Health Care Laws in the United States Federal Physician Self-Referral Prohibition In the United States, we are subject to the federal physician self-referral prohibition, commonly known as the Stark Law. Under this law, physicians who have an ownership interest or a compensation relationship with a clinical laboratory may not, unless an exception applies, refer Medicare or Medicaid patients for testing to the laboratory, regardless of the intent of the parties. Similarly, laboratories may not bill Medicare or Medicaid for services furnished pursuant to a prohibited self-referral. Several Stark Law exceptions are relevant to many common financial relationships involving clinical laboratories and referring physicians, including: (1) fair market value compensation for the provision of items or services; (2) payments by physicians to a laboratory for clinical laboratory services; (3) space and equipment rental arrangements that satisfy certain requirements and (4) personal services arrangements that satisfy certain requirements. Penalties for violating the Stark Law include significant denial of payment, the return of funds received for all prohibited referrals, fines, civil monetary penalties, and exclusion from the federal health care programs. In addition, knowing violations of the Stark Law may also serve as the basis for liability under the federal False Claims Act (the “FCA”), which can result in additional civil and criminal penalties. Many states have their own self-referral laws as well, which in some cases apply to all patient referrals, not just government reimbursement programs. Federal Anti-Kickback Law The federal Anti-Kickback Statute (AKS) prohibits, among other things, knowingly and willfully offering, paying, soliciting or receiving any remuneration (i.e., anything of value), directly or indirectly, overtly or covertly, in cash or in kind, in order to induce or in return either for the referral of an individual, or for purchasing, leasing, ordering, or arranging for the purchase, lease, or order of any healthcare item or service that is reimbursable under any federal health care program, including Medicare or Medicaid. Liability under the AKS may be established without proving actual knowledge of the statute or specific intent to violate it. Federal and state law enforcement authorities scrutinize arrangements between health care providers and potential referral sources to ensure that the arrangements are not designed as a mechanism to induce patient care referrals or induce the purchase or prescribing of particular applications, products, or services. Generally, courts have taken a broad interpretation of the scope of the AKS, holding that the statute may be violated if merely one purpose of a payment arrangement is to induce referrals or purchases. Although there is a number of statutory exceptions and regulatory safe harbors protecting certain common business arrangements and activities from prosecution or regulatory sanctions, the exceptions and safe harbors are drawn narrowly and practices that involve remuneration intended to induce prescribing, purchasing or recommending may be subject to scrutiny if they do not fit squarely within an exception or safe harbor. In addition, the government may assert that a claim that includes items or services resulting from a violation of the AKS constitutes a false or fraudulent claim under the federal civil False Claims Act (FCA), which is discussed in greater detail below. Although the AKS applies only to items and services reimbursable under any federal health care program, a number of states have passed statutes substantially similar to the AKS that apply to all payors. Violations of the AKS are punishable by imprisonment, criminal fines, damages, civil monetary penalties, and exclusion from participation in federal healthcare programs. False Claims Act The FCA prohibits, among other things, a person from knowingly presenting, or causing to be presented, a false or fraudulent claim for payment or approval and from making, using, or causing to be made or used, a false record or statement material to a false or fraudulent claim in order to secure payment or retain an overpayment by the federal government. In addition to actions initiated by the government itself, the statute authorizes actions to be brought on behalf of the federal government by a private party having knowledge of the alleged fraud. Because the complaint is initially filed under seal, the action may be pending for some time before the defendant is even aware of the action. If the government intervenes and is ultimately successful in obtaining redress in the matter or if the plaintiff succeeds in obtaining redress without the government’s involvement, then the plaintiff will receive a percentage of the recovery. Finally, the Social Security Act includes its own provisions 88 Table of Contents that prohibit the filing of false claims or submitting false statements in order to obtain payment. Several states have enacted comparable false claims laws which may be broader in scope and apply regardless of payor. Other Health Care Laws In addition to the requirements discussed above, several other health care fraud and abuse laws could have an effect on our business. The Social Security Act includes civil monetary penalty provisions that impose penalties against any person or entity that, among other things, is determined to have presented or caused to be presented a claim to a federal health program that the person knows or should know is for an item or service that was not provided as claimed or is false or fraudulent. In addition, a person who offers or provides to a Medicare or Medicaid beneficiary any remuneration, including waivers of copayments and deductible amounts (or any part thereof), that the person knows or should know is likely to influence the beneficiary’s selection of a particular provider, practitioner or supplier of Medicare or Medicaid payable items or services may be liable under the civil monetary penalties statute. Moreover, in certain cases, providers who routinely waive copayments and deductibles for Medicare and Medicaid beneficiaries, for example, in connection with patient assistance programs, can also be held liable under the AKS and FCA. One of the statutory exceptions to the prohibition is non-routine, unadvertised waivers of copayments or deductible amounts based on individualized determinations of financial need or exhaustion of reasonable collection efforts. The Office of Inspector General of the U.S. Department of Health and Human Services (HHS) emphasizes, however, that this exception should only be used occasionally to address special financial needs of a particular patient. The Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collectively, “HIPAA”) imposes criminal and civil liability for, among other actions, knowingly and willfully executing, or attempting to execute, a scheme to defraud any healthcare benefit program, including private third-party payors, and knowingly and willfully falsifying, concealing or covering up a material fact or making any materially false, fictitious or fraudulent statement or representation in connection with the delivery of or payment for healthcare benefits, items or services. Like the AKS, a person or entity does not need to have actual knowledge of the statute or specific intent to violate it in order to have committed a violation. The Eliminating Kickbacks in Recovery Act (EKRA) is an all-payor anti-kickback law that makes it a criminal offense to pay any remuneration to induce referrals to, or in exchange for, patients using the services of recovery homes, substance use clinical treatment facilities, or laboratories. Although the enactment of EKRA focused on patient brokering and similar arrangements to induce the patronage of substance use recovery and treatment, EKRA’s statutory prohibition is broadly written. The full scope and application of EKRA is uncertain. The Physician Payments Sunshine Act, enacted as part of the Affordable Care Act (ACA), also imposed annual requirements on manufacturers of certain devices, drugs, and biologics to report annually to CMS information related to payments and other transfers of value made to physicians, other health care professionals, and teaching hospitals, as well as ownership and investment interests held by physicians and their immediate family members. Also, many states have laws similar to those listed above that may be broader in scope and may apply regardless of payor. If our operations are found to be in violation of any of the fraud and abuse laws described above or any other laws that apply to us, we may be subject to penalties, including potentially significant criminal, civil and administrative penalties, damages, fines, disgorgement, imprisonment, exclusion from participation in government healthcare programs, contractual damages, reputational harm, integrity oversight and reporting obligations, limitations to the sale of certain applications, products, or services, diminished profits and future earnings, and the curtailment or restructuring of our operations. Efforts to ensure that our internal operations and business arrangements with third parties comply with applicable laws and regulations involve substantial costs. Any action brought against us for violation of these or other laws or regulations, even if we successfully defend against it, could cause us to incur significant legal expenses and divert our management’s attention from the operation of our business. 89 Table of Contents Coverage and Reimbursement Sales of our SOPHiA DDM Platform and related solutions, applications, products, and services, if approved for IVD use in the United States, may depend substantially on the extent to which health maintenance organizations, managed care organizations, pharmacy benefit managers, federal and state government health administration authorities, private health coverage insurers and other third-party payors provide coverage for and establish adequate reimbursement levels for such solutions, applications, products, and services. In the United States, many significant decisions about coverage and reimbursement for new diagnostics and medicines are made by CMS, which decides whether and to what extent a new diagnostic or medicine will be covered and reimbursed under Medicare, although it frequently delegates this authority to local Medicare Administrative Contractors (MACs), and by states under their Medicaid programs. Medicare is a federally funded program managed by CMS through MACs and carriers that administer coverage and reimbursement for certain healthcare items and services furnished to the elderly, disabled individuals, and individuals with certain medical conditions. Medicaid is an insurance program for certain categories of patients, including pregnant women, whose income and assets fall below state defined levels, that is both federally and state funded and managed by each state. In the United States, private health insurers and other third-party payors often provide reimbursement for products and services based on the level at which the government provides reimbursement through the Medicare or Medicaid programs for such products and services. It is difficult to predict what CMS, state Medicaid programs, and other third-party payors will decide with respect to coverage and reimbursement for novel platforms, applications, products, and services such as ours. Outside the United States, the reimbursement process and timelines vary significantly. Certain countries, including a number of member states of the EU, set prices and make reimbursement decisions for diagnostics and pharmaceutical products, or medicinal products, as they are commonly referred to in the EU, with limited participation from the marketing authorization holders or medical device manufacturers, or may take decisions that are unfavorable to the marketing authorization holders or medical device manufacturers where they have participated in the process. Health Reform In the United States and many foreign jurisdictions, there has been significant interest in implementing cost-containment programs to limit the growth of government-paid healthcare costs, including price controls and restrictions on reimbursement. Because private payers often follow Medicare and Medicaid coverage policy and payment limitations in setting their own reimbursement rates, any reduction in reimbursement that results from federal legislation or regulation may result in a similar reduction in payments from private payers. We expect to experience pricing pressures in connection with the sale of any products that we develop due to the trend toward managed healthcare, the increasing influence of health maintenance organizations, and additional legislative and regulatory measures. Such legislative changes in the United States include the ACA, which intended to broaden access to health insurance, reduced or constrained the growth of healthcare spending, enhanced remedies against healthcare fraud and abuse, added new transparency requirements for healthcare and health insurance industries, and imposed additional health policy reforms. We expect that additional federal, state, and foreign healthcare reform measures will be adopted in the future, any of which could limit the amounts that federal, state, and foreign governments will pay for healthcare products and services, which could result in limited coverage and reimbursement and reduced demand for our products, once approved, or additional pricing pressures. Data Privacy and Security Health Insurance Portability And Accountability Act and Other U.S. Laws and Regulations Under HIPAA, as amended by HITECH, HHS has issued security, privacy, and breach notification regulations pertaining to protected health information (PHI) used or disclosed by certain entities, including certain health care providers such as us. Three standards have been promulgated under HIPAA’s and HITECH’s regulations: the Standards for Privacy of Individually Identifiable Health Information, which restrict the use and disclosure of certain individually identifiable health information, the Standards for Electronic Transactions, which establish standards for common healthcare transactions, such as claims information, plan eligibility, payment information and the use of 90 Table of Contents electronic signatures, and the Security Standards for the Protection of Electronic Protected Health Information, which require covered entities and business associates to implement and maintain certain security measures to safeguard certain electronic health information, including the adoption of administrative, physical and technical safeguards to protect such information. The HIPAA privacy regulations cover the use and disclosure of PHI by covered entities as well as business associates, which are defined to include subcontractors that create, receive, maintain, or transmit PHI on behalf of a covered entity or business associate, as well as their covered subcontractors. They also set forth certain rights that an individual has with respect to his or her PHI maintained by a covered entity, including the right to access or amend certain records containing PHI, or to request restrictions on the use or disclosure of PHI. The HIPAA security regulations establish requirements for safeguarding the confidentiality, integrity and availability of PHI that is electronically transmitted or electronically stored. HITECH, among other things, established certain health information security breach notification requirements. A covered entity must notify any individual whose PHI is breached according to the specifications set forth in the breach notification rule. The HIPAA privacy and security regulations establish a uniform federal “floor” for PHI and do not preempt state laws that are more stringent or provide individuals with greater rights with respect to the privacy or security of, and access to, their records containing PHI or insofar as such state laws apply to personal information that is broader in scope than PHI. In addition, individuals (or their personal representatives, as applicable) generally have the right to access test reports directly from laboratories and to direct that copies of those reports be transmitted to persons or entities designated by the individual. HIPAA authorizes U.S. state attorneys general to file suit on behalf of their residents for violations. Courts are able to award damages, costs and attorneys’ fees related to violations of HIPAA in such cases. While HIPAA does not create a private right of action allowing individuals to file suit against us in civil court for violations of HIPAA, its standards have been used as the basis for duty-of-care cases in state civil suits such as those for negligence or recklessness in the misuse or breach of PHI. In addition, violations of HIPAA could result in significant penalties imposed by the HHS’s Office for Civil Rights. HIPAA also mandates that the Secretary of HHS conduct periodic compliance audits of HIPAA-covered entities, such as us, and their business associates for compliance with the HIPAA privacy and security standards. It also tasks HHS with establishing a methodology whereby harmed individuals who were the victims of breaches of unsecured PHI may receive a percentage of the civil monetary penalty paid by the violator. Our company may receive, as part of the normal course of its business, PHI that is covered by HIPAA. Considering this, we have certain obligations under HIPAA regarding the use and disclosure of any PHI that may be provided to us. Therefore, noncompliance with privacy and security requirements imposed by HIPAA and HITECH could subject us to significant administrative, civil, and criminal penalties. In addition, many states in which we operate have laws that protect the privacy and security of sensitive and personal information. Certain state laws, such as those of California and other states that have adopted versions of the Consumer Data Privacy Act, are more stringent or broader in scope, or offer greater rights to individuals, with respect to sensitive and personal information than federal, international or other state laws, and such laws may differ from each other, which may complicate compliance efforts. In addition, new legislation or constitutional amendments proposed or enacted in various states impose, or have the potential to impose, additional obligations on companies that collect, store, use, retain, disclose, transfer, and otherwise process confidential, sensitive, and personal information, and will continue to shape the data privacy environment nationally. State laws are changing rapidly and there is discussion in the U.S. Congress of a new federal data protection and privacy law to which we would become subject if it is enacted. All of these evolving compliance and operational requirements impose significant costs that are likely to increase over time, and may require us to modify our data processing practices and policies, divert resources from other initiatives and projects, and could restrict the way applications, products, and services involving data are offered, all of which may have a material and adverse impact on our business, financial condition and results of operations. Numerous other federal and state laws, including consumer protection laws and regulations, govern the collection, dissemination, use, access to, confidentiality and security of patient health information. We intend to continue to comprehensively protect all personal information and to comply with all applicable laws regarding the protection of such information through our policies and procedures as well as through administrative, physical and technical safeguards. 91 Table of Contents General Data Protection Regulation and Other Foreign Laws and Regulations As we are operating worldwide, including in the EU and the EEA member states, the U.K., and Switzerland, we have to ensure the compliance of our processing activities with different data protection laws and regulations. Non-compliance with these data protection laws and regulations may not only result in high penalties, it can also cause a loss of reputation and trust. In the EU and the EEA, processing operations of personal data, including health and genetic personal data, are governed by the GDPR. The GDPR strengthens the powers of the relevant authorities and adds a broad array of requirements for handling personal data, including, for example, requirements to establish a legal basis for processing, higher standards for obtaining consent from individuals to process their personal data, more robust disclosures to individuals and a strengthened individual data rights regime, requirements to implement safeguards to protect the security and confidentiality of personal data that requires the adoption of administrative, physical and technical safeguards, shortened timelines for data breach notifications to appropriate data protection authorities or data subjects, limitations on retention and secondary use of information, increased requirements pertaining to health data and additional obligations when we contract third-party processors in connection with the processing of the personal data. EU and EEA member states are tasked under the GDPR to enact, and have enacted, certain implementing legislation that adds to and/or further interprets the GDPR requirements and potentially extends our obligations and potential liability for failing to meet such obligations. The GDPR, together with national legislation, regulations and guidelines of the EU and the EEA member states governing the processing of personal data, impose strict obligations and restrictions on the ability to collect, use, retain, protect, disclose, transfer, and otherwise process personal data. In particular, the GDPR includes obligations and restrictions concerning the consent and rights of individuals to whom the personal data relates, the transfer of personal data out of the EEA, security breach notifications and the security and confidentiality of personal data, including the following: •Lawfulness, fairness and transparency: Personal data must be processed lawfully, fairly, and in a transparent manner. •Purpose limitation: Personal data must be obtained for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. •Data minimization: Personal data processed must be adequate, relevant, and limited to what is necessary. •Accuracy: Personal data must be accurate and, where necessary, kept up to date. •Storage limitation: Personal data must not be kept longer than is necessary. •Integrity and confidentiality: Appropriate technical and organizational measures must be put in place to guard against unauthorized or unlawful processing, loss, damage, or destruction. The GDPR authorizes fines for certain violations of up to 4% of global annual revenue or €20 million, whichever is greater, and other administrative penalties. The U.K. has transposed the GDPR into domestic law, with its version of the GDPR that took effect on January 1, 2021, exposing us to two parallel regimes, each of which authorizes similar fines for certain violations. While the GDPR and the U.K. GDPR remain substantially similar for the time being, the government of the U.K. has adopted reforms to its data privacy and cybersecurity legal framework in its Data Use and Access Act 2025, which became law on June 19, 2025 (phasing in between June 2025 and June 2026) and will introduce significant changes from the GDPR. This may lead to additional compliance costs and could increase overall risk exposure as businesses may no longer be able to take a unified approach across the EEA and the U.K., and such businesses may need to amend their processes and procedures to align with the new framework. Implementing mechanisms to endeavor to ensure compliance with the GDPR and the U.K. GDPR may be onerous and expose businesses to divergent parallel regimes that may be subject to potentially different interpretations and enforcement actions for certain violations and related uncertainty. In addition, processing of personal data may be governed by the Federal Act on Data Protection (FADP). The FADP entered into force in September 2023 and provides for data protection principles that are substantially similar to those applied under the GDPR. The purpose of the FADP is to protect the personality rights, including privacy rights, and the fundamental rights of data subjects. The FADP is broad in its material scope and applies 92 Table of Contents to personal data processing activities carried out by federal authorities, private organizations and individual private persons (excluding processing activities for exclusively personal use). The territorial scope of the FADP goes beyond those processing operations carried out in Switzerland, also covering operations that have an effect in Switzerland, even if they originate in another country. Sensitive personal data, including health data, genetic data and biometric data, which unequivocally identify a natural person, are subject to stricter protective measures in various respects. For example: (i) if consent is required, it must be given expressly in the case of processing of sensitive personal data; (ii) controllers must keep record of their data processing activities; (iii) sensitive data must not be disclosed to third parties without justification; (iv) the controller of a data file is obliged to inform the data subject of the collection personal data; and (v) disclosing personal data in breach of a confidentiality obligation may be criminally prosecuted. Processing activities by companies must not harm the privacy or personality of the data subject. If the FADP is violated, the Federal Data Protection and Information Commissioner may request that the processing is fully or partially adjusted, suspended, or terminated. Additionally, the new FADP authorize criminal fines for certain violations of up to CHF 250,000. Such fines are mainly imposed upon the individual responsible for the violation and most likely levied against C-level executives and those responsible for the organization’s data protection program. The FADP also authorizes fines of up to CHF 50,000 on the responsible data controller or processor. Fines under the FADP may be imposed in addition to fines under other data protection regimes. As part of our processing activities, we implemented a global compliance plan with applicable laws and regulations, which includes in particular: •the appointment of a Data Protection Officer; •the creation of the Information Security and Privacy Committee, of which the Information Security Governance Director and Data Protection Officer is the manager; •the implementation of contractual documentation with our collaborators, aligned with the GDPR requirements; •the preparation of procedures and guidelines, such as a global data protection policy, a data breach responses plan and standard operating procedures for data subject requests; and •the realization of global data mapping and record by the Data Protection Officer. In particular, the purpose of the Information Security and Privacy Committee is to ensure the data and information we process are protected against data protection risks (in compliance with various data privacy regulations and principles of good governance) as well as to assess the effectiveness of our systems, controls and procedures. The Data Protection Officer is in charge, in particular, of establishing and maintaining processes for receiving, documenting, tracking, investigating, and taking actions on all complaints concerning data protection and considering the risks associated with processing operations, taking into account the nature, scope, context, and purposes of processing. For more information regarding risks relating to data privacy and security laws and regulations, see “Item 3. Key Information—D. Risk Factors—Risks Related to Governmental Regulation—We are subject to stringent privacy and, information security laws and regulations and changes in such laws and regulations could adversely affect our business and increase our costs.” Information Security We have implemented protections consistent with the ISO/IEC 27001:2022, ISO/IEC 27017:2015, ISO/IEC 27018:2017 standards with respect to technical and physical security in an effort to ensure a level of security appropriate to the risk of our processing activities, in particular with respect to protecting the personal data and customer data we process in the cloud against damage, loss and unauthorized access, use, modification, disclosure, destruction, or other misuse. For this purpose, we have what we believe are adequate data breach response plans, disaster recovery plans, and security arrangements in place. However, there can be no assurance that our efforts will be successful in protecting against adverse events or successfully mitigating their effects. For more information regarding risks relating to information security, see “Item 3. Key Information—D. Risk Factors—Risks Related to Our Business and Industry—Cybersecurity or data privacy breaches, other unauthorized or improper access, or (distributed) denial service lack of access (e.g., ransomware, persistent DoS/DDoS) could result in additional costs, service outages, loss of revenue, significant liabilities, harm to our 93 Table of Contents brand and decreased/denied use of our SOPHiA DDM Platform and related solutions, applications, products, or services.” Data Use Rights As part of our activities, we process thousands of genetic profiles for our customers around the world. As a result, and in accordance with applicable data protection laws and regulations, we may produce aggregate anonymized statistical data from the results of all analyses performed using our proprietary algorithms (“Insights”), which are our sole and exclusive property. Hence, a distinction is made between customer data (i.e., the data uploaded by our customers on our SOPHiA DDM Platform) on the one hand and other data generated and developed by us (i.e., the results of the performance of our proprietary algorithms, such as Insights) on the other hand. In this respect, Insights are generated using our proprietary algorithms in the context of our SOPHiA DDM Platform and constitute our know-how and trade secrets. As part of the performance of our services related to our commercial and research and development activities and in accordance with our contractual documentations accepted by our customers and collaborators, we may use our customers’ and collaborators’ data in particular: (i) for providing services; (ii) for maintaining, developing, improving, and demonstrating the SOPHiA DDM Platform, products, and services; and (iii) as permitted by applicable laws and regulations. In addition, in accordance with the FADP and the GDPR, we can reuse customer data (including personal data) for further processing activities for statistical purposes. European data protection authorities have previously noted that processing for statistical purposes and for research purposes (including marketing research) are contexts where legitimate purpose can arise. In addition, the processing of personal data for purposes other than those for which the personal data was initially collected should be allowed where the processing is compatible with the purposes for which the personal data was initially collected. Specific derogations apply for processing operations for statistical purposes, in accordance with the GDPR, as follows: •personal data can be stored for longer periods insofar as the personal data will be processed solely for statistical purposes subject to implementation of the appropriate technical and organizational measures; information obligations in processing for statistical purposes do not apply if they would involve a disproportionate effort; consideration of this takes into account the number of data subjects and the age of the data, and appropriate safeguards must be adopted; and •restrictions of the right of a data subject to exercise its “right to erasure” apply if it is likely to significantly impair processing for statistical purposes. Meanwhile, processing for statistical purposes is subject to certain requirements to: •set up appropriate safeguards to protect the rights and freedoms of the data subject; and •implement adequate technical and security measures entrenching the principle of data minimization and using pseudonymized data as the default. Insights consist of aggregated data providing general trends without identifying individual data subjects and do not contain personally identifiable information. The GDPR does not apply to data that does not relate to or identify an individual, such as aggregated data sets. Consequently, such data sets do not constitute personal data or identifiable information under the GDPR. We believe we have taken reasonable measures to ensure appropriate safeguards and adequate technical and security measures for the processing activities required to generate Insights. Environmental, Health, and Safety Regulations We are subject to various federal, state, local, and foreign environmental, health, and safety laws and regulations and permitting and licensing requirements. Such laws include those governing laboratory practices, 94 Table of Contents the generation, storage, use, manufacture, handling, transportation, treatment, remediation, release and disposal of, and exposure to, hazardous materials and wastes, and worker health and safety. Our operations involve the generation, use, storage and disposal of hazardous materials, and the risk of injury, contamination or non-compliance with environmental, health, and safety laws and regulations or permitting or licensing requirements cannot be eliminated. Compliance with environmental laws and regulations has not had a material effect on our capital expenditures, financial position, or competitive position. International Regulations Many countries in which we may offer any of our diagnostic tests in the future have anti-kickback regulations prohibiting providers from offering, paying, soliciting, or receiving remuneration, directly or indirectly, in order to induce business that is reimbursable under any national health care program. In situations involving physicians employed by state-funded institutions or national health care agencies, violation of the local anti-kickback law may also constitute a violation of the FCPA. The FCPA prohibits individuals and companies, and their employees, agents, and intermediaries from offering, providing, giving, or authorizing the provision of, directly or indirectly through a third party, including any potential distributors we may rely on in certain markets, anything of value to a foreign government official with corrupt intent to influence an award or continuation of business or to gain an unfair advantage, whether or not such conduct violates local laws. We can also be held liable for the corrupt or illegal activities of our agents and intermediaries, even if we do not explicitly authorize or have actual knowledge of such activities. In addition, the FCPA requires public companies to maintain accurate books or records and to maintain a system of internal accounting controls. Violations of the FCPA’s anti-bribery provisions for corporations and other business entities are subject to a fine of up to $2 million, and officers, directors, stockholders, employees, and agents are subject to a fine of up to $100,000 and imprisonment for up to five years. Other countries, including the U.K. and other member states of the OECD Convention on Combating Bribery of Foreign Public Officials in International Business Transactions, have similar anti-corruption regulations, such as the United Kingdom Bribery Act 2010. When marketing our diagnostic tests outside of the United States, we may be subject to foreign regulatory requirements governing human clinical testing, prohibitions on the import of tissue necessary for us to perform our diagnostic tests or restrictions on the export of tissue imposed by countries outside of the United States or the import of tissue into the United States, and marketing approval. These requirements vary by jurisdiction, differ from those in the United States and may in some cases require us to perform additional pre-clinical or clinical testing. In many countries outside of the United States, coverage, pricing and reimbursement approvals are also required. C. Organizational Structure We have the following wholly owned subsidiaries: Name Jurisdiction of Incorporation SOPHiA GENETICS S.A.S. France SOPHiA GENETICS LTD U.K. SOPHiA GENETICS, Inc. Delaware, U.S. SOPHiA GENETICS Intermediação de Negócios LTDA Brazil SOPHiA GENETICS PTY LTD Australia SOPHiA GENETICS S.R.L. Italy SOPHiA GENETICS GmbH Germany 95 Table of Contents D. Property, Plants and Equipment We do not own any real property. We believe that our facilities meet our present needs and we are continuously reviewing our space requirements. The table below sets forth the sizes and uses of our facilities as of December 31, 2025: Location Primary Function Approximate Size A-ONE Park Building B2 Z.A La Pièce 12, 1180 Rolle Switzerland Office, Laboratory & Warehouse 65,860 sq ft Technopole Izarbel 158 Allée Fauste d'Elhuyar 64210 Bidart France Office 13,509 sq ft 401 Park Drive Suite 505 Boston, Massachusetts 02215 USA Office 12,807 sq ft Bâtiment GIENAH 11 avenue de Canteranne 33600 Pessac France Office 3,450 sq ft We continuously review our anticipated requirements for facilities and, on the basis of that review, may from time to time acquire or lease additional facilities and/or dispose of existing facilities. We are not aware of any environmental issues or other constraints that would materially impact the intended use of our facilities.