Contract analysis

I. EXECUTIVE SUMMARY This memorandum sets forth the findings and recommendations of Calderwood & Harkness LLP ("Calderwood & Harkness" or the "Firm") with respect to its assessment of the data privacy and data security practices of Meridian Diagnostics, Inc. (the "Company" or "Meridian"). This assessment has been conducted in connection with the proposed lead investment by Cobalt Ventures Fund III, LP ("Cobalt" or th

II. SCOPE AND METHODOLOGY A. Scope of Review This privacy and data security diligence review was conducted as part of a broader legal due diligence engagement commenced on January 6, 2026, with a target completion date of January 31, 2026. Calderwood & Harkness's privacy and data security practice group was engaged specifically to evaluate those aspects of the Company's operations, policies, procedures, and technical

1. The Company's privacy policies, including both internal-facing policies and any external-facing or patient-facing privacy notices in draft or final form;

2. Data flow diagrams and architecture documentation for the MeridianPulse platform, including depictions of data collection points, transmission pathways, storage locations, and processing workflows;

3. The Company's information security policies and procedures manual (version 1.2, dated September 2025);

4. Relevant provisions of the Company's employee handbook pertaining to data privacy, confidentiality, acceptable use of technology, and information security;

5. Executed confidentiality and Proprietary Information and Inventions Assignment Agreements ("PIIAs") for current employees, to the extent available;

6. Third-party vendor and service provider agreements, including cloud hosting agreements, software licensing agreements, and professional services engagement letters;

7. Existing Business Associate Agreements ("BAAs") executed between the Company and its cloud infrastructure providers;

8. The Company's draft incident response plan (version 0.8, dated November 2025), prepared by Dr. Julian Ochoa;

9. IT infrastructure documentation, including cloud environment configurations, network architecture descriptions, and any cybersecurity audit reports or assessments (noting that no formal external audit has been conducted to date);

10. The Company's responses to the Calderwood & Harkness Privacy and Security Diligence Questionnaire (submitted January 10, 2026; responses received January 17, 2026, with supplemental responses received January 22, 2026);

11. Memoranda and notes from discussions conducted by Calderwood & Harkness attorneys with Dr. Julian Ochoa (CTO) on January 14, 2026, and Nadia Chen (VP of Operations) on January 15, 2026, regarding the Company's current data privacy and security practices; and

12. The Company's intellectual property portfolio documentation, including five (5) issued U.S. utility patents and three (3) pending PCT applications, which were reviewed for data-related claims and embedded security features relevant to the MeridianPulse platform. A complete itemized list of all documents reviewed is set forth in Appendix A to this memorandum. C. Limitations. Several limitations apply to this asses

III. COMPANY OVERVIEW AND DATA ENVIRONMENT A. Business Overview Meridian Diagnostics, Inc. is developing the MeridianPulse platform, a microfluidic point-of-care diagnostic device designed to perform a 14-marker blood panel from a small-volume capillary or venous blood sample in under eight minutes. The platform integrates a disposable microfluidic cartridge with a compact, bench-top analyzer unit and associated clou

IV. HIPAA COMPLIANCE ASSESSMENT A. Covered Entity / Business Associate Status A threshold question in any HIPAA compliance assessment is whether the entity under review is a "Covered Entity" or a "Business Associate" under the statute. The applicability of HIPAA's Privacy Rule, Security Rule, and Breach Notification Rule depends on this classification. Current Status Analysis. Meridian's classification under HIPAA wi

V. STATE PRIVACY LAW COMPLIANCE A. Massachusetts — 201 CMR 17.00 As a company with its principal office in Cambridge, Massachusetts, Meridian is subject to the Massachusetts Standards for the Protection of Personal Information of Residents of the Commonwealth, codified at 201 CMR 17.00. These regulations apply to any person or entity that owns or licenses personal information about a resident of the Commonwealth of M

VI. CYBERSECURITY POSTURE AND TECHNICAL CONTROLS A. Network and Infrastructure Security The Company's technical infrastructure is primarily cloud-hosted. The Company does not maintain an on-premises data center and has limited local network infrastructure at its Cambridge, Massachusetts office. Development environments, data storage, and application hosting are provided through third-party cloud infrastructure provid

VII. ORGANIZATIONAL AND PERSONNEL MEASURES A. Employee Privacy and Security Training Employee awareness and training is a critical component of any data privacy and security program. Human error and insider threats consistently rank among the leading causes of data breaches and security incidents, and a well-designed training program is one of the most effective measures for mitigating these risks. The Company has co