Contract analysis

I. EXECUTIVE SUMMARY OF FINDINGS AND RISK ASSESSMENT

I.A. Engagement Background and Scope Solstice Biomedical Devices Ltd. ("Solstice," "SBD," or the "Company"), an Irish-headquartered private limited company specializing in the design, development, and commercialization of advanced cardiac monitoring devices, retained Calderwood & Harkness LLP ("C&H") to conduct a comprehensive sales-and-marketing compliance review in advance of the Company's first commercial launch i

I.B. Company Profile and Stakeholder Context A thorough understanding of Solstice's corporate structure, financial position, and stakeholder relationships is essential to contextualizing the compliance recommendations set forth in this Report. Solstice Biomedical Devices Ltd. is a private limited company incorporated under Irish law and headquartered at Unit 14, Clarion Business Park, Sandyford, Dublin D18 X4F2, Irel

I.C. Overall Risk Assessment Summary Based on our comprehensive review of Solstice's planned US commercial operations, contractual arrangements, compensation structures, promotional materials, and compliance program infrastructure, C&H has assessed the Company's compliance risk profile across the key regulatory areas within the scope of this engagement. The following summary risk matrix presents our categorization of

I.D. Key Recommendations Summary (Top 10 Priority Items) The following ten items represent the highest-priority recommendations arising from our engagement. Each is discussed in detail in the relevant section of this Report. We strongly recommend that Solstice's leadership team treat these items as prerequisites to the October 1, 2024 launch.

1. Revise sales compensation plan to add compliance guardrails to the 2.0x accelerator. At a minimum, allocate 15–20% of variable compensation to compliance-based metrics, add contractual clawback provisions, and consider capping accelerated earnings at 200% of at-plan variable compensation per quarter. (See Section V.E.)

2. Complete state registrations in Vermont ($500/year) and Massachusetts ($2,000/year plus PhRMA/AdvaMed Code adoption attestation) immediately. Both registrations must be in effect before any commercial sales activity in those states. (See Sections III.B.1 and III.B.2.)

3. Amend ADS Distribution Agreement Sections 7 and 12 per proposed redlines. Proposed amendments strengthen sub-distributor compliance provisions, expand audit rights, and add Sunshine Act data-collection and reporting obligations. (See Section IV.E and Appendix D.)

4. Finalize CMS Manufacturer ID registration. The application was submitted in June 2024 and must be confirmed and finalized before the launch date to ensure Open Payments reporting capability. (See Section II.C.4.)

5. Establish Medical-Legal-Regulatory (MLR) review committee before promotional materials are finalized. No promotional materials, sales training content, or speaker slide decks should be disseminated without MLR committee approval. (See Section II.D.4.)

6. Revise identified promotional claims in draft sales materials to align with 510(k) cleared indications. Specific claims regarding device performance, comparative efficacy, and patient population scope require revision. Detailed redlines provided separately. (See Section II.D.2.)

7. Hire permanent US-based Compliance Officer by Q4 2024. The current arrangement of a Dublin-based interim Compliance Officer is insufficient for sustained US commercial compliance operations. (See Section VII.C.)

8. Roll out compliance training for all 53 US commercial employees before October 1, 2024. Training curriculum has been developed; delivery must be completed and certifications obtained before launch. (See Section VIII.A.)

9. Implement Open Payments tracking and data-collection system for CY2024. The system must be operational before the first transfer of value to a covered recipient, which will occur at or near launch. (See Section II.C.6.)

10. Execute California Fair Pricing Act disclosure. The Pulsar CRM System's wholesale acquisition cost (WAC) of $4,950 exceeds the $2,500 threshold triggering disclosure requirements under California law. (See Section III.C.)

II. FEDERAL COMPLIANCE FRAMEWORK

II.A. Federal Anti-Kickback Statute Analysis (42 U.S.C. § 1320a-7b(b))

II.A.1. Overview of the AKS. The federal Anti-Kickback Statute ("AKS") is the cornerstone federal statute governing financial relationships between medical device manufacturers and those who are in a position to refer, recommend, or arrange for the purchase or use of products reimbursable under federal healthcare programs, including Medicare and Medicaid. The AKS is codified at 42 U.S.C. § 1320a-7b(b) and prohibits t

II.A.2. Applicable Safe Harbors. Congress authorized the OIG to promulgate regulatory safe harbors describing specific payment and business practices that, although potentially implicating the AKS, are not subject to criminal prosecution or civil sanctions. These safe harbors are set forth in 42 C.F.R. § 1001.952 and provide a "bright line" test: if an arrangement meets all elements of an applicable safe harbor, it i

II.A.3. Analysis of Specific Solstice Arrangements. ##### II.A.3.a. ADS Distribution Agreement — 18% Commission Structure Overview. Under the ADS Distribution Agreement (Ref. SBD-ADS-2024-0315, dated March 15, 2024), Solstice has granted ADS exclusive US distribution rights for the Pulsar CRM System. ADS's compensation consists of a commission equal to 18% of net US sales, which, based on Solstice's Year-1 revenue pr

II.B. False Claims Act Analysis (31 U.S.C. §§ 3729–3733)

II.B.1. Overview. The federal False Claims Act ("FCA") imposes liability on any person who knowingly submits or causes the submission of a false or fraudulent claim for payment to the federal government, or who knowingly makes a false record or statement material to a false or fraudulent claim. The FCA's penalties are severe: violators are subject to treble damages (three times the amount of damages sustained by the

II.B.2. Implied Certification Theory. The implied certification theory of FCA liability holds that when a party submits a claim for federal healthcare program reimbursement, it impliedly certifies compliance with the laws, regulations, and contractual conditions that are prerequisites to payment — including compliance with the AKS. In Universal Health Services, Inc. v. United States ex rel. Escobar, 579 U.S. 176 (201

II.B.3. Risk Mitigation. The existence of a robust compliance program is a significant mitigating factor in government enforcement decisions regarding FCA liability. The DOJ's guidance on corporate compliance programs, as well as OIG guidance, recognizes that the existence and effectiveness of a company's compliance program may be considered in determining whether to bring an enforcement action, the terms of any sett

II.C. Physician Payments Sunshine Act / Open Payments Compliance (42 U.S.C. § 1320a-7h)

II.C.1. Statutory and Regulatory Overview. The Physician Payments Sunshine Act, codified at 42 U.S.C. § 1320a-7h, requires applicable manufacturers of covered drugs, devices, biologicals, and medical supplies to report annually to the Centers for Medicare & Medicaid Services ("CMS") certain payments and other transfers of value made to covered recipients. CMS publishes this data on its Open Payments website, making i

II.C.2. Reporting Thresholds (CY2024). For calendar year 2024, the per-instance reporting threshold is $12.49, and the aggregate annual threshold is $100 per covered recipient. Any individual payment or transfer of value meeting or exceeding $12.49 must be reported. Additionally, if the aggregate value of all payments or transfers of value to a single covered recipient in a calendar year meets or exceeds $100, all su

II.C.3. Estimated Year-1 Reportable Transfers. Based on Solstice's planned physician engagement programs and commercial activities, C&H estimates that total Year-1 reportable transfers of value will be approximately $650,000, broken down as follows: This estimate represents a significant reporting obligation, and the data collection and tracking infrastructure must be robust enough to capture, validate, and report ev

II.C.4. CMS Registration and Reporting. Solstice submitted its CMS Manufacturer ID application in June 2024. As of the date of this Report, the application remains pending. It is critical that this registration be finalized before the October 1, 2024 launch date to ensure that Solstice is prepared to comply with its Open Payments reporting obligations from the first day of commercial activity. Reportable data for CY2

II.C.5. Distributor Pass-Through Reporting. Under the Open Payments regulations, an applicable manufacturer is responsible for reporting not only payments and transfers of value that it makes directly to covered recipients, but also those made by agents, distributors, or other third parties acting on its behalf or at its direction. This "pass-through" reporting requirement has direct implications for Solstice's relat

1. Assign Open Payments reporting responsibility to Theresa Brennan (Director, US Regulatory Affairs), with compliance oversight by Siobhán Mulcahy (Head of Global Compliance / interim US Compliance Officer) or her successor.

2. Implement an automated tracking system for Open Payments data collection, integrated with Solstice's customer relationship management (CRM) platform and expense management system. The system must be capable of capturing, in real time, all transfers of value to covered recipients, including consulting fees, speaker honoraria, meals, travel, and any other items of value. The system should generate reports in CMS-com

3. Establish a dispute resolution and data review process to manage the 45-day physician review window preceding CMS publication.

4. Implement data validation procedures and quality controls, including periodic reconciliation of Open Payments tracking data against accounts payable records, consulting and speaker program records, and expense reports.

5. Ensure ADS reporting obligations are formalized through the proposed Distribution Agreement amendments before the launch date.

II.D. FDA Promotional and Advertising Compliance

II.D.1. Regulatory Framework for Class II Device Promotion. The Pulsar CRM System received FDA 510(k) clearance on February 9, 2024, under Clearance No. K232847, as a Class II medical device. As a 510(k)-cleared device, the Pulsar CRM System may be legally marketed in the United States for its cleared intended use: continuous cardiac rhythm monitoring in adult patients with suspected or documented cardiac arrhythmias

II.D.2. Review of Draft Promotional Materials. C&H, in consultation with Meridian Consulting Group, conducted a detailed review of Solstice's draft promotional materials, including sales aids, detail pieces, website content, and sales training decks, prepared under the direction of Patrick Dunne, Director, US Marketing. The review identified several areas requiring revision to ensure alignment with the 510(k) cleared

1. Performance claims exceeding scope of 510(k) clearance data. Certain draft materials included quantitative performance claims — including statements regarding detection sensitivity and specificity rates — that were derived from internal bench testing or non-US clinical data not included in the 510(k) submission. Promotional claims must be limited to data that is substantiated by the evidence submitted to and revie

2. Comparative claims against predicate device. The draft materials contained several comparative claims against the CardioStar™ SC-200, the predicate device manufactured by Vantage Medical Technologies Inc. (510(k) No. K201156). While comparative claims are not per se prohibited, they must be truthful, non-misleading, and adequately substantiated. Certain of the comparative claims in the draft materials — particular

3. Draft website language implying broader patient population. Portions of the draft website copy described the Pulsar CRM System in terms that could be interpreted as suggesting its applicability to pediatric patients or to patient populations not within the cleared intended use (adult patients with suspected or documented cardiac arrhythmias). This language must be revised to clearly delineate the cleared patient p

4. Fair balance. Several draft materials lacked adequate presentation of risks, contraindications, and warnings alongside efficacy and performance claims. FDA requires that promotional materials present a fair balance of information regarding the benefits and risks of a device. All promotional materials must be revised to include a balanced presentation of risks, contraindications, and warnings drawn from the device'

II.D.3. Form 2253 Obligations. Under 21 C.F.R. § 807.81(a)(3), the manufacturer of a 510(k)-cleared device must submit advertisements and promotional labeling to FDA at the time of initial dissemination. This submission is made using FDA Form 2253 ("Premarket Notification: Advertisement and Promotional Labeling for Devices"). Solstice must file Form 2253 with each new advertisement or piece of promotional labeling at

II.D.4. Medical-Legal-Regulatory (MLR) Review Committee. C&H strongly recommends that Solstice establish a permanent Medical-Legal-Regulatory (MLR) Review Committee before any promotional materials are finalized or disseminated in connection with the US launch. The purpose of the MLR Committee is to ensure that all promotional materials, sales training content, speaker slide decks, website content, social media posts

II.D.5. Social Media and Digital Marketing. Solstice's US marketing strategy includes a digital marketing component that involves social media platforms, the Company's website, email marketing, and potentially other digital channels. The promotion of medical devices through digital and social media channels is subject to the same FDA requirements that apply to traditional promotional materials, including the prohibit

III. STATE-BY-STATE COMPLIANCE REQUIREMENTS AND ACTION ITEMS

III.A. Overview and Methodology In addition to the federal regulatory framework described in Section II, Solstice's US sales and marketing activities are subject to a patchwork of state laws and regulations that impose additional requirements on medical device manufacturers, including manufacturer registration, aggregate spend reporting, gift bans, marketing code adoption mandates, and pricing transparency disclosure

III.B. States Requiring Registration or Fee Payment

III.B.1. Vermont. Vermont requires manufacturers of prescription drugs and medical devices to register with the Vermont Office of the Attorney General before engaging in marketing activities within the state.