Company: OFIX
Filing Date: 2025-04-30
Form Type: DEF 14A
Source: 0000950170-25-061062
Chunk: 31

Company: Orthofix Medical Inc.
Filing Date: 2025-04-30
Form: DEF 14A
Chunk 31
---
 ethics program to promote lawful and ethical business practices throughout our company, and we require that all of our employees complete annual compliance training. Similarly, we require that our suppliers adopt sound human rights practices designed to treat workers fairly and with dignity and respect. We responsibly manage and influence the impacts of our distributors through compliance and governance training. We emphasize a culture of accountability and conduct our business in a manner that is fair, ethical, and responsible to earn the trust of our stakeholders.Orthofix has comprehensive corporate governance policies and structures in place to foster accountability and transparency for our management team. These policies reflect our underlying commitment to maintain high standards of ethics and integrity and to operate our business in compliance with all applicable anti-corruption, anti-bribery, and antitrust laws and regulations.Orthofix recognizes that identifying and managing enterprise risks is critically important to the long-term success of our business. We rely on a comprehensive risk management process to aggregate, monitor, measure, and mitigate risks. Although we do not have full control over our supply chain, nor the suppliers with whom we do business, we continually seek to partner with suppliers that share common values and a shared commitment to our sustainability objectives.As a global leader in the medical device industry, we are a trusted partner that meets the industry’s high bar for data resiliency and security. We have implemented robust cybersecurity programs to |

<div align='center'>23</div>

| ensure compliance with applicable laws and regulations governing ethical business practices, including our relationships with suppliers, customers, and business partners. Our IT team uses a combination of industry-leading tools and innovative technologies to help protect our stakeholders’ data. Our employees are responsible for complying with our data security standards and complete mandatory new hire and annual training to understand the behaviors and technical requirements necessary to keep data secure. We leverage the latest encryption configurations and technologies on our systems, devices, and third-party connections and further vet third party vendors’ encryption, as required, through our vendor management process.Our Information Security Policy and related compliance program is based on the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework. Orthofix’s team of cybersecurity professionals rigorously conduct audits and penetration testing of our network to ensure our cybersecurity defenses are operating effectively. In 2024, we continued to safeguard our data and ensure protection against threats such as ransomware. We engage with an external professional services organization to assess our maturity against the NIST Cybersecurity Framework. The results of the assessment are shared by our Chief Information Officer with our Board and Audit & Finance Committee who