Vendor Code of Conduct

Organ Recovery Systems, Inc., Lifeline Scientific, Inc., and Affiliated Companies

Version: Rev. 1.0 | Last Updated: September 15, 2026

This Vendor Code of Conduct describes the ethical, legal, regulatory, quality, labor, environmental, and reporting standards ORS expects from vendors and other third parties performing work for or on behalf of ORS.

This Code should be read with applicable agreements, purchase orders, quality agreements, distributor requirements, and ORS policies or procedures. If any written ORS requirement is stricter than this Code, the stricter requirement controls, subject to the terms of the governing agreement.

This Code reflects ORS’s current compliance expectations for vendors and other third parties and may be updated periodically to reflect changes in law, regulation, industry standards, Company policy.

1. PURPOSE

ORS is committed to ethical, responsible, and lawful business conduct and expects vendors to maintain standards consistent with ORS values, policies, and compliance expectations.

Questions regarding this Code or its application should be directed to the vendor’s ORS business contact or to the ORS Compliance Department at ORScompliance@organ-recovery.com.

2. SCOPE

This Code applies to all suppliers, vendors, contractors, consultants, distributors, agents, logistics providers, contract manufacturers, service providers, subcontractors, affiliate service organizations, and other third parties providing goods or services to ORS or acting for or on behalf of ORS.

3. COMPLIANCE WITH LAWS

Vendors must comply with all laws and regulations applicable to their ORS work, including healthcare and medical device requirements, trade controls, competition laws, anti-corruption rules, privacy and cybersecurity laws, labor and employment laws, environmental requirements, and licensing, permit, certification, and registration obligations.

4. BUSINESS INTEGRITY

4.1 Anti-Bribery and Anti-Corruption

Vendors must not offer bribes, kickbacks, facilitation payments, improper gifts or entertainment, or anything of value intended to improperly influence a decision. Vendors must maintain accurate books, records, and internal controls and comply with applicable anti-corruption laws, including the U.S. Foreign Corrupt Practices Act and UK Bribery Act.

4.2 Government Officials

Vendors must exercise enhanced caution with government officials, public healthcare institutions, government-employed healthcare professionals, customs officials, and state-owned enterprises, and may not provide any payment, gift, favor, employment opportunity, charitable contribution, or other benefit to improperly influence an official decision.

5. HEALTHCARE COMPLIANCE

Vendors interacting with healthcare professionals, healthcare organizations, hospitals organ procurement organizations, or other healthcare stakeholders must comply with applicable healthcare compliance requirements. Vendors must not offer inducements to influence purchasing decisions, provide improper meals, gifts, travel, entertainment, or remuneration, circumvent transparency reporting, or engage in conduct that could violate healthcare fraud and abuse laws. When acting for or

on behalf of ORS, vendors must comply with applicable healthcare compliance and transparency requirements, including, as applicable, the U.S. Anti-Kickback Statute, the U.S. Physician Payments Sunshine Act, the AdvaMed Code of Ethics, Article 10 of the Belgian Medicines Act of 25 March 1964, Articles 41–48 of the Act of 18 December 2016 on Various Health Provisions, the Royal Decree of 14 June 2017 implementing the Belgian Sunshine Act, MedTech Europe guidance, and any other applicable transparency or transfer-of-value requirements. Vendors must seek guidance before engaging in any uncertain interaction or transfer of value.

6. CONFLICTS OF INTEREST

Vendors must promptly disclose actual, potential, or perceived conflicts of interest, including financial interests involving ORS employees; relationships with healthcare professionals, government officials, or other parties that may affect ORS business; ownership interests that could influence purchasing decisions; and family relationships that could create business influence concerns. Failure to disclose a material conflict may result in termination.

7. FAIR COMPETITION

Vendors must compete fairly and may not participate in price fixing, exchange competitively sensitive information, allocate markets or customers, rig bids, or otherwise restrict lawful competition. Marketing, sales, and competitive activities must be truthful, accurate, and lawful.

8. QUALITY AND REGULATORY COMPLIANCE

Vendors supporting regulated products or services must maintain appropriate quality systems to meet applicable regulations to the products or services they are providing, which may include documented procedures, trained personnel, complaint handling and traceability controls, post-market support, change and issue notification, audit cooperation, and corrective and preventive action processes. Vendors must not distribute, ship, or use products known or reasonably suspected to be damaged, adulterated, counterfeit, recalled, or nonconforming. Furthermore, vendors must promptly notify ORS if they become aware that shipped or delivered goods or services may be nonconforming, defective, counterfeit, expired, contaminated, improperly documented, or otherwise unsuitable.

9. DATA PRIVACY AND CYBERSECURITY

Vendors must protect ORS confidential, proprietary, technical, pricing, customer, trade secret, and other non-public information, use it only for authorized ORS business purposes, and disclose it only with appropriate authorization. Vendors must maintain reasonable technical and organizational safeguards, restrict access to authorized users, comply with applicable privacy laws, promptly report suspected security incidents, maintain appropriate continuity capabilities, and ensure any AI use protects ORS confidentiality.

10. INTERNATIONAL TRADE COMPLIANCE

Vendors must comply with applicable import, export, sanctions, customs, and trade restrictions; avoid prohibited countries, sanctioned parties, unauthorized diversions, trade-control circumvention, and false customs documentation; and maintain procedures to identify restricted parties involved in ORS business. Vendors must promptly notify ORS if they or personnel involved in ORS-related activities become debarred, excluded, suspended, restricted, sanctioned, or otherwise ineligible to participate in government programs, healthcare activities, or ORS-related work.

11. HUMAN RIGHTS AND LABOR PRACTICES

Vendors must respect internationally recognized human rights principles and maintain lawful employment practices that protect worker dignity, safety, wages, benefits, working hours, leave, rest periods, and employment records throughout their operations and supply chains.

Vendors must prohibit forced labor, child labor, human trafficking, physical abuse, harassment, discrimination, retaliation, unlawful deductions, and work hours exceeding legal limits.

Wages, overtime pay, benefits, leave, deductions, rest periods, and other compensation and working-condition practices must comply with applicable wage-and-hour laws, employment contracts, collective bargaining obligations, and legally required benefit programs.

12. ENVIRONMENTAL RESPONSIBILITY

Vendors must comply with environmental laws and take practical steps to reduce waste, prevent pollution, improve resource efficiency, manage environmental risks, safely handle hazardous materials, provide relevant training, and monitor and control air emissions and other environmental impacts.

13. THIRD-PARTY MANAGEMENT

Vendors must conduct appropriate due diligence, monitor subcontractor compliance, flow down equivalent obligations, require adherence to applicable laws and this Code, and notify ORS before engaging subcontractors that may materially affect ORS product quality, regulatory compliance, data security, delivery performance, or supply continuity.

14. RECORDS, AUDITS, AND MONITORING

Vendors must maintain accurate ORS-related records, provide appropriate training or communications for personnel and subcontractors involved in higher-risk ORS activities, retain records as required by law, contract, quality agreement, or ORS instruction, and not alter, conceal, or destroy records to avoid review. ORS may request compliance information, conduct reviews or audits where permitted, require corrective action plans, and verify remediation.

15. REPORTING CONCERNS

Vendors must promptly report suspected violations involving corruption, fraud, quality or product safety issues, privacy incidents, regulatory violations, conflicts of interest, human rights concerns, or other misconduct.

Vendors must not retaliate, threaten, discipline, discriminate against, or take adverse action against anyone who raises a concern in good faith or cooperates with a review, audit, or investigation.

Reports should be made through the vendor’s ORS business contact, the ORS Compliance Department ORScompliance@organ-recovery.com, or any other ORS reporting channel, and should include enough information for appropriate review.

16. CONSEQUENCES OF NONCOMPLIANCE

Violations may result in corrective action, enhanced monitoring, withheld approvals, contractual remedies, suspension of activities, or termination of the business relationship.